summaryrefslogtreecommitdiffstats
path: root/bfdd
diff options
context:
space:
mode:
authorDonald Sharp <sharpd@nvidia.com>2021-02-07 21:03:51 +0100
committerDonald Sharp <sharpd@nvidia.com>2021-02-07 21:03:51 +0100
commit14b3514806a3c0c649bef0cd51af364947b8b7b6 (patch)
treef0e0e22c436e2c0d935116b18b03ef98a14211a3 /bfdd
parent*: Fix usage of bfd_adj_event (diff)
downloadfrr-14b3514806a3c0c649bef0cd51af364947b8b7b6.tar.xz
frr-14b3514806a3c0c649bef0cd51af364947b8b7b6.zip
bfdd: Prevent use after free ( again )
Valgrind is still reporting: 466020-==466020== by 0x11B9F4: main (bfdd.c:403) 466020-==466020== Address 0x5a7d544 is 84 bytes inside a block of size 272 free'd 466020:==466020== at 0x48399AB: free (vg_replace_malloc.c:538) 466020-==466020== by 0x490A947: qfree (memory.c:140) 466020-==466020== by 0x48F2AE8: if_delete (if.c:322) 466020-==466020== by 0x48F250D: if_destroy_via_zapi (if.c:195) 466020-==466020== by 0x497071E: zclient_interface_delete (zclient.c:2040) 466020-==466020== by 0x49745F6: zclient_read (zclient.c:3687) 466020-==466020== by 0x4955AEC: thread_call (thread.c:1684) 466020-==466020== by 0x48FF64E: frr_run (libfrr.c:1126) 466020-==466020== by 0x11B9F4: main (bfdd.c:403) 466020-==466020== Block was alloc'd at 466020:==466020== at 0x483AB65: calloc (vg_replace_malloc.c:760) 466020-==466020== by 0x490A805: qcalloc (memory.c:115) 466020-==466020== by 0x48F23D6: if_new (if.c:160) 466020-==466020== by 0x48F257F: if_create_name (if.c:214) 466020-==466020== by 0x48F3493: if_get_by_name (if.c:558) 466020-==466020== by 0x49705F2: zclient_interface_add (zclient.c:1989) 466020-==466020== by 0x49745E0: zclient_read (zclient.c:3684) 466020-==466020== by 0x4955AEC: thread_call (thread.c:1684) 466020-==466020== by 0x48FF64E: frr_run (libfrr.c:1126) 466020-==466020== by 0x11B9F4: main (bfdd.c:403) Apparently the bs->ifp pointer is being set even in cases when the bs->key.ifname is not being set. So go through and just match the interface pointer and cut-to-the-chase. Signed-off-by: Donald Sharp <sharpd@nvidia.com>
Diffstat (limited to 'bfdd')
-rw-r--r--bfdd/ptm_adapter.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/bfdd/ptm_adapter.c b/bfdd/ptm_adapter.c
index db636c919..0c70600f2 100644
--- a/bfdd/ptm_adapter.c
+++ b/bfdd/ptm_adapter.c
@@ -703,8 +703,10 @@ static void bfdd_sessions_disable_interface(struct interface *ifp)
TAILQ_FOREACH(bso, &bglobal.bg_obslist, bso_entry) {
bs = bso->bso_bs;
- if (strcmp(ifp->name, bs->key.ifname))
+
+ if (bs->ifp != ifp)
continue;
+
/* Skip disabled sessions. */
if (bs->sock == -1) {
bs->ifp = NULL;