IPv6 multicast address leak (2.4.*)

["David Stevens" <dlstevens@xxxxxxxxxx>]

     When joining a multicast group with ifindex == 0, we get to
ipv6_sock_mc_join() which uses the routing table to find an interface when
the index doesn't specify one.
     The code also saves the interface index (as passed by the user) in
mc_list.

     When leaving a multicast group, we call ipv6_sock_mc_drop(), which
has this code

>                     if ((dev = dev_get_by_index(mc_lst->ifindex)) != NULL) {
>                               ipv6_dev_mc_dec(dev, &mc_lst->addr);
>                               dev_put(dev);
>                      }

     In the case where ifindex passed was 0, this won't find the interface
we added the multicast address to, won't remove the reference, etc.

                                   +-DLS

Fix:
     In ipv6_sock_mc_join(), set the mc_list index based on the device we
actually use:

diff -urN linux/net/ipv6/mcast.c linux.NEW/net/ipv6/mcast.c
--- linux/net/ipv6/mcast.c    Thu Apr 26 22:17:26 2001
+++ linux.NEW/net/ipv6/mcast.c     Tue Aug 14 17:01:42 2001
@@ -90,7 +90,6 @@

     mc_lst->next = NULL;
     memcpy(&mc_lst->addr, addr, sizeof(struct in6_addr));
-    mc_lst->ifindex = ifindex;

     if (ifindex == 0) {
          struct rt6_info *rt;
@@ -107,6 +106,8 @@
          sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
          return -ENODEV;
     }
+
+    mc_lst->ifindex = dev->ifindex;

     /*
      *   now add/increase the group membership on the device