ospf6d: crash in ospf6_decrement_retrans_count.

Problem:
ospf6d crash is observed when lsack is received from the neighbour for
AS External LSA.

RCA:
The crash is observed in ospf6_decrement_retrans_count while decrementing
retransmit counter for the LSA when lsack is recived. This is because in
ospf6_flood_interace when new LSA is being added to the neighbour's list
the incrementing is happening on the received LSA instead of the already
present LSA in scope DB which is already carrying counters.

when this new LSA replaces the old one, the already present counters are
not copied on the new LSA this creates counter mismatch which results in
a crash when lsack is recevied due to counter going to negative.

Fix:
The fix involves following changes.
   1. In ospf6_flood_interace when LSA is being added to retrans list
      check if there is alreday lsa in the scoped db and increment
      the counter on that if present.
   2. In ospf6_lsdb_add copy the retrans counter from old to new lsa
      when its being replaced.

Signed-off-by: Manoj Naragund <mnaragund@vmware.com>
(cherry picked from commit 7c20ee06d3deddd6c53fcd5b09c40854c66633ea)

diff --git a/ospf6d/ospf6_flood.c b/ospf6d/ospf6_flood.c
index 5fed6dfe174f9af54c6b94fa3d293c3629018662..cc82084e5e92f18e00f175c5fcd70206aa034083 100644 (file)
--- a/ospf6d/ospf6_flood.c
+++ b/ospf6d/ospf6_flood.c
@@ -464,11 +464,28 @@ void ospf6_flood_interface(struct ospf6_neighbor *from, struct ospf6_lsa *lsa,
                                lsa->header->type, lsa->header->id,
                                lsa->header->adv_router, on->retrans_list);
                        if (!old) {
+                               struct ospf6_lsa *orig;
+                               struct ospf6_lsdb *lsdb;
+
                                if (is_debug)
                                        zlog_debug(
                                                "Increment %s from retrans_list of %s",
                                                lsa->name, on->name);
-                               ospf6_increment_retrans_count(lsa);
+
+                               /* Increment the retrans count on the original
+                                * copy of LSA if present, to maintain the
+                                * counter consistency.
+                                */
+
+                               lsdb = ospf6_get_scoped_lsdb(lsa);
+                               orig = ospf6_lsdb_lookup(
+                                       lsa->header->type, lsa->header->id,
+                                       lsa->header->adv_router, lsdb);
+                               if (orig)
+                                       ospf6_increment_retrans_count(orig);
+                               else
+                                       ospf6_increment_retrans_count(lsa);
+
                                ospf6_lsdb_add(ospf6_lsa_copy(lsa),
                                               on->retrans_list);
                                thread_add_timer(

diff --git a/ospf6d/ospf6_lsdb.c b/ospf6d/ospf6_lsdb.c
index 039c65d7398b7c85a6497b7777477ad23e40db3a..1d71a25390215898d32123a8911584644a4509e7 100644 (file)
--- a/ospf6d/ospf6_lsdb.c
+++ b/ospf6d/ospf6_lsdb.c
@@ -121,6 +121,8 @@ void ospf6_lsdb_add(struct ospf6_lsa *lsa, struct ospf6_lsdb *lsdb)
                                (*lsdb->hook_add)(lsa);
                }
        } else {
+               lsa->retrans_count = old->retrans_count;
+
                if (OSPF6_LSA_IS_CHANGED(old, lsa)) {
                        if (OSPF6_LSA_IS_MAXAGE(lsa)) {
                                if (lsdb->hook_remove) {