]> git.puffer.fish Git - mirror/frr.git/commit
ospf6d: clear lsa->refresh before clearing LSAs
authorDavid Lamparter <equinox@opensourcerouting.org>
Mon, 9 Dec 2013 15:48:55 +0000 (16:48 +0100)
committerDavid Lamparter <equinox@opensourcerouting.org>
Tue, 18 Mar 2014 07:45:29 +0000 (08:45 +0100)
commit11b4f01355703d34099d4da145c7d92e32d98636
treee895a3794edbfe60c481954ed4ad79fcc2b661c3
parentb13c1d9299d6426f48f074545f3e403e5a9b8a61
ospf6d: clear lsa->refresh before clearing LSAs

This fixes a SEGV when we receive a higher-SeqNum copy of a LSA that we
originated ourselves, before a reboot of ospf6d.  We create a new
copy of the LSA to resync the SeqNum, but then half an hour later
the old refresh thread ends up trying to refresh the free()'d old LSA.

The SEGV is triggered by this chain:
  ospf6_lsdb_maxage_remover
  -> thread_execute(ospf6_lsa_refresh)
     -> old->refresh = NULL
Which assumes that old->refresh is no longer scheduled to run, as it is
being run right there.  But the thread_execute() doesn't know about
old->refresh and therefore didn't remove it.

(Found by ANVL OSPFV3-16.17)

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
ospf6d/ospf6_flood.c
ospf6d/ospf6_lsdb.c