diff options
| author | Mobashshera Rasool <mrasool@vmware.com> | 2022-06-24 08:47:09 +0200 |
|---|---|---|
| committer | Mobashshera Rasool <mrasool@vmware.com> | 2022-06-24 12:50:45 +0200 |
| commit | 30247bd637c35ab04f4993e67a36961e4204f12c (patch) | |
| tree | f0539c102582974b01e58eea4e0a60672993b775 /pimd/pim_upstream.c | |
| parent | Merge pull request #11453 from ribarroetavena/master (diff) | |
| download | frr-30247bd637c35ab04f4993e67a36961e4204f12c.tar.xz frr-30247bd637c35ab04f4993e67a36961e4204f12c.zip | |
pimd: Avoid reading freed memory.
If the upstream is freed in pim_upstream_del, then trying to
call pim_upstream_timers_stop will lead to accessing freed memory.
Fix:
Stop the timer only if upstream is not deleted.
Co-authored-by: Sarita Patra <saritap@vmware.com>
Co-authored-by: Mobashshera Rasool <mrasool@vmware.com>
Signed-off-by: Mobashshera Rasool <mrasool@vmware.com>
Diffstat (limited to '')
| -rw-r--r-- | pimd/pim_upstream.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/pimd/pim_upstream.c b/pimd/pim_upstream.c index 3817d5d9e..54a7f59ca 100644 --- a/pimd/pim_upstream.c +++ b/pimd/pim_upstream.c @@ -1948,8 +1948,8 @@ void pim_upstream_terminate(struct pim_instance *pim) struct pim_upstream *up; while ((up = rb_pim_upstream_first(&pim->upstream_head))) { - pim_upstream_del(pim, up, __func__); - pim_upstream_timers_stop(up); + if (pim_upstream_del(pim, up, __func__)) + pim_upstream_timers_stop(up); } rb_pim_upstream_fini(&pim->upstream_head); |