Merge pull request #3857 from donaldsharp/dplane_use_after_free_7.0

riw777 · web-flow · commit bf99288b5186 · 2019-02-23T20:10:47.000-05:00
zebra: Fix use after free in rib_process_result
diff --git a/zebra/zebra_rib.c b/zebra/zebra_rib.c
@@ -1860,8 +1860,6 @@ static void rib_process_after(struct zebra_dplane_ctx *ctx)
 		goto done;
 	}
 
-	route_unlock_node(rn);
-
 	srcdest_rnode_prefixes(rn, &dest_pfx, &src_pfx);
 
 	op = dplane_ctx_get_op(ctx);
@@ -2011,6 +2009,9 @@ static void rib_process_after(struct zebra_dplane_ctx *ctx)
 
 done:
 
+	if (rn)
+		route_unlock_node(rn);
+
 	/* Return context to dataplane module */
 	dplane_ctx_fini(&ctx);
 }

Original file line number	Diff line number	Diff line change
`@@ -1860,8 +1860,6 @@ static void rib_process_after(struct zebra_dplane_ctx *ctx)`
`1860`	`1860`	`goto done;`
`1861`	`1861`	`}`
`1862`	`1862`
`1863`		`- route_unlock_node(rn);`
`1864`		`-`
`1865`	`1863`	`srcdest_rnode_prefixes(rn, &dest_pfx, &src_pfx);`
`1866`	`1864`
`1867`	`1865`	`op = dplane_ctx_get_op(ctx);`
`@@ -2011,6 +2009,9 @@ static void rib_process_after(struct zebra_dplane_ctx *ctx)`
`2011`	`2009`
`2012`	`2010`	`done:`
`2013`	`2011`
	`2012`	`+ if (rn)`
	`2013`	`+ route_unlock_node(rn);`
	`2014`	`+`
`2014`	`2015`	`/* Return context to dataplane module */`
`2015`	`2016`	`dplane_ctx_fini(&ctx);`
`2016`	`2017`	`}`