]> git.puffer.fish Git - matthieu/frr.git/commit
pimd: crash fix when RP is removed
authorMobashshera Rasool <mrasool@vmware.com>
Tue, 4 Aug 2020 06:24:29 +0000 (06:24 +0000)
committerMobashshera Rasool <mrasool@vmware.com>
Wed, 5 Aug 2020 05:49:14 +0000 (05:49 +0000)
commit4b67fe2df396398bda3cd646fa14c6789932f6bb
treec063553174e08831b7421f81b0e1c222edb2243d
parentde5f29dabda30d58c8b25e82245b9ad2bae485b4
pimd: crash fix when RP is removed

pimd crash at pim_msg_build_jp_groups (
grp=grp@entry=0x7ffca55b5d1e, sgs=sgs@entry=0x17821a0, size=20)
 at pimd/pim_msg.c:198

Fix for https://github.com/FRRouting/frr/issues/6849

Root Cause:
===========
pimd has crashed because pim_upstream_rpf_clear function sets the
up->rpf.source_nexthop.interface pointer to NULL and has not removed
the upstream source node from the neighbor. When the upstream gets
deleted the source is not removed from neighbor
neigh->upstream_jp_agg->groups->sources list. This source node has
pointer to upstream freed memory. Hence when on_neighbor_jp_timer expires,
it tries to access the upstream pointer and crashed.

Fix:
====
Before setting the interface pointer to NULL, remove the node from
neigh->upstream_jp_agg->groups->sources list. Also the upstream state
has to be changed to Not joined.

Removed extra line changes.

Signed-off-by: Mobashshera Rasool <mrasool@vmware.com>
pimd/pim_rpf.c