aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBenoît Ganne <bganne@cisco.com>2019-10-16 15:08:37 +0200
committerNeale Ranns <nranns@cisco.com>2019-10-16 15:19:46 +0000
commit7391156ce68a81f258d65f498ec6161d694fae47 (patch)
treea42ca65f924e965bc1afee943c204b4076d3d4ac
parent94d2da0b294b0084dd97217e79de18842f09356b (diff)
fib: fix use-after-free for interface adj removal
Type: fix Change-Id: I82308e368d14d84f5970dad229bdcf2de7d1839d Signed-off-by: Benoît Ganne <bganne@cisco.com>
-rw-r--r--src/vnet/adj/adj_nbr.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/src/vnet/adj/adj_nbr.c b/src/vnet/adj/adj_nbr.c
index cbd6691f78f..7f053c82d59 100644
--- a/src/vnet/adj/adj_nbr.c
+++ b/src/vnet/adj/adj_nbr.c
@@ -823,12 +823,15 @@ adj_nbr_interface_delete_one (adj_index_t ai,
};
ip_adjacency_t *adj;
+ adj_lock(ai);
+
adj = adj_get(ai);
adj->ia_flags |= ADJ_FLAG_SYNC_WALK_ACTIVE;
fib_walk_sync(FIB_NODE_TYPE_ADJ, ai, &bw_ctx);
adj->ia_flags &= ~ADJ_FLAG_SYNC_WALK_ACTIVE;
+ adj_unlock(ai);
return (ADJ_WALK_RC_CONTINUE);
}