Merge pull request #3856 from donaldsharp/dplane_use_after_free

zebra: Fix use after free in rib_process_result

1 files changed, 3 insertions, 2 deletions

diff --git a/zebra/zebra_rib.c b/zebra/zebra_rib.c
index b71bf77df2..5f9210109d 100644
--- a/zebra/zebra_rib.c
+++ b/zebra/zebra_rib.c
@@ -1879,8 +1879,6 @@ static void rib_process_result(struct zebra_dplane_ctx *ctx)
 		goto done;
 	}
 
-	route_unlock_node(rn);
-
 	srcdest_rnode_prefixes(rn, &dest_pfx, &src_pfx);
 
 	op = dplane_ctx_get_op(ctx);
@@ -2065,6 +2063,9 @@ static void rib_process_result(struct zebra_dplane_ctx *ctx)
 	}
 done:
 
+	if (rn)
+		route_unlock_node(rn);
+
 	/* Return context to dataplane module */
 	dplane_ctx_fini(&ctx);
 }