ospf6d, tests: Prevent use after free

The code pattern:

for (ALL_LSDB(lsdb, lsa)) {
	remove_lsa(lsa)
}

has a use after free in ALL_LSDB, since we ask for the next pointer,
after it has been freed.

Modify the code such that we grab the next pointer before we can
possibly free it.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>

diff --git a/ospf6d/ospf6_asbr.c b/ospf6d/ospf6_asbr.c
index 71ca5afcd22d06e395611696e296a6cd624f5f37..10a92414b98ef63f7662e18d823e432c92eda25a 100644 (file)
--- a/ospf6d/ospf6_asbr.c
+++ b/ospf6d/ospf6_asbr.c
@@ -1006,9 +1006,9 @@ static void ospf6_asbr_redistribute_unset(int type, vrf_id_t vrf_id)
 /* When an area is unstubified, flood all the external LSAs in the area */
 void ospf6_asbr_send_externals_to_area(struct ospf6_area *oa)
 {
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
-       for (ALL_LSDB(oa->ospf6->lsdb, lsa)) {
+       for (ALL_LSDB(oa->ospf6->lsdb, lsa, lsanext)) {
                if (ntohs(lsa->header->type) == OSPF6_LSTYPE_AS_EXTERNAL) {
                        zlog_debug("%s: Flooding AS-External LSA %s",
                                   __func__, lsa->name);

diff --git a/ospf6d/ospf6_interface.c b/ospf6d/ospf6_interface.c
index 334f1bd2a5dd79c56c23053b6c1a059434ba3ce7..72e40676a0a4c0d636b38a21a4ae6b411a3f6da3 100644 (file)
--- a/ospf6d/ospf6_interface.c
+++ b/ospf6d/ospf6_interface.c
@@ -906,7 +906,7 @@ static int ospf6_interface_show(struct vty *vty, struct interface *ifp)
        uint8_t default_iftype;
        struct timeval res, now;
        char duration[32];
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
        default_iftype = ospf6_default_iftype(ifp);
 
@@ -977,7 +977,7 @@ static int ospf6_interface_show(struct vty *vty, struct interface *ifp)
                "    %d Pending LSAs for LSUpdate in Time %s [thread %s]\n",
                oi->lsupdate_list->count, duration,
                (oi->thread_send_lsupdate ? "on" : "off"));
-       for (ALL_LSDB(oi->lsupdate_list, lsa))
+       for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext))
                vty_out(vty, "      %s\n", lsa->name);
 
        timerclear(&res);
@@ -987,7 +987,7 @@ static int ospf6_interface_show(struct vty *vty, struct interface *ifp)
        vty_out(vty, "    %d Pending LSAs for LSAck in Time %s [thread %s]\n",
                oi->lsack_list->count, duration,
                (oi->thread_send_lsack ? "on" : "off"));
-       for (ALL_LSDB(oi->lsack_list, lsa))
+       for (ALL_LSDB(oi->lsack_list, lsa, lsanext))
                vty_out(vty, "      %s\n", lsa->name);
        ospf6_bfd_show_info(vty, oi->bfd_info, 1);
        return 0;

diff --git a/ospf6d/ospf6_lsdb.c b/ospf6d/ospf6_lsdb.c
index b551dbdfa6e2bededa49e0265567e3b2364d08d3..db6f9a7801516e910695b1c03c82d6d050f4eaaa 100644 (file)
--- a/ospf6d/ospf6_lsdb.c
+++ b/ospf6d/ospf6_lsdb.c
@@ -298,12 +298,12 @@ struct ospf6_lsa *ospf6_lsdb_next(const struct route_node *iterend,
 
 void ospf6_lsdb_remove_all(struct ospf6_lsdb *lsdb)
 {
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
        if (lsdb == NULL)
                return;
 
-       for (ALL_LSDB(lsdb, lsa))
+       for (ALL_LSDB(lsdb, lsa, lsanext))
                ospf6_lsdb_remove(lsa, lsdb);
 }
 
