bgpd: fix invalid memory access in peer_free()
We shoult not call bgp_unlock() before calling
bgp_delete_connected_nexthop() in the peer_free() function. Otherwise,
if bgp->lock reaches zero, bgp_free() is called and peer->bgp becomes
an invalid pointer in the bgp_delete_connected_nexthop() function.
To fix this, move the call to bgp_unlock() to the end of peer_free().
diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index 56e4322..69ab7da 100644
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -736,8 +736,6 @@
{
assert (peer->status == Deleted);
- bgp_unlock(peer->bgp);
-
/* this /ought/ to have been done already through bgp_stop earlier,
* but just to be sure..
*/
@@ -782,6 +780,9 @@
XFREE(MTYPE_TMP, peer->notify.data);
bgp_sync_delete (peer);
+
+ bgp_unlock(peer->bgp);
+
memset (peer, 0, sizeof (struct peer));
XFREE (MTYPE_BGP_PEER, peer);