From: Donald Sharp <sharpd@cumulusnetworks.com>
Date: Fri, 27 Jul 2018 14:02:34 +0000 (-0400)
Subject: bgpd: Notice when we unlock if we should NULL pointer
X-Git-Tag: frr-6.1-dev~130^2
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=239b37bb3c1d1d82423c5934c8615d4bfb392472;p=matthieu%2Ffrr.git

bgpd: Notice when we unlock if we should NULL pointer

The bi->net pointer that is being unlocked had a commit
that removed the `bi->net = NULL;` recently.  This code
was preventing a use after free crash being experienced
in other code paths.  While commit 37e679629f9 was fixing
a different code path crash.

Make the parent->net pointer aware it may be locked/freed
from multiple places and to not NULL the pointer to it
unless we have actually freed the data.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
---

diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c
index 7fbc6d9a65..9ba9eb1e59 100644
--- a/bgpd/bgp_route.c
+++ b/bgpd/bgp_route.c
@@ -188,7 +188,7 @@ static void bgp_info_extra_free(struct bgp_info_extra **extra)
 		struct bgp_info *bi = (struct bgp_info *)e->parent;
 
 		if (bi->net)
-			bgp_unlock_node((struct bgp_node *)bi->net);
+			bi->net = bgp_unlock_node((struct bgp_node *)bi->net);
 		bgp_info_unlock(e->parent);
 		e->parent = NULL;
 	}
diff --git a/bgpd/bgp_table.h b/bgpd/bgp_table.h
index 60c2cbd4a4..f7eac09546 100644
--- a/bgpd/bgp_table.h
+++ b/bgpd/bgp_table.h
@@ -128,9 +128,9 @@ static inline struct bgp_node *bgp_node_parent_nolock(struct bgp_node *node)
 /*
  * bgp_unlock_node
  */
-static inline void bgp_unlock_node(struct bgp_node *node)
+static inline struct bgp_node *bgp_unlock_node(struct bgp_node *node)
 {
-	route_unlock_node(bgp_node_to_rnode(node));
+	return (struct bgp_node *)route_unlock_node(bgp_node_to_rnode(node));
 }
 
 /*