]> git.puffer.fish Git - mirror/frr.git/commit
bgpd: bgp_packet_process_error can access peer after deletion 9356/head
authorDonald Sharp <sharpd@nvidia.com>
Sun, 8 Aug 2021 12:23:24 +0000 (08:23 -0400)
committermergify-bot <noreply@mergify.io>
Tue, 10 Aug 2021 13:37:35 +0000 (13:37 +0000)
commit4e21262edddeeb805bc1a2aab237995f365b8a58
tree2c370dd0b23b656cb65e15f8a838a5ccc98055d0
parent507e91353dec04c445c6f1e34b7cb6adbb89ae27
bgpd: bgp_packet_process_error can access peer after deletion

in bgp_io.c upon packet read of some error we are storing
the peer pointer on a thread to call bgp_packet_process_error.
In this case an event is generated that is not guaranteed to be
run immediately.  It could come in *after* the peer data structure
is deleted and as such we now are writing into memory that we
no longer possibly own as a peer data structure.

Modify the code so that the peer can track the thread associated
with the read error and then it can wisely kill that thread
when deleting the peer data structure.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
(cherry picked from commit 1fae5c8e289f3a0dd6615663fe53d5fae19f53ff)
bgpd/bgp_io.c
bgpd/bgpd.h