From: Eric Kinzie <ekinzie@labn.net>
Date: Fri, 1 Apr 2022 00:47:30 +0000 (+0000)
Subject: isisd: fix merging flex-algo route nodes
X-Git-Tag: base_9.0~159^2~17
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=224eadd955b37d6eee501cecf85498eac3ad8d5b;p=mirror%2Ffrr.git

isisd: fix merging flex-algo route nodes

As isis_route_verify_merge() builds a new route table, each (src,dst)
new node in the table is created by merging data from the same (src,dst)
pair present in all route tables.  However, as it iterates over those
route nodes and copies SR data into the newly created node, it repeatedly
overwrites the isis_route_info pointer.  This, in turn, pollutes the
isis_route_info structures in all of the other tables with partially
updated SR data.

After a route is deleted, this leaves pointers to freed memory in one
of the route trees.

Fixes: 26b0598f6b6f ("isisd: fix isis_route_merge_verify logic")
Signed-off-by: Eric Kinzie <ekinzie@labn.net>
---

diff --git a/isisd/isis_route.c b/isisd/isis_route.c
index 3983c704ce..be92dcc22e 100644
--- a/isisd/isis_route.c
+++ b/isisd/isis_route.c
@@ -889,8 +889,9 @@ static void _isis_route_verify_merge(struct isis_area *area,
 						ISIS_ROUTE_FLAG_ZEBRA_SYNCED)) {
 					continue;
 				}
+			} else {
+				mrnode->info = rnode->info;
 			}
-			mrnode->info = rnode->info;
 		}
 	}