proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-07-17 17:08:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

bgpd: Hash release before we change the underlying hash assumptions

Browse Source 
The bgp->peerhash is made up of the sockunion and the CONFIG_NODE
flag.  If the CONFIG_NODE flag is moved around or changed then
we get into a situation where both the doppelganger and the peer
actually hash to the exact same thing.  Leading to wrongful deletion
and pointers being used after freed.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
This commit is contained in:
Donald Sharp 2022-12-02 12:51:34 -05:00
parent e235185279
commit 56b7d690bb
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
bgpd/bgp_fsm.c
View File

@ -2106,6 +2106,10 @@ static int bgp_establish(struct peer *peer)
int status; int status;
other = peer->doppelganger; other = peer->doppelganger;
hash_release(peer->bgp->peerhash, peer);
if (other)
hash_release(peer->bgp->peerhash, other);
peer = peer_xfer_conn(peer); peer = peer_xfer_conn(peer);
if (!peer) { if (!peer) {
flog_err(EC_BGP_CONNECT, "%%Neighbor failed in xfer_conn"); flog_err(EC_BGP_CONNECT, "%%Neighbor failed in xfer_conn");
@ -2310,7 +2314,6 @@ static int bgp_establish(struct peer *peer)
* the doppelgangers su and this peer's su are the same * the doppelgangers su and this peer's su are the same
* so the hash_release is the same for either. * so the hash_release is the same for either.
*/ */
hash_release(peer->bgp->peerhash, peer);
(void)hash_get(peer->bgp->peerhash, peer, hash_alloc_intern); (void)hash_get(peer->bgp->peerhash, peer, hash_alloc_intern);
/* Start BFD peer if not already running. */ /* Start BFD peer if not already running. */