diff options
| author | Donald Sharp <sharpd@cumulusnetworks.com> | 2020-04-18 03:18:53 +0200 |
|---|---|---|
| committer | Donald Sharp <sharpd@cumulusnetworks.com> | 2020-04-18 14:35:06 +0200 |
| commit | 744ba5696921114b552a05cd848a4f7da5b449b6 (patch) | |
| tree | d5e176b7e7d5c6861778505b84c141e4a9702c84 /ospf6d/ospf6_lsa.c | |
| parent | isisd: Prevent use after free for isis_adj_state_change (diff) | |
| download | frr-744ba5696921114b552a05cd848a4f7da5b449b6.tar.xz frr-744ba5696921114b552a05cd848a4f7da5b449b6.zip | |
ospf6d: Prevent use after free
ospf6_lsa_unlock may free the lsa data structure as such
we cannot use the passed in data structure after freeing it.
Provide a mechanism to know if the data has been freed
using the same usage patterns of other _unlock functions
in FRR.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Diffstat (limited to 'ospf6d/ospf6_lsa.c')
| -rw-r--r-- | ospf6d/ospf6_lsa.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/ospf6d/ospf6_lsa.c b/ospf6d/ospf6_lsa.c index bcfd97587..aa32fae6a 100644 --- a/ospf6d/ospf6_lsa.c +++ b/ospf6d/ospf6_lsa.c @@ -608,16 +608,17 @@ void ospf6_lsa_lock(struct ospf6_lsa *lsa) } /* decrement reference counter of struct ospf6_lsa */ -void ospf6_lsa_unlock(struct ospf6_lsa *lsa) +struct ospf6_lsa *ospf6_lsa_unlock(struct ospf6_lsa *lsa) { /* decrement reference counter */ assert(lsa->lock > 0); lsa->lock--; if (lsa->lock != 0) - return; + return lsa; ospf6_lsa_delete(lsa); + return NULL; } |