]> git.puffer.fish Git - mirror/frr.git/commitdiff
pimd: prevent invalid memory access 16937/head
authorRafael Zalamena <rzalamena@opensourcerouting.org>
Sun, 29 Sep 2024 20:31:06 +0000 (17:31 -0300)
committerRafael Zalamena <rzalamena@opensourcerouting.org>
Wed, 13 Nov 2024 15:05:35 +0000 (12:05 -0300)
Signalize termination to functions so they can avoid accessing pointers
that might be no longer available.

Signed-off-by: Rafael Zalamena <rzalamena@opensourcerouting.org>
pimd/pim_instance.c
pimd/pim_instance.h
pimd/pim_tib.c

index f7c5ea3bcf345ee81dcf476ec5e2cf6c59d6fcb4..e18ae97d6fcc26bfa2d6187d10c86fee0ce9b915 100644 (file)
@@ -26,6 +26,8 @@
 
 static void pim_instance_terminate(struct pim_instance *pim)
 {
+       pim->stopping = true;
+
        pim_vxlan_exit(pim);
 
        if (pim->ssm_info) {
index 387926c9078d0fafad9fa6fff78da8577c990ffd..1b7815d86c51bba02e99e4e5346f7b117c67ab50 100644 (file)
@@ -192,6 +192,8 @@ struct pim_instance {
 
        uint64_t gm_rx_drop_sys;
 
+       bool stopping;
+
 #if PIM_IPV == 6
        struct {
                /** Embedded RP enable state. */
index 12ae0d6246d1e6267402b6327da9898df7d0903d..e21793b8caafb6d32927c049635ff16ac2d40236 100644 (file)
@@ -181,7 +181,14 @@ void tib_sg_gm_prune(struct pim_instance *pim, pim_sgaddr sg,
         Making the call to pim_channel_del_oif and ignoring the return code
         fixes the issue without ill effect, similar to
         pim_forward_stop below.
+
+        Also on shutdown when the PIM upstream is removed the channel removal
+        may have already happened, so just return here instead of trying to
+        access an invalid pointer.
        */
+       if (pim->stopping)
+               return;
+
        result = pim_channel_del_oif(*oilp, oif, PIM_OIF_FLAG_PROTO_GM,
                                     __func__);
        if (result) {