diff options
| author | Daniel Walton <dwalton@cumulusnetworks.com> | 2015-11-20 18:43:33 +0000 |
|---|---|---|
| committer | Daniel Walton <dwalton@cumulusnetworks.com> | 2015-11-20 18:43:33 +0000 |
| commit | bd0c620c9303e4b06e131702fb33a444749d472b (patch) | |
| tree | da301e7006a1dc3bb8cab8279156e284b74ca7b4 | |
| parent | 99030da1245d5d73d2201cc86970182d7a1cbe7f (diff) | |
BGP crash in group_announce_route_walkcb
Signed-off-by: Daniel Walton <dwalton@cumulusnetworks.com>
Reviewed-by: Donald Sharp <sharpd@cumulusnetworks.com>
Ticket: CM-8295
This is a regression from the addpath-tx commit. We loop over the adj_out list
but the adj can be freed within the body of the loop so we need to note adj->next
prior to the free.
| -rw-r--r-- | bgpd/bgp_updgrp_adv.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/bgpd/bgp_updgrp_adv.c b/bgpd/bgp_updgrp_adv.c index eeb6643573..27597bf428 100644 --- a/bgpd/bgp_updgrp_adv.c +++ b/bgpd/bgp_updgrp_adv.c @@ -113,7 +113,7 @@ group_announce_route_walkcb (struct update_group *updgrp, void *arg) afi_t afi; safi_t safi; struct peer *peer; - struct bgp_adj_out *adj; + struct bgp_adj_out *adj, *adj_next; int addpath_capable; afi = UPDGRP_AFI (updgrp); @@ -136,8 +136,10 @@ group_announce_route_walkcb (struct update_group *updgrp, void *arg) { /* Look through all of the paths we have advertised for this rn and * send a withdraw for the ones that are no longer present */ - for (adj = ctx->rn->adj_out; adj; adj = adj->next) + for (adj = ctx->rn->adj_out; adj; adj = adj_next) { + adj_next = adj->next; + if (adj->subgroup == subgrp) { for (ri = ctx->rn->info; ri; ri = ri->next) @@ -181,8 +183,10 @@ group_announce_route_walkcb (struct update_group *updgrp, void *arg) { /* Find the addpath_tx_id of the path we had advertised and * send a withdraw */ - for (adj = ctx->rn->adj_out; adj; adj = adj->next) + for (adj = ctx->rn->adj_out; adj; adj = adj_next) { + adj_next = adj->next; + if (adj->subgroup == subgrp) { subgroup_process_announce_selected (subgrp, NULL, ctx->rn, adj->addpath_tx_id); |