diff options
| author | Donatas Abraitis <donatas.abraitis@gmail.com> | 2020-10-18 15:32:11 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-10-18 15:32:11 +0300 |
| commit | 175b6f3585307f1ffd47eacabb0275c33a8405be (patch) | |
| tree | b3fd1855c84330d5d49ddba492c486b826c7a0d2 /zebra/zebra_rib.c | |
| parent | b5566ba4810a10c10bb200ec909cadf3e4e2da48 (diff) | |
| parent | 947097eddf63ad4c01c7fbe5477fd877c7a2724a (diff) | |
Merge pull request #7331 from donaldsharp/75_zebra_use_after_free
[7.5]zebra: Fix use after free in debug path
Diffstat (limited to 'zebra/zebra_rib.c')
| -rw-r--r-- | zebra/zebra_rib.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/zebra/zebra_rib.c b/zebra/zebra_rib.c index 10b5f3c174..215188ac12 100644 --- a/zebra/zebra_rib.c +++ b/zebra/zebra_rib.c @@ -2240,9 +2240,18 @@ static void process_subq_route(struct listnode *lnode, uint8_t qindex) rib_process(rnode); if (IS_ZEBRA_DEBUG_RIB_DETAILED) { - struct route_entry *re = re_list_first(&dest->routes); + struct route_entry *re = NULL; char buf[SRCDEST2STR_BUFFER]; + /* + * rib_process may have freed the dest + * as part of the garbage collection. Let's + * prevent stupidity from happening. + */ + dest = rib_dest_from_rnode(rnode); + if (dest) + re = re_list_first(&dest->routes); + srcdest_rnode2str(rnode, buf, sizeof(buf)); zlog_debug("%s(%u:%u):%s: rn %p dequeued from sub-queue %u", zvrf_name(zvrf), zvrf_id(zvrf), re ? re->table : 0, buf, |