@@ -319,9 +319,9 @@ void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa)
 int ospf6_lsdb_maxage_remover(struct ospf6_lsdb *lsdb)
 {
        int reschedule = 0;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
-       for (ALL_LSDB(lsdb, lsa)) {
+       for (ALL_LSDB(lsdb, lsa, lsanext)) {
                if (!OSPF6_LSA_IS_MAXAGE(lsa))
                        continue;
                if (lsa->retrans_count != 0) {

diff --git a/ospf6d/ospf6_lsdb.h b/ospf6d/ospf6_lsdb.h
index 3b32e3ecf6d7138300ab8dc31d681e50cf2286a2..457e3dc4e4afeed0ddd8a5d892973553dcf0905a 100644 (file)
--- a/ospf6d/ospf6_lsdb.h
+++ b/ospf6d/ospf6_lsdb.h
@@ -66,11 +66,19 @@ extern struct ospf6_lsa *ospf6_lsdb_next(const struct route_node *iterend,
        lsa;                                                                   \
        lsa = ospf6_lsdb_next(iterend, lsa)
 
-#define ALL_LSDB(lsdb, lsa)                                                    \
+/*
+ * Since we are locking the lsa in ospf6_lsdb_head
+ * and then unlocking it in lspf6_lsa_lock, when
+ * we cache the next pointer we need to increment
+ * the lock for the lsa so we don't accidently free
+ * it really early.
+ */
+#define ALL_LSDB(lsdb, lsa, lsanext)                                           \
        const struct route_node *iterend =                                     \
                ospf6_lsdb_head(lsdb, 0, 0, 0, &lsa);                          \
-       lsa;                                                                   \
-       lsa = ospf6_lsdb_next(iterend, lsa)
+       (lsa) != NULL &&ospf6_lsa_lock(lsa)                                    \
+               && ((lsanext) = ospf6_lsdb_next(iterend, (lsa)), 1);           \
+       ospf6_lsa_unlock(lsa), (lsa) = (lsanext)
 
 extern void ospf6_lsdb_remove_all(struct ospf6_lsdb *lsdb);
 extern void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa);

diff --git a/ospf6d/ospf6_message.c b/ospf6d/ospf6_message.c
index 02daaf6c2c01324b7ad6d8c9c0e851be3401b623..07089d8774bab5bd529989391c391a414cc83b7e 100644 (file)
--- a/ospf6d/ospf6_message.c
+++ b/ospf6d/ospf6_message.c
@@ -1792,7 +1792,7 @@ int ospf6_dbdesc_send(struct thread *thread)
        struct ospf6_header *oh;
        struct ospf6_dbdesc *dbdesc;
        uint8_t *p;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
        struct in6_addr *dst;
 
        on = (struct ospf6_neighbor *)THREAD_ARG(thread);
@@ -1833,7 +1833,7 @@ int ospf6_dbdesc_send(struct thread *thread)
        /* if this is not initial one, set LSA headers in dbdesc */
        p = (uint8_t *)((caddr_t)dbdesc + sizeof(struct ospf6_dbdesc));
        if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) {
-               for (ALL_LSDB(on->dbdesc_list, lsa)) {
+               for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) {
                        ospf6_lsa_age_update_to_send(lsa,
                                                     on->ospf6_if->transdelay);
 
@@ -1867,7 +1867,7 @@ int ospf6_dbdesc_send(struct thread *thread)
 int ospf6_dbdesc_send_newone(struct thread *thread)
 {
        struct ospf6_neighbor *on;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
        unsigned int size = 0;
 
        on = (struct ospf6_neighbor *)THREAD_ARG(thread);
@@ -1877,7 +1877,7 @@ int ospf6_dbdesc_send_newone(struct thread *thread)
           structure)
           so that ospf6_send_dbdesc () can send those LSAs */
        size = sizeof(struct ospf6_lsa_header) + sizeof(struct ospf6_dbdesc);
-       for (ALL_LSDB(on->summary_list, lsa)) {
+       for (ALL_LSDB(on->summary_list, lsa, lsanext)) {
                if (size + sizeof(struct ospf6_lsa_header)
                    > ospf6_packet_max(on->ospf6_if)) {
                        ospf6_lsdb_lsa_unlock(lsa);
@@ -1908,7 +1908,7 @@ int ospf6_lsreq_send(struct thread *thread)
        struct ospf6_header *oh;
        struct ospf6_lsreq_entry *e;
        uint8_t *p;
-       struct ospf6_lsa *lsa, *last_req;
+       struct ospf6_lsa *lsa, *lsanext, *last_req;
 
