diff options
| author | Acee Lindem <acee@lindem.com> | 2025-02-24 21:44:32 +0000 |
|---|---|---|
| committer | Mergify <37929162+mergify[bot]@users.noreply.github.com> | 2025-02-26 17:48:49 +0000 |
| commit | 0d7236c2d279d95a83e71ead532ee86b9e0d9fe8 (patch) | |
| tree | a323182bd05a413d389544fe9594bcc6aaf7859c | |
| parent | b26f7fba928bc1291d5a97774efe1f6d898c9f6e (diff) | |
ospf6d: Fix use after free of router in OSPFv3 ABR route calculation.
This PR fixes FRR issue https://github.com/FRRouting/frr/issues/18040. The
OSPFv3 route is locked during the ABR calculation since there are
scenarios under which it is freed. The OSPFv3 ABR computation is
sub-optimal and this PR doesn't attempt to rework it.
Signed-off-by: Acee Lindem <acee@lindem.com>
(cherry picked from commit 06af50eacec8660fada0d4fd5cd11f0ade4e3c6c)
| -rw-r--r-- | ospf6d/ospf6_intra.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/ospf6d/ospf6_intra.c b/ospf6d/ospf6_intra.c index 324cd7abe8..23a5ec0695 100644 --- a/ospf6d/ospf6_intra.c +++ b/ospf6d/ospf6_intra.c @@ -2194,9 +2194,15 @@ void ospf6_intra_brouter_calculation(struct ospf6_area *oa) zlog_info("%s: brouter %s appears via area %s", __func__, brouter_name, oa->name); + ospf6_route_lock(brouter); /* newly added */ if (hook_add) (*hook_add)(brouter); + if (CHECK_FLAG(brouter->flag, OSPF6_ROUTE_WAS_REMOVED)) { + ospf6_route_unlock(brouter); + brouter = NULL; + } else + ospf6_route_unlock(brouter); } else { if (IS_OSPF6_DEBUG_BROUTER_SPECIFIC_ROUTER_ID( brouter_id) |