From 0f12455901fa5d424c28b4af854f6b78e54bafd3 Mon Sep 17 00:00:00 2001 From: Renato Westphal Date: Thu, 8 Dec 2016 17:36:03 -0200 Subject: [PATCH] zebra: fix segfault on exit when RIB debugging is enabled Fixes the following crash on exit: (gdb) bt 0 _rnode_zlog (...) at zebra_rib.c:104 1 0x0000000000417726 in rib_unlink (...) at zebra_rib.c:2370 2 0x000000000042db80 in zebra_rtable_node_destroy (...) at zebra_vrf.c:336 3 0x00007ffff7b6ce2e in route_node_free (...) at table.c:81 4 0x00007ffff7b6ced7 in route_table_free (...) at table.c:118 5 0x00007ffff7b6cd88 in route_table_finish (...) at table.c:53 6 0x000000000042defa in zebra_vrf_delete (...) at zebra_vrf.c:278 7 0x00007ffff7b9e044 in vrf_delete (...) at vrf.c:162 8 0x00007ffff7b9e89f in vrf_terminate () at vrf.c:458 9 0x000000000041027c in sigint () at main.c:205 10 0x00007ffff7b953f2 in quagga_sigevent_process () at sigevent.c:111 11 0x00007ffff7b681dd in thread_fetch (...) at thread.c:1297 12 0x000000000040c7ed in main (...) at main.c:471 To fix the problem, free the table->info pointer only after route_table_finish() is called for the table. Signed-off-by: Renato Westphal --- zebra/zebra_vrf.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/zebra/zebra_vrf.c b/zebra/zebra_vrf.c index bf42792cf8..929743859e 100644 --- a/zebra/zebra_vrf.c +++ b/zebra/zebra_vrf.c @@ -271,11 +271,14 @@ zebra_vrf_delete (struct vrf *vrf) /* release allocated memory */ for (afi = AFI_IP; afi <= AFI_IP6; afi++) { + void *table_info; + for (safi = SAFI_UNICAST; safi <= SAFI_MULTICAST; safi++) { table = zvrf->table[afi][safi]; - XFREE (MTYPE_RIB_TABLE_INFO, table->info); + table_info = table->info; route_table_finish (table); + XFREE (MTYPE_RIB_TABLE_INFO, table_info); table = zvrf->stable[afi][safi]; route_table_finish (table); @@ -285,8 +288,9 @@ zebra_vrf_delete (struct vrf *vrf) if (zvrf->other_table[afi][table_id]) { table = zvrf->other_table[afi][table_id]; - XFREE (MTYPE_RIB_TABLE_INFO, table->info); + table_info = table->info; route_table_finish (table); + XFREE (MTYPE_RIB_TABLE_INFO, table_info); } route_table_finish (zvrf->rnh_table[afi]); -- 2.39.5