Skip to content

Commit

Permalink
bgpd: Prevent use after free
Browse files Browse the repository at this point in the history
When bgp_stop finishes and it deletes the peer it is sending
back a return code stating that the peer was deleted, but
the code was operating like it was not deleted and continued
to access the data structure.  Fix.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
  • Loading branch information
donaldsharp committed Aug 25, 2023
1 parent d4a9b10 commit 5160672
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions bgpd/bgp_fsm.c
Original file line number Diff line number Diff line change
Expand Up @@ -2675,7 +2675,6 @@ int bgp_event_update(struct peer *peer, enum bgp_fsm_events event)
bgp_timer_set(peer);
break;
case BGP_FSM_FAILURE:
case BGP_FSM_FAILURE_AND_DELETE:
/*
* If we got a return value of -1, that means there was an
* error, restart the FSM. Since bgp_stop() was called on the
Expand All @@ -2699,7 +2698,9 @@ int bgp_event_update(struct peer *peer, enum bgp_fsm_events event)
bgp_timer_set(peer);
}
fsm_result = FSM_PEER_STOPPED;

break;
case BGP_FSM_FAILURE_AND_DELETE:
fsm_result = FSM_PEER_STOPPED;
break;
}

Expand Down

0 comments on commit 5160672

Please sign in to comment.