        on = (struct ospf6_neighbor *)THREAD_ARG(thread);
        on->thread_send_lsreq = (struct thread *)NULL;
@@ -1935,7 +1935,7 @@ int ospf6_lsreq_send(struct thread *thread)
 
        /* set Request entries in lsreq */
        p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header));
-       for (ALL_LSDB(on->request_list, lsa)) {
+       for (ALL_LSDB(on->request_list, lsa, lsanext)) {
                /* MTU check */
                if (p - sendbuf + sizeof(struct ospf6_lsreq_entry)
                    > ospf6_packet_max(on->ospf6_if)) {
@@ -2020,7 +2020,7 @@ int ospf6_lsupdate_send_neighbor(struct thread *thread)
        struct ospf6_lsupdate *lsupdate;
        uint8_t *p;
        int lsa_cnt;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
        on = (struct ospf6_neighbor *)THREAD_ARG(thread);
        on->thread_send_lsupdate = (struct thread *)NULL;
@@ -2045,7 +2045,7 @@ int ospf6_lsupdate_send_neighbor(struct thread *thread)
 
        /* lsupdate_list lists those LSA which doesn't need to be
           retransmitted. remove those from the list */
-       for (ALL_LSDB(on->lsupdate_list, lsa)) {
+       for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) {
                /* MTU check */
                if ((p - sendbuf + (unsigned int)OSPF6_LSA_SIZE(lsa->header))
                    > ospf6_packet_max(on->ospf6_if)) {
@@ -2097,7 +2097,7 @@ int ospf6_lsupdate_send_neighbor(struct thread *thread)
        p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate));
        lsa_cnt = 0;
 
-       for (ALL_LSDB(on->retrans_list, lsa)) {
+       for (ALL_LSDB(on->retrans_list, lsa, lsanext)) {
                /* MTU check */
                if ((p - sendbuf + (unsigned int)OSPF6_LSA_SIZE(lsa->header))
                    > ospf6_packet_max(on->ospf6_if)) {
@@ -2202,7 +2202,7 @@ int ospf6_lsupdate_send_interface(struct thread *thread)
        struct ospf6_lsupdate *lsupdate;
        uint8_t *p;
        int lsa_cnt;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
        oi = (struct ospf6_interface *)THREAD_ARG(thread);
        oi->thread_send_lsupdate = (struct thread *)NULL;
@@ -2228,7 +2228,7 @@ int ospf6_lsupdate_send_interface(struct thread *thread)
        p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate));
        lsa_cnt = 0;
 
-       for (ALL_LSDB(oi->lsupdate_list, lsa)) {
+       for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) {
                /* MTU check */
                if ((p - sendbuf + ((unsigned int)OSPF6_LSA_SIZE(lsa->header)))
                    > ospf6_packet_max(oi)) {
@@ -2288,7 +2288,7 @@ int ospf6_lsack_send_neighbor(struct thread *thread)
        struct ospf6_neighbor *on;
        struct ospf6_header *oh;
        uint8_t *p;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
        int lsa_cnt = 0;
 
        on = (struct ospf6_neighbor *)THREAD_ARG(thread);
@@ -2311,7 +2311,7 @@ int ospf6_lsack_send_neighbor(struct thread *thread)
 
        p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header));
 
