From bd0c620c9303e4b06e131702fb33a444749d472b Mon Sep 17 00:00:00 2001 From: Daniel Walton Date: Fri, 20 Nov 2015 18:43:33 +0000 Subject: [PATCH] BGP crash in group_announce_route_walkcb Signed-off-by: Daniel Walton Reviewed-by: Donald Sharp Ticket: CM-8295 This is a regression from the addpath-tx commit. We loop over the adj_out list but the adj can be freed within the body of the loop so we need to note adj->next prior to the free. --- bgpd/bgp_updgrp_adv.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/bgpd/bgp_updgrp_adv.c b/bgpd/bgp_updgrp_adv.c index eeb6643573..27597bf428 100644 --- a/bgpd/bgp_updgrp_adv.c +++ b/bgpd/bgp_updgrp_adv.c @@ -113,7 +113,7 @@ group_announce_route_walkcb (struct update_group *updgrp, void *arg) afi_t afi; safi_t safi; struct peer *peer; - struct bgp_adj_out *adj; + struct bgp_adj_out *adj, *adj_next; int addpath_capable; afi = UPDGRP_AFI (updgrp); @@ -136,8 +136,10 @@ group_announce_route_walkcb (struct update_group *updgrp, void *arg) { /* Look through all of the paths we have advertised for this rn and * send a withdraw for the ones that are no longer present */ - for (adj = ctx->rn->adj_out; adj; adj = adj->next) + for (adj = ctx->rn->adj_out; adj; adj = adj_next) { + adj_next = adj->next; + if (adj->subgroup == subgrp) { for (ri = ctx->rn->info; ri; ri = ri->next) @@ -181,8 +183,10 @@ group_announce_route_walkcb (struct update_group *updgrp, void *arg) { /* Find the addpath_tx_id of the path we had advertised and * send a withdraw */ - for (adj = ctx->rn->adj_out; adj; adj = adj->next) + for (adj = ctx->rn->adj_out; adj; adj = adj_next) { + adj_next = adj->next; + if (adj->subgroup == subgrp) { subgroup_process_announce_selected (subgrp, NULL, ctx->rn, adj->addpath_tx_id); -- 2.39.5