]> git.proxmox.com Git - mirror_frr.git/commit - pimd/pim_upstream.c
pimd: Fix pim_mroute_del crash while terminating pimd
authorroot <root@dev.vmware.com>
Wed, 22 Aug 2018 07:00:32 +0000 (00:00 -0700)
committerroot <root@dev.vmware.com>
Wed, 22 Aug 2018 07:00:32 +0000 (00:00 -0700)
commite83f3b316a3a582f31031c9eba0273259a155711
treeb65236c446be36a0c14e35771e31b56f7d1fa81d
parentf8a523363e8a948aa0a55477826b8fae1d43cd5a
pimd: Fix pim_mroute_del crash while terminating pimd

When pimd is getting terminated, pim_upstream_del() gets called as
part of cleaning process. pim_upstream_del() deletes the route and
assigns NULL to the up->channel_oil. It also deletes each if_channel
by calling the function pim_ifchannel_delete().
pim_ifchannel_delete() internally calls the caller function pim_upstream_del(),
if it is the last ifchannel for that upstream. So pim_upstream_del
is getting called twice, which will access the up->channel_oil which
was already set to NULL before. This results in crash.

Fix:
pim_ifchannel_delete() should call pim_upstream_del (caller function)
only if the up->ref_count > 0. Added an assert(up->ref_count > 0) in
the function pim_upstream_del().

Signed-off-by: Sarita Patra <saritap@vmware.com>
pimd/pim_ifchannel.c
pimd/pim_upstream.c