bgpd: free rfapi callback object always

An rfapi timer callback is responsible for the memory in a
context object, even in special-case exit paths. Always
free that object.

Signed-off-by: Mark Stapp <mjs@labn.net>
(cherry picked from commit 870d3d2cb8e2fa6ff9329ec7126265d1e25a38ae)

diff --git a/bgpd/rfapi/rfapi_import.c b/bgpd/rfapi/rfapi_import.c
index 2aae0bc6167260596e3a08961fb3f40d9addbc4d..f8d950b8dbff7686641e25e96c40cc8896a315fa 100644 (file)
--- a/bgpd/rfapi/rfapi_import.c
+++ b/bgpd/rfapi/rfapi_import.c
@@ -2344,8 +2344,7 @@ static void rfapiMonitorEncapDelete(struct bgp_path_info *vpn_bpi)
 }
 
 /*
- * quagga lib/thread.h says this must return int even though
- * it doesn't do anything with the return value
+ * Timer callback for withdraw
  */
 static void rfapiWithdrawTimerVPN(struct thread *t)
 {
@@ -2355,19 +2354,27 @@ static void rfapiWithdrawTimerVPN(struct thread *t)
        const struct prefix *p;
        struct rfapi_monitor_vpn *moved;
        afi_t afi;
+       bool early_exit = false;
 
        if (bgp == NULL) {
                vnc_zlog_debug_verbose(
                    "%s: NULL BGP pointer, assume shutdown race condition!!!",
                    __func__);
-               return;
+               early_exit = true;
        }
-       if (CHECK_FLAG(bgp->flags, BGP_FLAG_DELETE_IN_PROGRESS)) {
+       if (bgp && CHECK_FLAG(bgp->flags, BGP_FLAG_DELETE_IN_PROGRESS)) {
                vnc_zlog_debug_verbose(
                        "%s: BGP delete in progress, assume shutdown race condition!!!",
                        __func__);
+               early_exit = true;
+       }
+
+       /* This callback is responsible for the withdraw object's memory */
+       if (early_exit) {
+               XFREE(MTYPE_RFAPI_WITHDRAW, wcb);
                return;
        }
+
        assert(wcb->node);
        assert(bpi);
        assert(wcb->import_table);