proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-16 00:25:01 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

pimd: Fix pim_mroute_del crash while terminating pimd

Browse Source 
When pimd is getting terminated, pim_upstream_del() gets called as
part of cleaning process. pim_upstream_del() deletes the route and
assigns NULL to the up->channel_oil. It also deletes each if_channel
by calling the function pim_ifchannel_delete().
pim_ifchannel_delete() internally calls the caller function pim_upstream_del(),
if it is the last ifchannel for that upstream. So pim_upstream_del
is getting called twice, which will access the up->channel_oil which
was already set to NULL before. This results in crash.

Fix:
pim_ifchannel_delete() should call pim_upstream_del (caller function)
only if the up->ref_count > 0. Added an assert(up->ref_count > 0) in
the function pim_upstream_del().

Signed-off-by: Sarita Patra <saritap@vmware.com>
This commit is contained in:
root 2018-08-22 00:00:32 -07:00
parent f8a523363e
commit e83f3b316a
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pimd/pim_ifchannel.c
View File

@ -174,7 +174,16 @@ void pim_ifchannel_delete(struct pim_ifchannel *ch)
ifchannel list is empty before deleting upstream_del
ref count will take care of it.
*/
pim_upstream_del(pim_ifp->pim, ch->upstream, __PRETTY_FUNCTION__);
if (ch->upstream->ref_count > 0)
pim_upstream_del(pim_ifp->pim, ch->upstream,
__PRETTY_FUNCTION__);
else
zlog_warn("%s: Avoiding deletion of upstream with ref_count %d "
"from ifchannel(%s): %s", __PRETTY_FUNCTION__,
ch->upstream->ref_count, ch->interface->name,
ch->sg_str);
ch->upstream = NULL;
THREAD_OFF(ch->t_ifjoin_expiry_timer);

2
pimd/pim_upstream.c
View File

@ -167,6 +167,8 @@ struct pim_upstream *pim_upstream_del(struct pim_instance *pim,
up->ref_count, up->flags,
up->channel_oil->oil_ref_count);
assert(up->ref_count > 0);
--up->ref_count;
if (up->ref_count >= 1)