[bgpd] Fix double-free crash in bgp_table_finish, seen with rs-client

2008-07-02 Stephen Hemminger <stephen.hemminger@vyatta.com>

	* bgp_table.{c,h}: (bgp_table_finish) Take a double pointer and
	  scrub pointer in caller, so fixing double-free crashes seen
	  with route-server-client configuration.
	* *.c: Adjust all callers of bgp_table_finish

2008-07-02 Paul Jakma <paul.jakma@sun.com>

	* bgp_table.{c,h}: (bgp_node_delete, bgp_table_free) shouldn't be
	  exported.

diff --git a/bgpd/ChangeLog b/bgpd/ChangeLog
index 2da282132b6cb3f6c754d3749846de80c43d9a28..f486e6488ea4cf28de38312f97f78d7204d42d24 100644 (file)
--- a/bgpd/ChangeLog
+++ b/bgpd/ChangeLog
@@ -1,3 +1,15 @@
+2008-07-02 Stephen Hemminger <stephen.hemminger@vyatta.com>
+
+       * bgp_table.{c,h}: (bgp_table_finish) Take a double pointer and 
+         scrub pointer in caller, so fixing double-free crashes seen
+         with route-server-client configuration.
+       * *.c: Adjust all callers of bgp_table_finish
+
+2008-07-02 Paul Jakma <paul.jakma@sun.com>
+
+       * bgp_table.{c,h}: (bgp_node_delete, bgp_table_free) shouldn't be
+         exported.
+       
 2008-06-07 Paul Jakma <paul@jakma.org>
 
        * bgp_attr.{c,h}: (bgp_mp_{un,}reach_parse) export, for unit tests.

diff --git a/bgpd/bgp_table.c b/bgpd/bgp_table.c
index 810dab54e8b007362ae9289f15b63c444240e7f4..be598328d1a251356c0340d725be5d72a5c9fd75 100644 (file)
--- a/bgpd/bgp_table.c
+++ b/bgpd/bgp_table.c
@@ -28,8 +28,8 @@ Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
 #include "bgpd/bgpd.h"
 #include "bgpd/bgp_table.h"
 
-void bgp_node_delete (struct bgp_node *);
-void bgp_table_free (struct bgp_table *);
+static void bgp_node_delete (struct bgp_node *);
+static void bgp_table_free (struct bgp_table *);
 \f
 struct bgp_table *
 bgp_table_init (afi_t afi, safi_t safi)
@@ -47,9 +47,10 @@ bgp_table_init (afi_t afi, safi_t safi)
 }
 
 void
-bgp_table_finish (struct bgp_table *rt)
+bgp_table_finish (struct bgp_table **rt)
 {
-  bgp_table_free (rt);
+  bgp_table_free (*rt);
+  *rt = NULL;
 }
 
 static struct bgp_node *
@@ -84,7 +85,7 @@ bgp_node_free (struct bgp_node *node)
 }
 
 /* Free route table. */
-void
+static void
 bgp_table_free (struct bgp_table *rt)
 {
   struct bgp_node *tmp_node;
@@ -360,7 +361,7 @@ bgp_node_get (struct bgp_table *table, struct prefix *p)
 }
 
 /* Delete node from the routing table. */
-void
+static void
 bgp_node_delete (struct bgp_node *node)
 {
   struct bgp_node *child;

diff --git a/bgpd/bgp_table.h b/bgpd/bgp_table.h
index 62421e716fd070e5659ab4e2a26d5f9e9d944457..0387c247f11e382ad2a5f83e64f6ea058ad4bdc3 100644 (file)
--- a/bgpd/bgp_table.h
+++ b/bgpd/bgp_table.h
@@ -68,9 +68,8 @@ struct bgp_node
 };
 
 extern struct bgp_table *bgp_table_init (afi_t, safi_t);
-extern void bgp_table_finish (struct bgp_table *);
+extern void bgp_table_finish (struct bgp_table **);
 extern void bgp_unlock_node (struct bgp_node *node);
-extern void bgp_node_delete (struct bgp_node *node);
 extern struct bgp_node *bgp_table_top (struct bgp_table *);
 extern struct bgp_node *bgp_route_next (struct bgp_node *);
 extern struct bgp_node *bgp_route_next_until (struct bgp_node *, struct bgp_node *);

diff --git a/bgpd/bgp_vty.c b/bgpd/bgp_vty.c
index 927e99a14c73d9ad106340f79c2dac20a704a4f6..f1749a7840f15b27c8e1bf8bac86e69c469ea2cb 100644 (file)
--- a/bgpd/bgp_vty.c
+++ b/bgpd/bgp_vty.c
@@ -2153,7 +2153,7 @@ peer_rsclient_unset_vty (struct vty *vty, const char *peer_str,
       listnode_delete (bgp->rsclient, peer);
     }
 
-  bgp_table_finish (peer->rib[bgp_node_afi(vty)][bgp_node_safi(vty)]);
+  bgp_table_finish (&peer->rib[bgp_node_afi(vty)][bgp_node_safi(vty)]);
 
   return CMD_SUCCESS;
 }

diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index 374c4c5281531de5991a0f4a11e104fb206f1be3..4dc6621de5c018995352ae77fbad51ccfaf32ff5 100644 (file)
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -1228,7 +1228,7 @@ peer_delete (struct peer *peer)
   for (afi = AFI_IP; afi < AFI_MAX; afi++)
     for (safi = SAFI_UNICAST; safi < SAFI_MAX; safi++)
       if (peer->rib[afi][safi] && ! peer->af_group[afi][safi])
-        bgp_table_finish (peer->rib[afi][safi]);
+        bgp_table_finish (&peer->rib[afi][safi]);
 
   /* Buffers.  */
   if (peer->ibuf)
@@ -1798,7 +1798,7 @@ peer_group_bind (struct bgp *bgp, union sockunion *su,
           list_delete_node (bgp->rsclient, pn);
         }
 
-      bgp_table_finish (peer->rib[afi][safi]);
+      bgp_table_finish (&peer->rib[afi][safi]);
 
       /* Import policy. */
       if (peer->filter[afi][safi].map[RMAP_IMPORT].name)