diff options
| author | Donald Sharp <sharpd@cumulusnetworks.com> | 2020-04-17 21:18:53 -0400 |
|---|---|---|
| committer | Donald Sharp <sharpd@cumulusnetworks.com> | 2020-04-18 08:35:06 -0400 |
| commit | 744ba5696921114b552a05cd848a4f7da5b449b6 (patch) | |
| tree | d5e176b7e7d5c6861778505b84c141e4a9702c84 /ospf6d/ospf6_lsdb.c | |
| parent | 16167b31469c1cf3c6203495e639cbf640ef45f1 (diff) | |
ospf6d: Prevent use after free
ospf6_lsa_unlock may free the lsa data structure as such
we cannot use the passed in data structure after freeing it.
Provide a mechanism to know if the data has been freed
using the same usage patterns of other _unlock functions
in FRR.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Diffstat (limited to 'ospf6d/ospf6_lsdb.c')
| -rw-r--r-- | ospf6d/ospf6_lsdb.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/ospf6d/ospf6_lsdb.c b/ospf6d/ospf6_lsdb.c index 0a9f1c6f7c..18fcec82c1 100644 --- a/ospf6d/ospf6_lsdb.c +++ b/ospf6d/ospf6_lsdb.c @@ -136,7 +136,7 @@ void ospf6_lsdb_add(struct ospf6_lsa *lsa, struct ospf6_lsdb *lsdb) } /* to free the lookup lock in node get*/ route_unlock_node(current); - ospf6_lsa_unlock(old); + old = ospf6_lsa_unlock(old); } ospf6_lsdb_count_assert(lsdb); @@ -164,7 +164,7 @@ void ospf6_lsdb_remove(struct ospf6_lsa *lsa, struct ospf6_lsdb *lsdb) route_unlock_node(node); /* to free the lookup lock */ route_unlock_node(node); /* to free the original lock */ - ospf6_lsa_unlock(lsa); + lsa = ospf6_lsa_unlock(lsa); ospf6_lsdb_count_assert(lsdb); } @@ -279,7 +279,7 @@ struct ospf6_lsa *ospf6_lsdb_next(const struct route_node *iterend, { struct route_node *node = lsa->rn; - ospf6_lsa_unlock(lsa); + lsa = ospf6_lsa_unlock(lsa); do node = route_next_until(node, iterend); @@ -316,7 +316,7 @@ void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa) if (lsa != NULL) { if (lsa->rn != NULL) route_unlock_node(lsa->rn); - ospf6_lsa_unlock(lsa); + lsa = ospf6_lsa_unlock(lsa); } } |