zebra: fix segfault on exit when RIB debugging is enabled

Fixes the following crash on exit:
(gdb) bt
0  _rnode_zlog (...) at zebra_rib.c:104
1  0x0000000000417726 in rib_unlink (...) at zebra_rib.c:2370
2  0x000000000042db80 in zebra_rtable_node_destroy (...) at zebra_vrf.c:336
3  0x00007ffff7b6ce2e in route_node_free (...) at table.c:81
4  0x00007ffff7b6ced7 in route_table_free (...) at table.c:118
5  0x00007ffff7b6cd88 in route_table_finish (...) at table.c:53
6  0x000000000042defa in zebra_vrf_delete (...) at zebra_vrf.c:278
7  0x00007ffff7b9e044 in vrf_delete (...) at vrf.c:162
8  0x00007ffff7b9e89f in vrf_terminate () at vrf.c:458
9  0x000000000041027c in sigint () at main.c:205
10 0x00007ffff7b953f2 in quagga_sigevent_process () at sigevent.c:111
11 0x00007ffff7b681dd in thread_fetch (...) at thread.c:1297
12 0x000000000040c7ed in main (...) at main.c:471

To fix the problem, free the table->info pointer only after
route_table_finish() is called for the table.

Signed-off-by: Renato Westphal <renato@opensourcerouting.org>

diff --git a/zebra/zebra_vrf.c b/zebra/zebra_vrf.c
index bf42792cf8186ce826193710f1dc16858b8316ed..929743859e76e119f07d378b1b0551439ca7fe67 100644 (file)
--- a/zebra/zebra_vrf.c
+++ b/zebra/zebra_vrf.c
@@ -271,11 +271,14 @@ zebra_vrf_delete (struct vrf *vrf)
   /* release allocated memory */
   for (afi = AFI_IP; afi <= AFI_IP6; afi++)
     {
+      void *table_info;
+
       for (safi = SAFI_UNICAST; safi <= SAFI_MULTICAST; safi++)
        {
          table = zvrf->table[afi][safi];
-         XFREE (MTYPE_RIB_TABLE_INFO, table->info);
+         table_info = table->info;
          route_table_finish (table);
+         XFREE (MTYPE_RIB_TABLE_INFO, table_info);
 
          table = zvrf->stable[afi][safi];
          route_table_finish (table);
@@ -285,8 +288,9 @@ zebra_vrf_delete (struct vrf *vrf)
        if (zvrf->other_table[afi][table_id])
          {
            table = zvrf->other_table[afi][table_id];
-           XFREE (MTYPE_RIB_TABLE_INFO, table->info);
+           table_info = table->info;
            route_table_finish (table);
+           XFREE (MTYPE_RIB_TABLE_INFO, table_info);
          }
 
       route_table_finish (zvrf->rnh_table[afi]);