From: Rajasekar Raja <rajasekarr@nvidia.com>
Date: Mon, 22 Jul 2024 17:13:19 +0000 (-0700)
Subject: bgpd: backpressure - Avoid use after free
X-Git-Tag: docker/10.1.0~10^2
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=refs%2Fpull%2F16441%2Fhead;p=mirror%2Ffrr.git

bgpd: backpressure - Avoid use after free

Coverity complains there is a use after free (1598495 and 1598496)
At this point, most likely dest->refcount cannot go 1 and free up
the dest, but there might be some code path where this can happen.

Fixing this with a simple order change (no harm fix).

Ticket :#4001204

Signed-off-by: Rajasekar Raja <rajasekarr@nvidia.com>
(cherry picked from commit 40965e599975b019bbe6f4b1dfb3ff22d8980876)
---

diff --git a/bgpd/bgp_evpn.c b/bgpd/bgp_evpn.c
index 9a796ef91b..0485bbac64 100644
--- a/bgpd/bgp_evpn.c
+++ b/bgpd/bgp_evpn.c
@@ -6338,9 +6338,9 @@ void bgp_evpn_free(struct bgp *bgp, struct bgpevpn *vpn)
 	     dest = dest_next) {
 		dest_next = zebra_announce_next(&bm->zebra_announce_head, dest);
 		if (dest->za_vpn == vpn) {
+			zebra_announce_del(&bm->zebra_announce_head, dest);
 			bgp_path_info_unlock(dest->za_bgp_pi);
 			bgp_dest_unlock_node(dest);
-			zebra_announce_del(&bm->zebra_announce_head, dest);
 		}
 	}
 
diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index 08d1268e9e..894226adac 100644
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -3930,9 +3930,9 @@ int bgp_delete(struct bgp *bgp)
 		dest_next = zebra_announce_next(&bm->zebra_announce_head, dest);
 		dest_table = bgp_dest_table(dest);
 		if (dest_table->bgp == bgp) {
+			zebra_announce_del(&bm->zebra_announce_head, dest);
 			bgp_path_info_unlock(dest->za_bgp_pi);
 			bgp_dest_unlock_node(dest);
-			zebra_announce_del(&bm->zebra_announce_head, dest);
 		}
 	}