Netstack: Check address matches the endpoint protocol for IP_DROP_MEMBERSHIP

According to syzkaller report, the setsockopt option used was 0x24, which
matches with IP_DROP_MEMBERSHIP for which we did not have the equivalent check
that we had for IP_ADD_MEMBERSHIP.

Reported-by: syzbot+923097b958e5b74950d1@syzkaller.appspotmail.com
PiperOrigin-RevId: 487840922

pkg/tcpip/tests/integration/multicast_broadcast_test.go

@@ -817,11 +817,16 @@ func TestMismatchedMulticastAddressAndProtocol(t *testing.T) {
 		InterfaceAddr: utils.Ipv4Addr.Address,
 	}
 
-	// Add membership should succeed when the interface index is specified,
+	// Add/remove membership should succeed when the interface index is specified,
 	// even if a bad interface address is specified.
 	addOpt := tcpip.AddMembershipOption(memOpt)
 	expErr := &tcpip.ErrInvalidOptionValue{}
 	if err := ep.SetSockOpt(&addOpt); err != expErr {
 		t.Fatalf("ep.SetSockOpt(&%#v): want %q, got %q", addOpt, expErr, err)
 	}
+
+	removeOpt := tcpip.RemoveMembershipOption(memOpt)
+	if err := ep.SetSockOpt(&removeOpt); err != expErr {
+		t.Fatalf("ep.SetSockOpt(&%#v): want %q, got %q", addOpt, expErr, err)
+	}
 }

pkg/tcpip/transport/internal/network/endpoint.go

@@ -951,7 +951,7 @@ func (e *Endpoint) SetSockOpt(opt tcpip.SettableSocketOption) tcpip.Error {
 		e.multicastMemberships[memToInsert] = struct{}{}
 
 	case *tcpip.RemoveMembershipOption:
-		if !header.IsV4MulticastAddress(v.MulticastAddr) && !header.IsV6MulticastAddress(v.MulticastAddr) {
+		if !(header.IsV4MulticastAddress(v.MulticastAddr) && e.netProto == header.IPv4ProtocolNumber) && !(header.IsV6MulticastAddress(v.MulticastAddr) && e.netProto == header.IPv6ProtocolNumber) {
 			return &tcpip.ErrInvalidOptionValue{}
 		}