Merge pull request #17143 from FRRouting/mergify/bp/dev/10.2/pr-17020

zebra: fix heap-use-after free on ns shutdown (backport #17020)

1 files changed, 17 insertions, 3 deletions

diff --git a/zebra/zebra_ns.c b/zebra/zebra_ns.c
index 803d8f0034..ffd749fcf1 100644
--- a/zebra/zebra_ns.c
+++ b/zebra/zebra_ns.c
@@ -175,6 +175,22 @@ int zebra_ns_early_shutdown(struct ns *ns,
 	return NS_WALK_CONTINUE;
 }
 
+/* During zebra shutdown, do kernel cleanup
+ * netlink sockets, ..
+ */
+int zebra_ns_kernel_shutdown(struct ns *ns, void *param_in __attribute__((unused)),
+			     void **param_out __attribute__((unused)))
+{
+	struct zebra_ns *zns = ns->info;
+
+	if (zns == NULL)
+		return NS_WALK_CONTINUE;
+
+	kernel_terminate(zns, true);
+
+	return NS_WALK_CONTINUE;
+}
+
 /* During zebra shutdown, do final cleanup
  * after all dataplane work is complete.
  */
@@ -185,9 +201,7 @@ int zebra_ns_final_shutdown(struct ns *ns,
 	struct zebra_ns *zns = ns->info;
 
 	if (zns == NULL)
-		return 0;
-
-	kernel_terminate(zns, true);
+		return NS_WALK_CONTINUE;
 
 	zebra_ns_delete(ns);