Commit cdf104cb5f for frr
commit cdf104cb5f2d66c687f8c1b9f2d65a491b07b041
Author: Suresh Kumar <surkumar@redhat.com>
Date: Wed Apr 22 17:54:14 2026 +0530
pimd: Fix sockaddr corruption in ssmpingd multicast reply
The multicast reply in ssmpingd_read_msg() was incorrectly copying a
pim_addr (which is just an in_addr or in6_addr) directly into a
sockaddr_storage structure. This corrupted the socket address because
it didn't properly set the address family, port, or other sockaddr
fields.
router debug throws below error while trying to send multicast packets:
[WARN] pimd: [X1BS5-ZV5QM] ssmpingd_sendto: sendto() failure to (af 11240),fd=22 len=38: errno=97: Address family not supported by protocol
[WARN] pimd: [X1BS5-ZV5QM] ssmpingd_sendto: sendto() failure to (af 11240),fd=22 len=38: errno=97: Address family not supported by protocol
[WARN] pimd: [X1BS5-ZV5QM] ssmpingd_sendto: sendto() failure to (af 11240),fd=22 len=38: errno=97: Address family not supported by protocol
gdb analysis confirms address family is overwritten by memcpy():
303 memcpy(&from, &ss->pim->ssmpingd_group_addr, sizeof(pim_addr));
(gdb) p from->ss_family
$1 = 2
(gdb) n
304 ssmpingd_sendto(ss, buf, len, from);
(gdb) p from->ss_family
$2 = 11240 <-------------------------------------- corrupted
(gdb)
Fix by properly modifying the address field, preserving the protocol
family and other data.
Tested ok
=========
$ sudo nsenter -a -t $(cat /tmp/topotests/pim_basic.test_pim/r1.pid) bash
root@r1:/# ssmping -I r1-eth0 10.0.20.2
ssmping joined (S,G) = (10.0.20.2,232.43.211.234)
pinging S from 10.0.20.1
unicast from 10.0.20.2, seq=1 dist=0 time=0.144 ms
multicast from 10.0.20.2, seq=1 dist=0 time=0.161 ms
unicast from 10.0.20.2, seq=2 dist=0 time=0.368 ms
multicast from 10.0.20.2, seq=2 dist=0 time=0.395 ms
unicast from 10.0.20.2, seq=3 dist=0 time=0.148 ms
multicast from 10.0.20.2, seq=3 dist=0 time=0.163 ms
unicast from 10.0.20.2, seq=4 dist=0 time=0.222 ms (edited)
Signed-off-by: Suresh Kumar <surkumar@redhat.com>
diff --git a/pimd/pim_ssmpingd.c b/pimd/pim_ssmpingd.c
index d245805d58..250abb0e71 100644
--- a/pimd/pim_ssmpingd.c
+++ b/pimd/pim_ssmpingd.c
@@ -300,7 +300,11 @@ static int ssmpingd_read_msg(struct ssmpingd_sock *ss)
ssmpingd_sendto(ss, buf, len, from);
/* multicast reply */
- memcpy(&from, &ss->pim->ssmpingd_group_addr, sizeof(pim_addr));
+#if PIM_IPV == 4
+ ((struct sockaddr_in *)&from)->sin_addr = ss->pim->ssmpingd_group_addr;
+#else
+ ((struct sockaddr_in6 *)&from)->sin6_addr = ss->pim->ssmpingd_group_addr;
+#endif
ssmpingd_sendto(ss, buf, len, from);
return 0;