pimd: Avoid reading freed memory.

If the upstream is freed in pim_upstream_del, then trying to
call pim_upstream_timers_stop will lead to accessing freed memory.

Fix:
Stop the timer only if upstream is not deleted.

Co-authored-by: Sarita Patra <saritap@vmware.com>
Co-authored-by: Mobashshera Rasool <mrasool@vmware.com>
Signed-off-by: Mobashshera Rasool <mrasool@vmware.com>

diff --git a/pimd/pim_upstream.c b/pimd/pim_upstream.c
index 3817d5d9e1f9a0e76bb9a046219a15b93bff96a5..54a7f59ca44074d6b75fa7d15bafb8481a846c9f 100644 (file)
--- a/pimd/pim_upstream.c
+++ b/pimd/pim_upstream.c
@@ -1948,8 +1948,8 @@ void pim_upstream_terminate(struct pim_instance *pim)
        struct pim_upstream *up;
 
        while ((up = rb_pim_upstream_first(&pim->upstream_head))) {
-               pim_upstream_del(pim, up, __func__);
-               pim_upstream_timers_stop(up);
+               if (pim_upstream_del(pim, up, __func__))
+                       pim_upstream_timers_stop(up);
        }
 
        rb_pim_upstream_fini(&pim->upstream_head);