Merge pull request #13900 from donaldsharp/neighbor_structure_crash

ospf6d: Fix crash because neighbor structure was freed

3 files changed, 6 insertions, 2 deletions

diff --git a/ospf6d/ospf6_message.c b/ospf6d/ospf6_message.c
index de75b78eb0..cc00604f0a 100644
--- a/ospf6d/ospf6_message.c
+++ b/ospf6d/ospf6_message.c
@@ -2533,7 +2533,8 @@ void ospf6_lsreq_send(struct event *thread)
 
 	/* schedule loading_done if request list is empty */
 	if (on->request_list->count == 0) {
-		event_add_event(master, loading_done, on, 0, NULL);
+		event_add_event(master, loading_done, on, 0,
+				&on->event_loading_done);
 		return;
 	}
 
diff --git a/ospf6d/ospf6_neighbor.c b/ospf6d/ospf6_neighbor.c
index 42e4074522..dc7abdd84c 100644
--- a/ospf6d/ospf6_neighbor.c
+++ b/ospf6d/ospf6_neighbor.c
@@ -173,6 +173,7 @@ void ospf6_neighbor_delete(struct ospf6_neighbor *on)
 	EVENT_OFF(on->thread_send_lsack);
 	EVENT_OFF(on->thread_exchange_done);
 	EVENT_OFF(on->thread_adj_ok);
+	EVENT_OFF(on->event_loading_done);
 
 	EVENT_OFF(on->gr_helper_info.t_grace_timer);
 
@@ -428,7 +429,8 @@ void ospf6_check_nbr_loading(struct ospf6_neighbor *on)
 	if ((on->state == OSPF6_NEIGHBOR_LOADING)
 	    || (on->state == OSPF6_NEIGHBOR_EXCHANGE)) {
 		if (on->request_list->count == 0)
-			event_add_event(master, loading_done, on, 0, NULL);
+			event_add_event(master, loading_done, on, 0,
+					&on->event_loading_done);
 		else if (on->last_ls_req == NULL) {
 			EVENT_OFF(on->thread_send_lsreq);
 			event_add_event(master, ospf6_lsreq_send, on, 0,
diff --git a/ospf6d/ospf6_neighbor.h b/ospf6d/ospf6_neighbor.h
index 5ec754d3a4..226f4c1322 100644
--- a/ospf6d/ospf6_neighbor.h
+++ b/ospf6d/ospf6_neighbor.h
@@ -123,6 +123,7 @@ struct ospf6_neighbor {
 	struct event *thread_send_lsack;
 	struct event *thread_exchange_done;
 	struct event *thread_adj_ok;
+	struct event *event_loading_done;
 
 	/* BFD information */
 	struct bfd_session_params *bfd_session;