From: Quentin Young <qlyoung@cumulusnetworks.com>
Date: Tue, 6 Mar 2018 18:42:53 +0000 (-0500)
Subject: ospfd: cancel SR thread at shutdown
X-Git-Tag: frr-5.0-dev~187^2
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=45a4385612b5d9b57a0c862750339a0e2ae66740;p=matthieu%2Ffrr.git

ospfd: cancel SR thread at shutdown

Otherwise if it is scheduled the thread pointer will be accessed after
the shutdown task finishes accessing, having deleted the structure that
owns said pointer, which causes a heap UAF.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
---

diff --git a/ospfd/ospfd.c b/ospfd/ospfd.c
index 79af4a55fb..b3c4e4a365 100644
--- a/ospfd/ospfd.c
+++ b/ospfd/ospfd.c
@@ -707,6 +707,7 @@ static void ospf_finish_final(struct ospf *ospf)
 	OSPF_TIMER_OFF(ospf->t_read);
 	OSPF_TIMER_OFF(ospf->t_write);
 	OSPF_TIMER_OFF(ospf->t_opaque_lsa_self);
+	OSPF_TIMER_OFF(ospf->t_sr_update);
 
 	close(ospf->fd);
 	stream_free(ospf->ibuf);