bgpd: backpressure - Avoid use after free

Coverity complains there is a use after free (1598495 and 1598496)
At this point, most likely dest->refcount cannot go 1 and free up
the dest, but there might be some code path where this can happen.

Fixing this with a simple order change (no harm fix).

Ticket :#4001204

Signed-off-by: Rajasekar Raja <rajasekarr@nvidia.com>
(cherry picked from commit 40965e599975b019bbe6f4b1dfb3ff22d8980876)

diff --git a/bgpd/bgp_evpn.c b/bgpd/bgp_evpn.c
index 9a796ef91b4bc8d7c2aec03db107c6c76506c2cc..0485bbac6464e2db4b6982610a535f20c0ebe86c 100644 (file)
--- a/bgpd/bgp_evpn.c
+++ b/bgpd/bgp_evpn.c
@@ -6338,9 +6338,9 @@ void bgp_evpn_free(struct bgp *bgp, struct bgpevpn *vpn)
             dest = dest_next) {
                dest_next = zebra_announce_next(&bm->zebra_announce_head, dest);
                if (dest->za_vpn == vpn) {
+                       zebra_announce_del(&bm->zebra_announce_head, dest);
                        bgp_path_info_unlock(dest->za_bgp_pi);
                        bgp_dest_unlock_node(dest);
-                       zebra_announce_del(&bm->zebra_announce_head, dest);
                }
        }
 

diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index 08d1268e9e6bf42fda1190a36045a9d106b75487..894226adac53581520d0453cdd78c009f998b83a 100644 (file)
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -3930,9 +3930,9 @@ int bgp_delete(struct bgp *bgp)
                dest_next = zebra_announce_next(&bm->zebra_announce_head, dest);
                dest_table = bgp_dest_table(dest);
                if (dest_table->bgp == bgp) {
+                       zebra_announce_del(&bm->zebra_announce_head, dest);
                        bgp_path_info_unlock(dest->za_bgp_pi);
                        bgp_dest_unlock_node(dest);
-                       zebra_announce_del(&bm->zebra_announce_head, dest);
                }
        }