[ospfd] early-return in nsm_event missed LLDown event, fixes use after free

2006-07-06 Paul Jakma <paul.jakma@sun.com>

	* ospf_nsm.c: (ospf_nsm_event) LLDown event also results in nbr
	  being deleted, requires early-return too. Likely explains
	  some crash reports after interface events.

diff --git a/ospfd/ChangeLog b/ospfd/ChangeLog
index 054935b30f1dc9914ce20bde4b205b2cc3dcac66..b4f7d3e74b90ed2574b802c8a353a85167029dca 100644 (file)
--- a/ospfd/ChangeLog
+++ b/ospfd/ChangeLog
@@ -1,3 +1,9 @@
+2006-07-06 Paul Jakma <paul.jakma@sun.com>
+
+       * ospf_nsm.c: (ospf_nsm_event) LLDown event also results in nbr
+         being deleted, requires early-return too. Likely explains
+         some crash reports after interface events.
+
 2006-07-04 Paul Jakma <paul.jakma@sun.com>
 
        * ospf_nsm.c: (general) Various small cleanups from Andrew's

diff --git a/ospfd/ospf_nsm.c b/ospfd/ospf_nsm.c
index 11da503e46dd338b1d0e3c2d8bc2bbfdcf9d856b..fb736eba78539407b664c391ada3fd358403029f 100644 (file)
--- a/ospfd/ospf_nsm.c
+++ b/ospfd/ospf_nsm.c
@@ -857,7 +857,9 @@ ospf_nsm_event (struct thread *thread)
 
   /* When event is NSM_KillNbr or InactivityTimer, the neighbor is
      deleted. */
-  if (event == NSM_KillNbr || event == NSM_InactivityTimer)
+  if (event == NSM_KillNbr 
+      || event == NSM_InactivityTimer
+      || event == NSM_LLDown)
     {
       if (IS_DEBUG_OSPF (nsm, NSM_EVENTS))
        zlog_debug ("NSM[%s:%s]: neighbor deleted",