From 5d05de671f3448cac247d8d694b7fe8964535758 Mon Sep 17 00:00:00 2001 From: Mark Stapp Date: Wed, 22 Feb 2023 08:58:28 -0500 Subject: [PATCH] bgpd: free rfapi callback object always An rfapi timer callback is responsible for the memory in a context object, even in special-case exit paths. Always free that object. Signed-off-by: Mark Stapp (cherry picked from commit 870d3d2cb8e2fa6ff9329ec7126265d1e25a38ae) --- bgpd/rfapi/rfapi_import.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/bgpd/rfapi/rfapi_import.c b/bgpd/rfapi/rfapi_import.c index 2aae0bc616..f8d950b8db 100644 --- a/bgpd/rfapi/rfapi_import.c +++ b/bgpd/rfapi/rfapi_import.c @@ -2344,8 +2344,7 @@ static void rfapiMonitorEncapDelete(struct bgp_path_info *vpn_bpi) } /* - * quagga lib/thread.h says this must return int even though - * it doesn't do anything with the return value + * Timer callback for withdraw */ static void rfapiWithdrawTimerVPN(struct thread *t) { @@ -2355,19 +2354,27 @@ static void rfapiWithdrawTimerVPN(struct thread *t) const struct prefix *p; struct rfapi_monitor_vpn *moved; afi_t afi; + bool early_exit = false; if (bgp == NULL) { vnc_zlog_debug_verbose( "%s: NULL BGP pointer, assume shutdown race condition!!!", __func__); - return; + early_exit = true; } - if (CHECK_FLAG(bgp->flags, BGP_FLAG_DELETE_IN_PROGRESS)) { + if (bgp && CHECK_FLAG(bgp->flags, BGP_FLAG_DELETE_IN_PROGRESS)) { vnc_zlog_debug_verbose( "%s: BGP delete in progress, assume shutdown race condition!!!", __func__); + early_exit = true; + } + + /* This callback is responsible for the withdraw object's memory */ + if (early_exit) { + XFREE(MTYPE_RFAPI_WITHDRAW, wcb); return; } + assert(wcb->node); assert(bpi); assert(wcb->import_table); -- 2.39.5