From: Donald Sharp <sharpd@cumulusnetworks.com>
Date: Wed, 1 Aug 2018 13:29:43 +0000 (-0400)
Subject: bgpd: Intentionally stop some timers on instance removal
X-Git-Tag: frr-6.1-dev~112^2
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=c969b2edae68816f42a3893ac6dba7873e83981b;p=matthieu%2Ffrr.git

bgpd: Intentionally stop some timers on instance removal

When a bgp instance is stopped, with a `no router bgp..`
make sure any timers associated with the instance are stopped
as well.

This issue was discovered when a customer issued a `no router bgp`
while a maxmed timer was operative.  The max-med timer used the
`struct bgp *` as the passed in value for the thread.  The
thread eventually popped after the cleanup and attempted to use
data off in lala land and crashed

Ticket: CM-21895
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
---

diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index b5fb653bae..82da0245b5 100644
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -3120,6 +3120,9 @@ int bgp_delete(struct bgp *bgp)
 
 	assert(bgp);
 	THREAD_OFF(bgp->t_startup);
+	THREAD_OFF(bgp->t_maxmed_onstartup);
+	THREAD_OFF(bgp->t_update_delay);
+	THREAD_OFF(bgp->t_establish_wait);
 
 	if (BGP_DEBUG(zebra, ZEBRA)) {
 		if (bgp->inst_type == BGP_INSTANCE_TYPE_DEFAULT)