]> git.puffer.fish Git - matthieu/frr.git/commit
bgpd: fix invalid memory access in peer_free()
authorRenato Westphal <renato@opensourcerouting.org>
Mon, 28 Nov 2016 17:00:05 +0000 (15:00 -0200)
committerRenato Westphal <renato@opensourcerouting.org>
Mon, 28 Nov 2016 18:46:22 +0000 (16:46 -0200)
commitf4f59de462018e48c639978cfe57cf4301a0d209
tree24c5d6c3eea911806083722ecb5a7721a9552808
parent5a8dfcd891fd12bb9db8f504bf3a083cea4f3cbd
bgpd: fix invalid memory access in peer_free()

We shoult not call bgp_unlock() before calling
bgp_delete_connected_nexthop() in the peer_free() function. Otherwise,
if bgp->lock reaches zero, bgp_free() is called and peer->bgp becomes
an invalid pointer in the bgp_delete_connected_nexthop() function.

To fix this, move the call to bgp_unlock() to the end of peer_free().

Bug exposed by commit 37d361e ("bgpd: plug several memleaks").

Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
bgpd/bgpd.c