ospf6d: Track wait_timer and disable when needed

When removing ospfv3 from an interface that has been previously
put into wait state, there is a possible use after free of the
oi because the wait_timer could have been started for the interface.
This is because the wait_timer was not tracked by the interface
and we just created a thread for it without storing the thread
pointer.

Issue: #7932
Signed-off-by: Donald Sharp <sharpd@nvidia.com>

diff --git a/ospf6d/ospf6_interface.c b/ospf6d/ospf6_interface.c
index 4988cee7d860b9b194eecd14aca75ac8524d3961..948880a4b59f6f9bb50ea23a71bcabad1e76e0f1 100644 (file)
--- a/ospf6d/ospf6_interface.c
+++ b/ospf6d/ospf6_interface.c
@@ -250,6 +250,7 @@ void ospf6_interface_delete(struct ospf6_interface *oi)
        THREAD_OFF(oi->thread_send_lsupdate);
        THREAD_OFF(oi->thread_send_lsack);
        THREAD_OFF(oi->thread_sso);
+       THREAD_OFF(oi->thread_wait_timer);
 
        ospf6_lsdb_remove_all(oi->lsdb);
        ospf6_lsdb_remove_all(oi->lsupdate_list);
@@ -304,6 +305,7 @@ void ospf6_interface_disable(struct ospf6_interface *oi)
        THREAD_OFF(oi->thread_link_lsa);
        THREAD_OFF(oi->thread_intra_prefix_lsa);
        THREAD_OFF(oi->thread_as_extern_lsa);
+       THREAD_OFF(oi->thread_wait_timer);
 }
 
 static struct in6_addr *
@@ -793,7 +795,7 @@ int interface_up(struct thread *thread)
        else {
                ospf6_interface_state_change(OSPF6_INTERFACE_WAITING, oi);
                thread_add_timer(master, wait_timer, oi, oi->dead_interval,
-                                NULL);
+                                &oi->thread_wait_timer);
        }
 
        return 0;

diff --git a/ospf6d/ospf6_interface.h b/ospf6d/ospf6_interface.h
index dd7f4d1b1ea23d688825cb6bb32ec3f4c589cb17..6e4692920cba9b825bb3c736bcbc9b8444fad7a6 100644 (file)
--- a/ospf6d/ospf6_interface.h
+++ b/ospf6d/ospf6_interface.h
@@ -111,6 +111,7 @@ struct ospf6_interface {
        struct thread *thread_link_lsa;
        struct thread *thread_intra_prefix_lsa;
        struct thread *thread_as_extern_lsa;
+       struct thread *thread_wait_timer;
 
        struct ospf6_route_table *route_connected;