diff options
| author | Donald Sharp <sharpd@nvidia.com> | 2025-02-10 12:02:00 -0500 |
|---|---|---|
| committer | Mergify <37929162+mergify[bot]@users.noreply.github.com> | 2025-02-13 17:45:22 +0000 |
| commit | 20e543dd763c622eb7344352a92c5a9fef06981d (patch) | |
| tree | be48753582830379b5f76f7fd7af967918f077d4 /lib/srv6.c | |
| parent | b54519d027a0535bbe0d3fd0a8bf27873e866009 (diff) | |
bgpd: Fix crash in bgp_labelpool
The bgp labelpool code is grabbing the vpn policy data structure.
This vpn_policy has a pointer to the bgp data structure. If
a item placed on the bgp label pool workqueue happens to sit
there for the microsecond or so and the operator issues a
`no router bgp...` command that corresponds to the vpn_policy
bgp pointer, when the workqueue is run it will crash because
the bgp pointer is now freed and something else owns it.
Modify the labelpool code to store the vrf id associated
with the request on the workqueue. When you wake up
if the vrf id still has a bgp pointer allow the request
to continue, else drop it.
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
(cherry picked from commit 14eac319e8ae9314f5270f871106a70c4986c60c)
Diffstat (limited to 'lib/srv6.c')
0 files changed, 0 insertions, 0 deletions