ospfd: cancel SR thread at shutdown

Otherwise if it is scheduled the thread pointer will be accessed after
the shutdown task finishes accessing, having deleted the structure that
owns said pointer, which causes a heap UAF.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>

diff --git a/ospfd/ospfd.c b/ospfd/ospfd.c
index 86a3293d7110bc4987e5ba0fc3438814eeaf2924..eda0fd477312c2bdbb2d7839498d7406aca8e11e 100644 (file)
--- a/ospfd/ospfd.c
+++ b/ospfd/ospfd.c
@@ -704,6 +704,7 @@ static void ospf_finish_final(struct ospf *ospf)
        OSPF_TIMER_OFF(ospf->t_read);
        OSPF_TIMER_OFF(ospf->t_write);
        OSPF_TIMER_OFF(ospf->t_opaque_lsa_self);
+       OSPF_TIMER_OFF(ospf->t_sr_update);
 
        close(ospf->fd);
        stream_free(ospf->ibuf);