-       for (ALL_LSDB(on->lsack_list, lsa)) {
+       for (ALL_LSDB(on->lsack_list, lsa, lsanext)) {
                /* MTU check */
                if (p - sendbuf + sizeof(struct ospf6_lsa_header)
                    > ospf6_packet_max(on->ospf6_if)) {
@@ -2366,7 +2366,7 @@ int ospf6_lsack_send_interface(struct thread *thread)
        struct ospf6_interface *oi;
        struct ospf6_header *oh;
        uint8_t *p;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
        int lsa_cnt = 0;
 
        oi = (struct ospf6_interface *)THREAD_ARG(thread);
@@ -2390,7 +2390,7 @@ int ospf6_lsack_send_interface(struct thread *thread)
 
        p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header));
 
-       for (ALL_LSDB(oi->lsack_list, lsa)) {
+       for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) {
                /* MTU check */
                if (p - sendbuf + sizeof(struct ospf6_lsa_header)
                    > ospf6_packet_max(oi)) {

diff --git a/ospf6d/ospf6_neighbor.c b/ospf6d/ospf6_neighbor.c
index 92a3c9e1adc5122f78be50e440879acdbe5de73e..f8676e0c13bc97fb8c562616fc06cf2ec7ce4969 100644 (file)
--- a/ospf6d/ospf6_neighbor.c
+++ b/ospf6d/ospf6_neighbor.c
@@ -118,11 +118,11 @@ struct ospf6_neighbor *ospf6_neighbor_create(uint32_t router_id,
 
 void ospf6_neighbor_delete(struct ospf6_neighbor *on)
 {
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
        ospf6_lsdb_remove_all(on->summary_list);
        ospf6_lsdb_remove_all(on->request_list);
-       for (ALL_LSDB(on->retrans_list, lsa)) {
+       for (ALL_LSDB(on->retrans_list, lsa, lsanext)) {
                ospf6_decrement_retrans_count(lsa);
                ospf6_lsdb_remove(lsa, on->retrans_list);
        }
@@ -293,7 +293,7 @@ int twoway_received(struct thread *thread)
 int negotiation_done(struct thread *thread)
 {
        struct ospf6_neighbor *on;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
        on = (struct ospf6_neighbor *)THREAD_ARG(thread);
        assert(on);
@@ -307,13 +307,13 @@ int negotiation_done(struct thread *thread)
        /* clear ls-list */
        ospf6_lsdb_remove_all(on->summary_list);
        ospf6_lsdb_remove_all(on->request_list);
-       for (ALL_LSDB(on->retrans_list, lsa)) {
+       for (ALL_LSDB(on->retrans_list, lsa, lsanext)) {
                ospf6_decrement_retrans_count(lsa);
                ospf6_lsdb_remove(lsa, on->retrans_list);
        }
 
        /* Interface scoped LSAs */
-       for (ALL_LSDB(on->ospf6_if->lsdb, lsa)) {
+       for (ALL_LSDB(on->ospf6_if->lsdb, lsa, lsanext)) {
                if (OSPF6_LSA_IS_MAXAGE(lsa)) {
                        ospf6_increment_retrans_count(lsa);
                        ospf6_lsdb_add(ospf6_lsa_copy(lsa), on->retrans_list);
@@ -322,7 +322,7 @@ int negotiation_done(struct thread *thread)
        }
 
        /* Area scoped LSAs */
-       for (ALL_LSDB(on->ospf6_if->area->lsdb, lsa)) {
+       for (ALL_LSDB(on->ospf6_if->area->lsdb, lsa, lsanext)) {
                if (OSPF6_LSA_IS_MAXAGE(lsa)) {
                        ospf6_increment_retrans_count(lsa);
                        ospf6_lsdb_add(ospf6_lsa_copy(lsa), on->retrans_list);
@@ -331,7 +331,7 @@ int negotiation_done(struct thread *thread)
        }
 
