matthieu/frr
1
0
Fork 0
forked from Mirror/frr
Code Pull requests Activity

[bgpd] Bug #533: Fix crash with copy/pasted commands, inc 'no bgp ...'

Browse source 
* bgpd.c: Removal of (struct bgp *) from the master list was being left to
  bgp_free time.  This meant there was a window of time between bgp_delete
  and refcounts hitting 0 (e.g.  routes to be processed) where bgp_lookup's
  could return a deleted (struct bgp *).

  (bgp_delete) This is the logical place where a (struct bgp *) should lose
  its visibility, so move the deletion from the bgp-master list to here,
  from bgp_free.

  Many thanks to Fritz Reichmann for his thorough debugging of the problem
  and testing of fixes and Chris Caputo for his further analysis.
This commit is contained in:
Paul Jakma 2009-07-16 19:27:32 +01:00
parent 3fa3f957e7
commit fd35b948db
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
bgpd/bgpd.c
View file

@ -2074,6 +2074,11 @@ bgp_delete (struct bgp *bgp)
bgp->peer_self = NULL;
}
/* Remove visibility via the master list - there may however still be
* routes to be processed still referencing the struct bgp.
*/
listnode_delete (bm->bgp, bgp);
bgp_unlock(bgp); /* initial reference */
return 0;
@ -2104,8 +2109,6 @@ bgp_free (struct bgp *bgp)
list_delete (bgp->peer);
list_delete (bgp->rsclient);
listnode_delete (bm->bgp, bgp);
if (bgp->name)
free (bgp->name);