diff options
| author | David Lamparter <equinox@opensourcerouting.org> | 2022-03-25 06:55:37 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-03-25 06:55:37 +0100 |
| commit | 619a6623cb6de83f1266beda17842cd1814e5d39 (patch) | |
| tree | 1e768d4e8239e22cc0f47ffa2ba92ff6161d9838 /zebra/kernel_socket.c | |
| parent | d51683e6fe32ef70dc8e5119288be29c18f66d73 (diff) | |
| parent | d0438da6b09333d2b77a9eac2e9fffbbae6e603b (diff) | |
Merge pull request #10867 from donaldsharp/ifp_use_after_free
Diffstat (limited to 'zebra/kernel_socket.c')
| -rw-r--r-- | zebra/kernel_socket.c | 27 |
1 files changed, 15 insertions, 12 deletions
diff --git a/zebra/kernel_socket.c b/zebra/kernel_socket.c index 420e41e394..d6ca92f54e 100644 --- a/zebra/kernel_socket.c +++ b/zebra/kernel_socket.c @@ -453,12 +453,13 @@ static int ifan_read(struct if_announcemsghdr *ifan) if_get_metric(ifp); if_add_update(ifp); } else if (ifp != NULL && ifan->ifan_what == IFAN_DEPARTURE) - if_delete_update(ifp); - - if_get_flags(ifp); - if_get_mtu(ifp); - if_get_metric(ifp); + if_delete_update(&ifp); + if (ifp) { + if_get_flags(ifp); + if_get_mtu(ifp); + if_get_metric(ifp); + } if (IS_ZEBRA_DEBUG_KERNEL) zlog_debug("%s: interface %s index %d", __func__, ifan->ifan_name, ifan->ifan_index); @@ -725,10 +726,10 @@ int ifm_read(struct if_msghdr *ifm) * will still behave correctly if run on a platform * without */ - if_delete_update(ifp); + if_delete_update(&ifp); } #endif /* RTM_IFANNOUNCE */ - if (if_is_up(ifp)) { + if (ifp && if_is_up(ifp)) { #if defined(__bsdi__) if_kvm_get_mtu(ifp); #else @@ -738,14 +739,16 @@ int ifm_read(struct if_msghdr *ifm) } } + if (ifp) { #ifdef HAVE_NET_RT_IFLIST - ifp->stats = ifm->ifm_data; + ifp->stats = ifm->ifm_data; #endif /* HAVE_NET_RT_IFLIST */ - ifp->speed = ifm->ifm_data.ifi_baudrate / 1000000; + ifp->speed = ifm->ifm_data.ifi_baudrate / 1000000; - if (IS_ZEBRA_DEBUG_KERNEL) - zlog_debug("%s: interface %s index %d", __func__, ifp->name, - ifp->ifindex); + if (IS_ZEBRA_DEBUG_KERNEL) + zlog_debug("%s: interface %s index %d", __func__, + ifp->name, ifp->ifindex); + } return 0; } |