        /* AS scoped LSAs */
-       for (ALL_LSDB(on->ospf6_if->area->ospf6->lsdb, lsa)) {
+       for (ALL_LSDB(on->ospf6_if->area->ospf6->lsdb, lsa, lsanext)) {
                if (OSPF6_LSA_IS_MAXAGE(lsa)) {
                        ospf6_increment_retrans_count(lsa);
                        ospf6_lsdb_add(ospf6_lsa_copy(lsa), on->retrans_list);
@@ -427,7 +427,7 @@ int loading_done(struct thread *thread)
 int adj_ok(struct thread *thread)
 {
        struct ospf6_neighbor *on;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
        on = (struct ospf6_neighbor *)THREAD_ARG(thread);
        assert(on);
@@ -452,7 +452,7 @@ int adj_ok(struct thread *thread)
                                            OSPF6_NEIGHBOR_EVENT_ADJ_OK);
                ospf6_lsdb_remove_all(on->summary_list);
                ospf6_lsdb_remove_all(on->request_list);
-               for (ALL_LSDB(on->retrans_list, lsa)) {
+               for (ALL_LSDB(on->retrans_list, lsa, lsanext)) {
                        ospf6_decrement_retrans_count(lsa);
                        ospf6_lsdb_remove(lsa, on->retrans_list);
                }
@@ -464,7 +464,7 @@ int adj_ok(struct thread *thread)
 int seqnumber_mismatch(struct thread *thread)
 {
        struct ospf6_neighbor *on;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
        on = (struct ospf6_neighbor *)THREAD_ARG(thread);
        assert(on);
@@ -483,7 +483,7 @@ int seqnumber_mismatch(struct thread *thread)
 
        ospf6_lsdb_remove_all(on->summary_list);
        ospf6_lsdb_remove_all(on->request_list);
-       for (ALL_LSDB(on->retrans_list, lsa)) {
+       for (ALL_LSDB(on->retrans_list, lsa, lsanext)) {
                ospf6_decrement_retrans_count(lsa);
                ospf6_lsdb_remove(lsa, on->retrans_list);
        }
@@ -501,7 +501,7 @@ int seqnumber_mismatch(struct thread *thread)
 int bad_lsreq(struct thread *thread)
 {
        struct ospf6_neighbor *on;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
        on = (struct ospf6_neighbor *)THREAD_ARG(thread);
        assert(on);
@@ -520,7 +520,7 @@ int bad_lsreq(struct thread *thread)
 
        ospf6_lsdb_remove_all(on->summary_list);
        ospf6_lsdb_remove_all(on->request_list);
-       for (ALL_LSDB(on->retrans_list, lsa)) {
+       for (ALL_LSDB(on->retrans_list, lsa, lsanext)) {
                ospf6_decrement_retrans_count(lsa);
                ospf6_lsdb_remove(lsa, on->retrans_list);
        }
@@ -538,7 +538,7 @@ int bad_lsreq(struct thread *thread)
 int oneway_received(struct thread *thread)
 {
        struct ospf6_neighbor *on;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
        on = (struct ospf6_neighbor *)THREAD_ARG(thread);
        assert(on);
@@ -555,7 +555,7 @@ int oneway_received(struct thread *thread)
 
        ospf6_lsdb_remove_all(on->summary_list);
        ospf6_lsdb_remove_all(on->request_list);
-       for (ALL_LSDB(on->retrans_list, lsa)) {
+       for (ALL_LSDB(on->retrans_list, lsa, lsanext)) {
                ospf6_decrement_retrans_count(lsa);
                ospf6_lsdb_remove(lsa, on->retrans_list);
        }
@@ -685,7 +685,7 @@ static void ospf6_neighbor_show_detail(struct vty *vty,
        char drouter[16], bdrouter[16];
        char linklocal_addr[64], duration[32];
        struct timeval now, res;
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
 
        inet_ntop(AF_INET6, &on->linklocal_addr, linklocal_addr,
                  sizeof(linklocal_addr));
@@ -715,15 +715,15 @@ static void ospf6_neighbor_show_detail(struct vty *vty,
                (unsigned long)ntohl(on->dbdesc_seqnum));
 
        vty_out(vty, "    Summary-List: %d LSAs\n", on->summary_list->count);
-       for (ALL_LSDB(on->summary_list, lsa))
+       for (ALL_LSDB(on->summary_list, lsa, lsanext))
                vty_out(vty, "      %s\n", lsa->name);
 
