From: Donald Sharp Date: Mon, 17 Aug 2020 12:25:12 +0000 (-0400) Subject: ospf6d, tests: Prevent use after free X-Git-Tag: base_7.6~434^2 X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=2e37407f9d27dec02a49260ac3218126522dc666;p=matthieu%2Ffrr.git ospf6d, tests: Prevent use after free The code pattern: for (ALL_LSDB(lsdb, lsa)) { remove_lsa(lsa) } has a use after free in ALL_LSDB, since we ask for the next pointer, after it has been freed. Modify the code such that we grab the next pointer before we can possibly free it. Signed-off-by: Donald Sharp --- diff --git a/ospf6d/ospf6_asbr.c b/ospf6d/ospf6_asbr.c index 71ca5afcd2..10a92414b9 100644 --- a/ospf6d/ospf6_asbr.c +++ b/ospf6d/ospf6_asbr.c @@ -1006,9 +1006,9 @@ static void ospf6_asbr_redistribute_unset(int type, vrf_id_t vrf_id) /* When an area is unstubified, flood all the external LSAs in the area */ void ospf6_asbr_send_externals_to_area(struct ospf6_area *oa) { - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; - for (ALL_LSDB(oa->ospf6->lsdb, lsa)) { + for (ALL_LSDB(oa->ospf6->lsdb, lsa, lsanext)) { if (ntohs(lsa->header->type) == OSPF6_LSTYPE_AS_EXTERNAL) { zlog_debug("%s: Flooding AS-External LSA %s", __func__, lsa->name); diff --git a/ospf6d/ospf6_interface.c b/ospf6d/ospf6_interface.c index 334f1bd2a5..72e40676a0 100644 --- a/ospf6d/ospf6_interface.c +++ b/ospf6d/ospf6_interface.c @@ -906,7 +906,7 @@ static int ospf6_interface_show(struct vty *vty, struct interface *ifp) uint8_t default_iftype; struct timeval res, now; char duration[32]; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; default_iftype = ospf6_default_iftype(ifp); @@ -977,7 +977,7 @@ static int ospf6_interface_show(struct vty *vty, struct interface *ifp) " %d Pending LSAs for LSUpdate in Time %s [thread %s]\n", oi->lsupdate_list->count, duration, (oi->thread_send_lsupdate ? "on" : "off")); - for (ALL_LSDB(oi->lsupdate_list, lsa)) + for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) vty_out(vty, " %s\n", lsa->name); timerclear(&res); @@ -987,7 +987,7 @@ static int ospf6_interface_show(struct vty *vty, struct interface *ifp) vty_out(vty, " %d Pending LSAs for LSAck in Time %s [thread %s]\n", oi->lsack_list->count, duration, (oi->thread_send_lsack ? "on" : "off")); - for (ALL_LSDB(oi->lsack_list, lsa)) + for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) vty_out(vty, " %s\n", lsa->name); ospf6_bfd_show_info(vty, oi->bfd_info, 1); return 0; diff --git a/ospf6d/ospf6_lsdb.c b/ospf6d/ospf6_lsdb.c index b551dbdfa6..db6f9a7801 100644 --- a/ospf6d/ospf6_lsdb.c +++ b/ospf6d/ospf6_lsdb.c @@ -298,12 +298,12 @@ struct ospf6_lsa *ospf6_lsdb_next(const struct route_node *iterend, void ospf6_lsdb_remove_all(struct ospf6_lsdb *lsdb) { - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; if (lsdb == NULL) return; - for (ALL_LSDB(lsdb, lsa)) + for (ALL_LSDB(lsdb, lsa, lsanext)) ospf6_lsdb_remove(lsa, lsdb); } @@ -319,9 +319,9 @@ void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa) int ospf6_lsdb_maxage_remover(struct ospf6_lsdb *lsdb) { int reschedule = 0; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; - for (ALL_LSDB(lsdb, lsa)) { + for (ALL_LSDB(lsdb, lsa, lsanext)) { if (!OSPF6_LSA_IS_MAXAGE(lsa)) continue; if (lsa->retrans_count != 0) { diff --git a/ospf6d/ospf6_lsdb.h b/ospf6d/ospf6_lsdb.h index 3b32e3ecf6..457e3dc4e4 100644 --- a/ospf6d/ospf6_lsdb.h +++ b/ospf6d/ospf6_lsdb.h @@ -66,11 +66,19 @@ extern struct ospf6_lsa *ospf6_lsdb_next(const struct route_node *iterend, lsa; \ lsa = ospf6_lsdb_next(iterend, lsa) -#define ALL_LSDB(lsdb, lsa) \ +/* + * Since we are locking the lsa in ospf6_lsdb_head + * and then unlocking it in lspf6_lsa_lock, when + * we cache the next pointer we need to increment + * the lock for the lsa so we don't accidently free + * it really early. + */ +#define ALL_LSDB(lsdb, lsa, lsanext) \ const struct route_node *iterend = \ ospf6_lsdb_head(lsdb, 0, 0, 0, &lsa); \ - lsa; \ - lsa = ospf6_lsdb_next(iterend, lsa) + (lsa) != NULL &&ospf6_lsa_lock(lsa) \ + && ((lsanext) = ospf6_lsdb_next(iterend, (lsa)), 1); \ + ospf6_lsa_unlock(lsa), (lsa) = (lsanext) extern void ospf6_lsdb_remove_all(struct ospf6_lsdb *lsdb); extern void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa); diff --git a/ospf6d/ospf6_message.c b/ospf6d/ospf6_message.c index 02daaf6c2c..07089d8774 100644 --- a/ospf6d/ospf6_message.c +++ b/ospf6d/ospf6_message.c @@ -1792,7 +1792,7 @@ int ospf6_dbdesc_send(struct thread *thread) struct ospf6_header *oh; struct ospf6_dbdesc *dbdesc; uint8_t *p; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; struct in6_addr *dst; on = (struct ospf6_neighbor *)THREAD_ARG(thread); @@ -1833,7 +1833,7 @@ int ospf6_dbdesc_send(struct thread *thread) /* if this is not initial one, set LSA headers in dbdesc */ p = (uint8_t *)((caddr_t)dbdesc + sizeof(struct ospf6_dbdesc)); if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { - for (ALL_LSDB(on->dbdesc_list, lsa)) { + for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { ospf6_lsa_age_update_to_send(lsa, on->ospf6_if->transdelay); @@ -1867,7 +1867,7 @@ int ospf6_dbdesc_send(struct thread *thread) int ospf6_dbdesc_send_newone(struct thread *thread) { struct ospf6_neighbor *on; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; unsigned int size = 0; on = (struct ospf6_neighbor *)THREAD_ARG(thread); @@ -1877,7 +1877,7 @@ int ospf6_dbdesc_send_newone(struct thread *thread) structure) so that ospf6_send_dbdesc () can send those LSAs */ size = sizeof(struct ospf6_lsa_header) + sizeof(struct ospf6_dbdesc); - for (ALL_LSDB(on->summary_list, lsa)) { + for (ALL_LSDB(on->summary_list, lsa, lsanext)) { if (size + sizeof(struct ospf6_lsa_header) > ospf6_packet_max(on->ospf6_if)) { ospf6_lsdb_lsa_unlock(lsa); @@ -1908,7 +1908,7 @@ int ospf6_lsreq_send(struct thread *thread) struct ospf6_header *oh; struct ospf6_lsreq_entry *e; uint8_t *p; - struct ospf6_lsa *lsa, *last_req; + struct ospf6_lsa *lsa, *lsanext, *last_req; on = (struct ospf6_neighbor *)THREAD_ARG(thread); on->thread_send_lsreq = (struct thread *)NULL; @@ -1935,7 +1935,7 @@ int ospf6_lsreq_send(struct thread *thread) /* set Request entries in lsreq */ p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); - for (ALL_LSDB(on->request_list, lsa)) { + for (ALL_LSDB(on->request_list, lsa, lsanext)) { /* MTU check */ if (p - sendbuf + sizeof(struct ospf6_lsreq_entry) > ospf6_packet_max(on->ospf6_if)) { @@ -2020,7 +2020,7 @@ int ospf6_lsupdate_send_neighbor(struct thread *thread) struct ospf6_lsupdate *lsupdate; uint8_t *p; int lsa_cnt; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; on = (struct ospf6_neighbor *)THREAD_ARG(thread); on->thread_send_lsupdate = (struct thread *)NULL; @@ -2045,7 +2045,7 @@ int ospf6_lsupdate_send_neighbor(struct thread *thread) /* lsupdate_list lists those LSA which doesn't need to be retransmitted. remove those from the list */ - for (ALL_LSDB(on->lsupdate_list, lsa)) { + for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { /* MTU check */ if ((p - sendbuf + (unsigned int)OSPF6_LSA_SIZE(lsa->header)) > ospf6_packet_max(on->ospf6_if)) { @@ -2097,7 +2097,7 @@ int ospf6_lsupdate_send_neighbor(struct thread *thread) p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); lsa_cnt = 0; - for (ALL_LSDB(on->retrans_list, lsa)) { + for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { /* MTU check */ if ((p - sendbuf + (unsigned int)OSPF6_LSA_SIZE(lsa->header)) > ospf6_packet_max(on->ospf6_if)) { @@ -2202,7 +2202,7 @@ int ospf6_lsupdate_send_interface(struct thread *thread) struct ospf6_lsupdate *lsupdate; uint8_t *p; int lsa_cnt; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; oi = (struct ospf6_interface *)THREAD_ARG(thread); oi->thread_send_lsupdate = (struct thread *)NULL; @@ -2228,7 +2228,7 @@ int ospf6_lsupdate_send_interface(struct thread *thread) p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); lsa_cnt = 0; - for (ALL_LSDB(oi->lsupdate_list, lsa)) { + for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { /* MTU check */ if ((p - sendbuf + ((unsigned int)OSPF6_LSA_SIZE(lsa->header))) > ospf6_packet_max(oi)) { @@ -2288,7 +2288,7 @@ int ospf6_lsack_send_neighbor(struct thread *thread) struct ospf6_neighbor *on; struct ospf6_header *oh; uint8_t *p; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; int lsa_cnt = 0; on = (struct ospf6_neighbor *)THREAD_ARG(thread); @@ -2311,7 +2311,7 @@ int ospf6_lsack_send_neighbor(struct thread *thread) p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); - for (ALL_LSDB(on->lsack_list, lsa)) { + for (ALL_LSDB(on->lsack_list, lsa, lsanext)) { /* MTU check */ if (p - sendbuf + sizeof(struct ospf6_lsa_header) > ospf6_packet_max(on->ospf6_if)) { @@ -2366,7 +2366,7 @@ int ospf6_lsack_send_interface(struct thread *thread) struct ospf6_interface *oi; struct ospf6_header *oh; uint8_t *p; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; int lsa_cnt = 0; oi = (struct ospf6_interface *)THREAD_ARG(thread); @@ -2390,7 +2390,7 @@ int ospf6_lsack_send_interface(struct thread *thread) p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); - for (ALL_LSDB(oi->lsack_list, lsa)) { + for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) { /* MTU check */ if (p - sendbuf + sizeof(struct ospf6_lsa_header) > ospf6_packet_max(oi)) { diff --git a/ospf6d/ospf6_neighbor.c b/ospf6d/ospf6_neighbor.c index 92a3c9e1ad..f8676e0c13 100644 --- a/ospf6d/ospf6_neighbor.c +++ b/ospf6d/ospf6_neighbor.c @@ -118,11 +118,11 @@ struct ospf6_neighbor *ospf6_neighbor_create(uint32_t router_id, void ospf6_neighbor_delete(struct ospf6_neighbor *on) { - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; ospf6_lsdb_remove_all(on->summary_list); ospf6_lsdb_remove_all(on->request_list); - for (ALL_LSDB(on->retrans_list, lsa)) { + for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { ospf6_decrement_retrans_count(lsa); ospf6_lsdb_remove(lsa, on->retrans_list); } @@ -293,7 +293,7 @@ int twoway_received(struct thread *thread) int negotiation_done(struct thread *thread) { struct ospf6_neighbor *on; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; on = (struct ospf6_neighbor *)THREAD_ARG(thread); assert(on); @@ -307,13 +307,13 @@ int negotiation_done(struct thread *thread) /* clear ls-list */ ospf6_lsdb_remove_all(on->summary_list); ospf6_lsdb_remove_all(on->request_list); - for (ALL_LSDB(on->retrans_list, lsa)) { + for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { ospf6_decrement_retrans_count(lsa); ospf6_lsdb_remove(lsa, on->retrans_list); } /* Interface scoped LSAs */ - for (ALL_LSDB(on->ospf6_if->lsdb, lsa)) { + for (ALL_LSDB(on->ospf6_if->lsdb, lsa, lsanext)) { if (OSPF6_LSA_IS_MAXAGE(lsa)) { ospf6_increment_retrans_count(lsa); ospf6_lsdb_add(ospf6_lsa_copy(lsa), on->retrans_list); @@ -322,7 +322,7 @@ int negotiation_done(struct thread *thread) } /* Area scoped LSAs */ - for (ALL_LSDB(on->ospf6_if->area->lsdb, lsa)) { + for (ALL_LSDB(on->ospf6_if->area->lsdb, lsa, lsanext)) { if (OSPF6_LSA_IS_MAXAGE(lsa)) { ospf6_increment_retrans_count(lsa); ospf6_lsdb_add(ospf6_lsa_copy(lsa), on->retrans_list); @@ -331,7 +331,7 @@ int negotiation_done(struct thread *thread) } /* AS scoped LSAs */ - for (ALL_LSDB(on->ospf6_if->area->ospf6->lsdb, lsa)) { + for (ALL_LSDB(on->ospf6_if->area->ospf6->lsdb, lsa, lsanext)) { if (OSPF6_LSA_IS_MAXAGE(lsa)) { ospf6_increment_retrans_count(lsa); ospf6_lsdb_add(ospf6_lsa_copy(lsa), on->retrans_list); @@ -427,7 +427,7 @@ int loading_done(struct thread *thread) int adj_ok(struct thread *thread) { struct ospf6_neighbor *on; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; on = (struct ospf6_neighbor *)THREAD_ARG(thread); assert(on); @@ -452,7 +452,7 @@ int adj_ok(struct thread *thread) OSPF6_NEIGHBOR_EVENT_ADJ_OK); ospf6_lsdb_remove_all(on->summary_list); ospf6_lsdb_remove_all(on->request_list); - for (ALL_LSDB(on->retrans_list, lsa)) { + for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { ospf6_decrement_retrans_count(lsa); ospf6_lsdb_remove(lsa, on->retrans_list); } @@ -464,7 +464,7 @@ int adj_ok(struct thread *thread) int seqnumber_mismatch(struct thread *thread) { struct ospf6_neighbor *on; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; on = (struct ospf6_neighbor *)THREAD_ARG(thread); assert(on); @@ -483,7 +483,7 @@ int seqnumber_mismatch(struct thread *thread) ospf6_lsdb_remove_all(on->summary_list); ospf6_lsdb_remove_all(on->request_list); - for (ALL_LSDB(on->retrans_list, lsa)) { + for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { ospf6_decrement_retrans_count(lsa); ospf6_lsdb_remove(lsa, on->retrans_list); } @@ -501,7 +501,7 @@ int seqnumber_mismatch(struct thread *thread) int bad_lsreq(struct thread *thread) { struct ospf6_neighbor *on; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; on = (struct ospf6_neighbor *)THREAD_ARG(thread); assert(on); @@ -520,7 +520,7 @@ int bad_lsreq(struct thread *thread) ospf6_lsdb_remove_all(on->summary_list); ospf6_lsdb_remove_all(on->request_list); - for (ALL_LSDB(on->retrans_list, lsa)) { + for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { ospf6_decrement_retrans_count(lsa); ospf6_lsdb_remove(lsa, on->retrans_list); } @@ -538,7 +538,7 @@ int bad_lsreq(struct thread *thread) int oneway_received(struct thread *thread) { struct ospf6_neighbor *on; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; on = (struct ospf6_neighbor *)THREAD_ARG(thread); assert(on); @@ -555,7 +555,7 @@ int oneway_received(struct thread *thread) ospf6_lsdb_remove_all(on->summary_list); ospf6_lsdb_remove_all(on->request_list); - for (ALL_LSDB(on->retrans_list, lsa)) { + for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { ospf6_decrement_retrans_count(lsa); ospf6_lsdb_remove(lsa, on->retrans_list); } @@ -685,7 +685,7 @@ static void ospf6_neighbor_show_detail(struct vty *vty, char drouter[16], bdrouter[16]; char linklocal_addr[64], duration[32]; struct timeval now, res; - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; inet_ntop(AF_INET6, &on->linklocal_addr, linklocal_addr, sizeof(linklocal_addr)); @@ -715,15 +715,15 @@ static void ospf6_neighbor_show_detail(struct vty *vty, (unsigned long)ntohl(on->dbdesc_seqnum)); vty_out(vty, " Summary-List: %d LSAs\n", on->summary_list->count); - for (ALL_LSDB(on->summary_list, lsa)) + for (ALL_LSDB(on->summary_list, lsa, lsanext)) vty_out(vty, " %s\n", lsa->name); vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); - for (ALL_LSDB(on->request_list, lsa)) + for (ALL_LSDB(on->request_list, lsa, lsanext)) vty_out(vty, " %s\n", lsa->name); vty_out(vty, " Retrans-List: %d LSAs\n", on->retrans_list->count); - for (ALL_LSDB(on->retrans_list, lsa)) + for (ALL_LSDB(on->retrans_list, lsa, lsanext)) vty_out(vty, " %s\n", lsa->name); timerclear(&res); @@ -733,7 +733,7 @@ static void ospf6_neighbor_show_detail(struct vty *vty, vty_out(vty, " %d Pending LSAs for DbDesc in Time %s [thread %s]\n", on->dbdesc_list->count, duration, (on->thread_send_dbdesc ? "on" : "off")); - for (ALL_LSDB(on->dbdesc_list, lsa)) + for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) vty_out(vty, " %s\n", lsa->name); timerclear(&res); @@ -743,7 +743,7 @@ static void ospf6_neighbor_show_detail(struct vty *vty, vty_out(vty, " %d Pending LSAs for LSReq in Time %s [thread %s]\n", on->request_list->count, duration, (on->thread_send_lsreq ? "on" : "off")); - for (ALL_LSDB(on->request_list, lsa)) + for (ALL_LSDB(on->request_list, lsa, lsanext)) vty_out(vty, " %s\n", lsa->name); timerclear(&res); @@ -754,7 +754,7 @@ static void ospf6_neighbor_show_detail(struct vty *vty, " %d Pending LSAs for LSUpdate in Time %s [thread %s]\n", on->lsupdate_list->count, duration, (on->thread_send_lsupdate ? "on" : "off")); - for (ALL_LSDB(on->lsupdate_list, lsa)) + for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) vty_out(vty, " %s\n", lsa->name); timerclear(&res); @@ -764,7 +764,7 @@ static void ospf6_neighbor_show_detail(struct vty *vty, vty_out(vty, " %d Pending LSAs for LSAck in Time %s [thread %s]\n", on->lsack_list->count, duration, (on->thread_send_lsack ? "on" : "off")); - for (ALL_LSDB(on->lsack_list, lsa)) + for (ALL_LSDB(on->lsack_list, lsa, lsanext)) vty_out(vty, " %s\n", lsa->name); ospf6_bfd_show_info(vty, on->bfd_info, 0); diff --git a/ospf6d/ospf6_snmp.c b/ospf6d/ospf6_snmp.c index 57cc055296..6e24be6a1e 100644 --- a/ospf6d/ospf6_snmp.c +++ b/ospf6d/ospf6_snmp.c @@ -637,7 +637,7 @@ static uint8_t *ospfv3GeneralGroup(struct variable *v, oid *name, { uint16_t sum; uint32_t count; - struct ospf6_lsa *lsa = NULL; + struct ospf6_lsa *lsa = NULL, *lsanext; /* Check whether the instance identifier is valid */ if (smux_header_generic(v, name, length, exact, var_len, write_method) @@ -679,7 +679,7 @@ static uint8_t *ospfv3GeneralGroup(struct variable *v, oid *name, case OSPFv3ASSCOPELSACHECKSUMSUM: if (ospf6) { sum = 0; - for (ALL_LSDB(ospf6->lsdb, lsa)) + for (ALL_LSDB(ospf6->lsdb, lsa, lsanext)) sum += ntohs(lsa->header->checksum); return SNMP_INTEGER(sum); } @@ -733,7 +733,7 @@ static uint8_t *ospfv3AreaEntry(struct variable *v, oid *name, size_t *length, WriteMethod **write_method) { struct ospf6_area *oa, *area = NULL; - struct ospf6_lsa *lsa = NULL; + struct ospf6_lsa *lsa = NULL, *lsanext; uint32_t area_id = 0; uint32_t count; uint16_t sum; @@ -808,7 +808,7 @@ static uint8_t *ospfv3AreaEntry(struct variable *v, oid *name, size_t *length, return SNMP_INTEGER(area->lsdb->count); case OSPFv3AREASCOPELSACKSUMSUM: sum = 0; - for (ALL_LSDB(area->lsdb, lsa)) + for (ALL_LSDB(area->lsdb, lsa, lsanext)) sum += ntohs(lsa->header->checksum); return SNMP_INTEGER(sum); case OSPFv3AREASUMMARY: @@ -1044,7 +1044,7 @@ static uint8_t *ospfv3IfEntry(struct variable *v, oid *name, size_t *length, ifindex_t ifindex = 0; unsigned int instid = 0; struct ospf6_interface *oi = NULL; - struct ospf6_lsa *lsa = NULL; + struct ospf6_lsa *lsa = NULL, *lsanext; struct interface *iif; struct listnode *i; struct list *ifslist; @@ -1171,7 +1171,7 @@ static uint8_t *ospfv3IfEntry(struct variable *v, oid *name, size_t *length, return SNMP_INTEGER(oi->lsdb->count); case OSPFv3IFLINKLSACKSUMSUM: sum = 0; - for (ALL_LSDB(oi->lsdb, lsa)) + for (ALL_LSDB(oi->lsdb, lsa, lsanext)) sum += ntohs(lsa->header->checksum); return SNMP_INTEGER(sum); case OSPFv3IFDEMANDNBRPROBE: diff --git a/ospf6d/ospf6_spf.c b/ospf6d/ospf6_spf.c index e5eb8d74eb..bb6a050976 100644 --- a/ospf6d/ospf6_spf.c +++ b/ospf6d/ospf6_spf.c @@ -1082,9 +1082,9 @@ struct ospf6_lsa *ospf6_create_single_router_lsa(struct ospf6_area *area, void ospf6_remove_temp_router_lsa(struct ospf6_area *area) { - struct ospf6_lsa *lsa = NULL; + struct ospf6_lsa *lsa = NULL, *lsanext; - for (ALL_LSDB(area->temp_router_lsa_lsdb, lsa)) { + for (ALL_LSDB(area->temp_router_lsa_lsdb, lsa, lsanext)) { if (IS_OSPF6_DEBUG_SPF(PROCESS)) zlog_debug( "%s Remove LSA %s lsa->lock %u lsdb count %u", diff --git a/tests/ospf6d/test_lsdb.c b/tests/ospf6d/test_lsdb.c index 24821febe6..c5bdcd3d13 100644 --- a/tests/ospf6d/test_lsdb.c +++ b/tests/ospf6d/test_lsdb.c @@ -134,9 +134,10 @@ DEFPY(lsdb_walk, lsdb_walk_cmd, "LSDB\n" "walk entries\n") { - struct ospf6_lsa *lsa; + struct ospf6_lsa *lsa, *lsanext; + unsigned cnt = 0; - for (ALL_LSDB(lsdb, lsa)) { + for (ALL_LSDB(lsdb, lsa, lsanext)) { lsa_show_oneline(vty, lsa); cnt++; }