[bgpd] Fix double-free crash in bgp_table_finish, seen with rs-client
2008-07-02 Stephen Hemminger <stephen.hemminger@vyatta.com>
* bgp_table.{c,h}: (bgp_table_finish) Take a double pointer and
scrub pointer in caller, so fixing double-free crashes seen
with route-server-client configuration.
* *.c: Adjust all callers of bgp_table_finish
2008-07-02 Paul Jakma <paul.jakma@sun.com>
* bgp_table.{c,h}: (bgp_node_delete, bgp_table_free) shouldn't be
exported.
diff --git a/bgpd/ChangeLog b/bgpd/ChangeLog
index 2da2821..f486e64 100644
--- a/bgpd/ChangeLog
+++ b/bgpd/ChangeLog
@@ -1,3 +1,15 @@
+2008-07-02 Stephen Hemminger <stephen.hemminger@vyatta.com>
+
+ * bgp_table.{c,h}: (bgp_table_finish) Take a double pointer and
+ scrub pointer in caller, so fixing double-free crashes seen
+ with route-server-client configuration.
+ * *.c: Adjust all callers of bgp_table_finish
+
+2008-07-02 Paul Jakma <paul.jakma@sun.com>
+
+ * bgp_table.{c,h}: (bgp_node_delete, bgp_table_free) shouldn't be
+ exported.
+
2008-06-07 Paul Jakma <paul@jakma.org>
* bgp_attr.{c,h}: (bgp_mp_{un,}reach_parse) export, for unit tests.
diff --git a/bgpd/bgp_table.c b/bgpd/bgp_table.c
index 810dab5..be59832 100644
--- a/bgpd/bgp_table.c
+++ b/bgpd/bgp_table.c
@@ -28,8 +28,8 @@
#include "bgpd/bgpd.h"
#include "bgpd/bgp_table.h"
-void bgp_node_delete (struct bgp_node *);
-void bgp_table_free (struct bgp_table *);
+static void bgp_node_delete (struct bgp_node *);
+static void bgp_table_free (struct bgp_table *);
struct bgp_table *
bgp_table_init (afi_t afi, safi_t safi)
@@ -47,9 +47,10 @@
}
void
-bgp_table_finish (struct bgp_table *rt)
+bgp_table_finish (struct bgp_table **rt)
{
- bgp_table_free (rt);
+ bgp_table_free (*rt);
+ *rt = NULL;
}
static struct bgp_node *
@@ -84,7 +85,7 @@
}
/* Free route table. */
-void
+static void
bgp_table_free (struct bgp_table *rt)
{
struct bgp_node *tmp_node;
@@ -360,7 +361,7 @@
}
/* Delete node from the routing table. */
-void
+static void
bgp_node_delete (struct bgp_node *node)
{
struct bgp_node *child;
diff --git a/bgpd/bgp_table.h b/bgpd/bgp_table.h
index 62421e7..0387c24 100644
--- a/bgpd/bgp_table.h
+++ b/bgpd/bgp_table.h
@@ -68,9 +68,8 @@
};
extern struct bgp_table *bgp_table_init (afi_t, safi_t);
-extern void bgp_table_finish (struct bgp_table *);
+extern void bgp_table_finish (struct bgp_table **);
extern void bgp_unlock_node (struct bgp_node *node);
-extern void bgp_node_delete (struct bgp_node *node);
extern struct bgp_node *bgp_table_top (struct bgp_table *);
extern struct bgp_node *bgp_route_next (struct bgp_node *);
extern struct bgp_node *bgp_route_next_until (struct bgp_node *, struct bgp_node *);
diff --git a/bgpd/bgp_vty.c b/bgpd/bgp_vty.c
index 927e99a..f1749a7 100644
--- a/bgpd/bgp_vty.c
+++ b/bgpd/bgp_vty.c
@@ -2153,7 +2153,7 @@
listnode_delete (bgp->rsclient, peer);
}
- bgp_table_finish (peer->rib[bgp_node_afi(vty)][bgp_node_safi(vty)]);
+ bgp_table_finish (&peer->rib[bgp_node_afi(vty)][bgp_node_safi(vty)]);
return CMD_SUCCESS;
}
diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index 374c4c5..4dc6621 100644
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -1228,7 +1228,7 @@
for (afi = AFI_IP; afi < AFI_MAX; afi++)
for (safi = SAFI_UNICAST; safi < SAFI_MAX; safi++)
if (peer->rib[afi][safi] && ! peer->af_group[afi][safi])
- bgp_table_finish (peer->rib[afi][safi]);
+ bgp_table_finish (&peer->rib[afi][safi]);
/* Buffers. */
if (peer->ibuf)
@@ -1798,7 +1798,7 @@
list_delete_node (bgp->rsclient, pn);
}
- bgp_table_finish (peer->rib[afi][safi]);
+ bgp_table_finish (&peer->rib[afi][safi]);
/* Import policy. */
if (peer->filter[afi][safi].map[RMAP_IMPORT].name)