From: Quentin Young <qlyoung@cumulusnetworks.com>
Date: Tue, 6 Mar 2018 18:42:53 +0000 (-0500)
Subject: ospfd: cancel SR thread at shutdown
X-Git-Tag: frr-4.0~5^2
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=8431215f6ea167d3741ced597b8548b45f4b265e;p=matthieu%2Ffrr.git

ospfd: cancel SR thread at shutdown

Otherwise if it is scheduled the thread pointer will be accessed after
the shutdown task finishes accessing, having deleted the structure that
owns said pointer, which causes a heap UAF.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
---

diff --git a/ospfd/ospfd.c b/ospfd/ospfd.c
index 86a3293d71..eda0fd4773 100644
--- a/ospfd/ospfd.c
+++ b/ospfd/ospfd.c
@@ -704,6 +704,7 @@ static void ospf_finish_final(struct ospf *ospf)
 	OSPF_TIMER_OFF(ospf->t_read);
 	OSPF_TIMER_OFF(ospf->t_write);
 	OSPF_TIMER_OFF(ospf->t_opaque_lsa_self);
+	OSPF_TIMER_OFF(ospf->t_sr_update);
 
 	close(ospf->fd);
 	stream_free(ospf->ibuf);