summaryrefslogtreecommitdiff
path: root/filter
diff options
context:
space:
mode:
authorMaria Matejka <mq@ucw.cz>2021-09-27 16:40:28 +0200
committerMaria Matejka <mq@ucw.cz>2021-11-22 19:05:44 +0100
commitf0507f05ce57398e135651896dace4cb68eeed54 (patch)
tree44bfd6148689af15f4f5469b2f37bca55c3e7327 /filter
parent3b20722a1fc777c27ab2e0451d0ea3fee7fa81a2 (diff)
Route sources have an explicit owner
This commit prevents use-after-free of routes belonging to protocols which have been already destroyed, delaying also all the protocols' shutdown until all of their routes have been finally propagated through all the pipes down to the appropriate exports. The use-after-free was somehow hypothetic yet theoretically possible in rare conditions, when one BGP protocol authors a lot of routes and the user deletes that protocol by reconfiguring in the same time as next hop update is requested, causing rte_better() to be called on a not-yet-pruned network prefix while the owner protocol has been already freed. In parallel execution environments, this would happen an inter-thread use-after-free, causing possible heisenbugs or other nasty problems.
Diffstat (limited to 'filter')
-rw-r--r--filter/f-inst.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/filter/f-inst.c b/filter/f-inst.c
index 00e22383..706eb684 100644
--- a/filter/f-inst.c
+++ b/filter/f-inst.c
@@ -526,7 +526,7 @@
case SA_FROM: RESULT(sa.f_type, ip, rta->from); break;
case SA_GW: RESULT(sa.f_type, ip, rta->nh.gw); break;
case SA_NET: RESULT(sa.f_type, net, fs->rte->net); break;
- case SA_PROTO: RESULT(sa.f_type, s, fs->rte->src->proto->name); break;
+ case SA_PROTO: RESULT(sa.f_type, s, fs->rte->src->owner->name); break;
case SA_SOURCE: RESULT(sa.f_type, i, rta->source); break;
case SA_SCOPE: RESULT(sa.f_type, i, rta->scope); break;
case SA_DEST: RESULT(sa.f_type, i, rta->dest); break;
@@ -562,7 +562,8 @@
{
ip_addr ip = v1.val.ip;
struct iface *ifa = ipa_is_link_local(ip) ? rta->nh.iface : NULL;
- neighbor *n = neigh_find(fs->rte->src->proto, ip, ifa, 0);
+ /* XXX this code supposes that every owner is a protocol XXX */
+ neighbor *n = neigh_find(SKIP_BACK(struct proto, sources, fs->rte->src->owner), ip, ifa, 0);
if (!n || (n->scope == SCOPE_HOST))
runtime( "Invalid gw address" );