proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-15 13:27:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #10213 from idryzhov/isis-adj-uaf

Browse Source 
isisd: fix use after free
This commit is contained in:
Donatas Abraitis 2021-12-16 16:41:11 +02:00 committed by GitHub
commit a98380bb93
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
isisd/isis_adjacency.c
View File

@ -327,16 +327,19 @@ void isis_adj_state_change(struct isis_adjacency **padj,
adj->flaps++; adj->flaps++;
} else if (old_state == ISIS_ADJ_UP) { } else if (old_state == ISIS_ADJ_UP) {
circuit->adj_state_changes++; circuit->adj_state_changes++;
listnode_delete(circuit->u.bc.adjdb[level - 1],
adj);
circuit->upadjcount[level - 1]--; circuit->upadjcount[level - 1]--;
if (circuit->upadjcount[level - 1] == 0) if (circuit->upadjcount[level - 1] == 0)
isis_tx_queue_clean(circuit->tx_queue); isis_tx_queue_clean(circuit->tx_queue);
if (new_state == ISIS_ADJ_DOWN) if (new_state == ISIS_ADJ_DOWN) {
listnode_delete(
circuit->u.bc.adjdb[level - 1],
adj);
del = true; del = true;
} }
}
if (circuit->u.bc.lan_neighs[level - 1]) { if (circuit->u.bc.lan_neighs[level - 1]) {
list_delete_all_node( list_delete_all_node(
@ -374,17 +377,20 @@ void isis_adj_state_change(struct isis_adjacency **padj,
&circuit->t_send_csnp[1]); &circuit->t_send_csnp[1]);
} }
} else if (old_state == ISIS_ADJ_UP) { } else if (old_state == ISIS_ADJ_UP) {
if (adj->circuit->u.p2p.neighbor == adj)
adj->circuit->u.p2p.neighbor = NULL;
circuit->upadjcount[level - 1]--; circuit->upadjcount[level - 1]--;
if (circuit->upadjcount[level - 1] == 0) if (circuit->upadjcount[level - 1] == 0)
isis_tx_queue_clean(circuit->tx_queue); isis_tx_queue_clean(circuit->tx_queue);
if (new_state == ISIS_ADJ_DOWN) if (new_state == ISIS_ADJ_DOWN) {
if (adj->circuit->u.p2p.neighbor == adj)
adj->circuit->u.p2p.neighbor =
NULL;
del = true; del = true;
} }
} }
} }
}
hook_call(isis_adj_state_change_hook, adj); hook_call(isis_adj_state_change_hook, adj);