        vty_out(vty, "    Request-List: %d LSAs\n", on->request_list->count);
-       for (ALL_LSDB(on->request_list, lsa))
+       for (ALL_LSDB(on->request_list, lsa, lsanext))
                vty_out(vty, "      %s\n", lsa->name);
 
        vty_out(vty, "    Retrans-List: %d LSAs\n", on->retrans_list->count);
-       for (ALL_LSDB(on->retrans_list, lsa))
+       for (ALL_LSDB(on->retrans_list, lsa, lsanext))
                vty_out(vty, "      %s\n", lsa->name);
 
        timerclear(&res);
@@ -733,7 +733,7 @@ static void ospf6_neighbor_show_detail(struct vty *vty,
        vty_out(vty, "    %d Pending LSAs for DbDesc in Time %s [thread %s]\n",
                on->dbdesc_list->count, duration,
                (on->thread_send_dbdesc ? "on" : "off"));
-       for (ALL_LSDB(on->dbdesc_list, lsa))
+       for (ALL_LSDB(on->dbdesc_list, lsa, lsanext))
                vty_out(vty, "      %s\n", lsa->name);
 
        timerclear(&res);
@@ -743,7 +743,7 @@ static void ospf6_neighbor_show_detail(struct vty *vty,
        vty_out(vty, "    %d Pending LSAs for LSReq in Time %s [thread %s]\n",
                on->request_list->count, duration,
                (on->thread_send_lsreq ? "on" : "off"));
-       for (ALL_LSDB(on->request_list, lsa))
+       for (ALL_LSDB(on->request_list, lsa, lsanext))
                vty_out(vty, "      %s\n", lsa->name);
 
        timerclear(&res);
@@ -754,7 +754,7 @@ static void ospf6_neighbor_show_detail(struct vty *vty,
                "    %d Pending LSAs for LSUpdate in Time %s [thread %s]\n",
                on->lsupdate_list->count, duration,
                (on->thread_send_lsupdate ? "on" : "off"));
-       for (ALL_LSDB(on->lsupdate_list, lsa))
+       for (ALL_LSDB(on->lsupdate_list, lsa, lsanext))
                vty_out(vty, "      %s\n", lsa->name);
 
        timerclear(&res);
@@ -764,7 +764,7 @@ static void ospf6_neighbor_show_detail(struct vty *vty,
        vty_out(vty, "    %d Pending LSAs for LSAck in Time %s [thread %s]\n",
                on->lsack_list->count, duration,
                (on->thread_send_lsack ? "on" : "off"));
-       for (ALL_LSDB(on->lsack_list, lsa))
+       for (ALL_LSDB(on->lsack_list, lsa, lsanext))
                vty_out(vty, "      %s\n", lsa->name);
 
        ospf6_bfd_show_info(vty, on->bfd_info, 0);

diff --git a/ospf6d/ospf6_snmp.c b/ospf6d/ospf6_snmp.c
index 57cc05529685a53e60d2273c5de61d29dd4287ff..6e24be6a1eb6f4c16b9f66c9c7d7af4ff35963b2 100644 (file)
--- a/ospf6d/ospf6_snmp.c
+++ b/ospf6d/ospf6_snmp.c
@@ -637,7 +637,7 @@ static uint8_t *ospfv3GeneralGroup(struct variable *v, oid *name,
 {
        uint16_t sum;
        uint32_t count;
-       struct ospf6_lsa *lsa = NULL;
+       struct ospf6_lsa *lsa = NULL, *lsanext;
 
