diff options
| author | Donald Sharp <sharpd@cumulusnetworks.com> | 2020-04-17 21:18:53 -0400 |
|---|---|---|
| committer | Donald Sharp <sharpd@cumulusnetworks.com> | 2020-04-18 08:35:06 -0400 |
| commit | 744ba5696921114b552a05cd848a4f7da5b449b6 (patch) | |
| tree | d5e176b7e7d5c6861778505b84c141e4a9702c84 /ospf6d/ospf6_message.c | |
| parent | 16167b31469c1cf3c6203495e639cbf640ef45f1 (diff) | |
ospf6d: Prevent use after free
ospf6_lsa_unlock may free the lsa data structure as such
we cannot use the passed in data structure after freeing it.
Provide a mechanism to know if the data has been freed
using the same usage patterns of other _unlock functions
in FRR.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Diffstat (limited to 'ospf6d/ospf6_message.c')
| -rw-r--r-- | ospf6d/ospf6_message.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/ospf6d/ospf6_message.c b/ospf6d/ospf6_message.c index 21f9b0722c..31862a2298 100644 --- a/ospf6d/ospf6_message.c +++ b/ospf6d/ospf6_message.c @@ -1948,9 +1948,9 @@ int ospf6_lsreq_send(struct thread *thread) } if (last_req != NULL) { - if (on->last_ls_req != NULL) { - ospf6_lsa_unlock(on->last_ls_req); - } + if (on->last_ls_req != NULL) + on->last_ls_req = ospf6_lsa_unlock(on->last_ls_req); + ospf6_lsa_lock(last_req); on->last_ls_req = last_req; } |