        /* Check whether the instance identifier is valid */
        if (smux_header_generic(v, name, length, exact, var_len, write_method)
@@ -679,7 +679,7 @@ static uint8_t *ospfv3GeneralGroup(struct variable *v, oid *name,
        case OSPFv3ASSCOPELSACHECKSUMSUM:
                if (ospf6) {
                        sum = 0;
-                       for (ALL_LSDB(ospf6->lsdb, lsa))
+                       for (ALL_LSDB(ospf6->lsdb, lsa, lsanext))
                                sum += ntohs(lsa->header->checksum);
                        return SNMP_INTEGER(sum);
                }
@@ -733,7 +733,7 @@ static uint8_t *ospfv3AreaEntry(struct variable *v, oid *name, size_t *length,
                                WriteMethod **write_method)
 {
        struct ospf6_area *oa, *area = NULL;
-       struct ospf6_lsa *lsa = NULL;
+       struct ospf6_lsa *lsa = NULL, *lsanext;
        uint32_t area_id = 0;
        uint32_t count;
        uint16_t sum;
@@ -808,7 +808,7 @@ static uint8_t *ospfv3AreaEntry(struct variable *v, oid *name, size_t *length,
                return SNMP_INTEGER(area->lsdb->count);
        case OSPFv3AREASCOPELSACKSUMSUM:
                sum = 0;
-               for (ALL_LSDB(area->lsdb, lsa))
+               for (ALL_LSDB(area->lsdb, lsa, lsanext))
                        sum += ntohs(lsa->header->checksum);
                return SNMP_INTEGER(sum);
        case OSPFv3AREASUMMARY:
@@ -1044,7 +1044,7 @@ static uint8_t *ospfv3IfEntry(struct variable *v, oid *name, size_t *length,
        ifindex_t ifindex = 0;
        unsigned int instid = 0;
        struct ospf6_interface *oi = NULL;
-       struct ospf6_lsa *lsa = NULL;
+       struct ospf6_lsa *lsa = NULL, *lsanext;
        struct interface *iif;
        struct listnode *i;
        struct list *ifslist;
@@ -1171,7 +1171,7 @@ static uint8_t *ospfv3IfEntry(struct variable *v, oid *name, size_t *length,
                return SNMP_INTEGER(oi->lsdb->count);
        case OSPFv3IFLINKLSACKSUMSUM:
                sum = 0;
-               for (ALL_LSDB(oi->lsdb, lsa))
+               for (ALL_LSDB(oi->lsdb, lsa, lsanext))
                        sum += ntohs(lsa->header->checksum);
                return SNMP_INTEGER(sum);
        case OSPFv3IFDEMANDNBRPROBE:

diff --git a/ospf6d/ospf6_spf.c b/ospf6d/ospf6_spf.c
index e5eb8d74eb7877a9aed18bbca4c5d0294729795b..bb6a05097631edf76c34181c51abca888d7c1c3e 100644 (file)
--- a/ospf6d/ospf6_spf.c
+++ b/ospf6d/ospf6_spf.c
@@ -1082,9 +1082,9 @@ struct ospf6_lsa *ospf6_create_single_router_lsa(struct ospf6_area *area,
 
 void ospf6_remove_temp_router_lsa(struct ospf6_area *area)
 {
-       struct ospf6_lsa *lsa = NULL;
+       struct ospf6_lsa *lsa = NULL, *lsanext;
 
-       for (ALL_LSDB(area->temp_router_lsa_lsdb, lsa)) {
+       for (ALL_LSDB(area->temp_router_lsa_lsdb, lsa, lsanext)) {
                if (IS_OSPF6_DEBUG_SPF(PROCESS))
                        zlog_debug(
                                "%s Remove LSA %s lsa->lock %u lsdb count %u",

diff --git a/tests/ospf6d/test_lsdb.c b/tests/ospf6d/test_lsdb.c
index 24821febe6be0ef4065efcc16f7cf87b3d430154..c5bdcd3d1342bc3cc0ed36ac75beeb546bde1b22 100644 (file)
--- a/tests/ospf6d/test_lsdb.c
+++ b/tests/ospf6d/test_lsdb.c
@@ -134,9 +134,10 @@ DEFPY(lsdb_walk, lsdb_walk_cmd,
       "LSDB\n"
       "walk entries\n")
 {
-       struct ospf6_lsa *lsa;
+       struct ospf6_lsa *lsa, *lsanext;
+
        unsigned cnt = 0;
-       for (ALL_LSDB(lsdb, lsa)) {
+       for (ALL_LSDB(lsdb, lsa, lsanext)) {
                lsa_show_oneline(vty, lsa);
                cnt++;
        }