Route sources have an explicit owner

This commit prevents use-after-free of routes belonging to protocols
which have been already destroyed, delaying also all the protocols'
shutdown until all of their routes have been finally propagated through
all the pipes down to the appropriate exports.

The use-after-free was somehow hypothetic yet theoretically possible in
rare conditions, when one BGP protocol authors a lot of routes and the
user deletes that protocol by reconfiguring in the same time as next hop
update is requested, causing rte_better() to be called on a
not-yet-pruned network prefix while the owner protocol has been already
freed.

In parallel execution environments, this would happen an inter-thread
use-after-free, causing possible heisenbugs or other nasty problems.

1 files changed, 19 insertions, 6 deletions

diff --git a/proto/rip/rip.c b/proto/rip/rip.c
index 0a9844f3..ee05f058 100644
--- a/proto/rip/rip.c
+++ b/proto/rip/rip.c
@@ -353,7 +353,7 @@ rip_rt_notify(struct proto *P, struct channel *ch UNUSED, const net_addr *net, s
     en->valid = RIP_ENTRY_VALID;
     en->metric = rt_metric;
     en->tag = rt_tag;
-    en->from = (new->src->proto == P) ? rt_from : NULL;
+    en->from = (new->src->owner == &P->sources) ? rt_from : NULL;
     en->iface = new->attrs->nh.iface;
     en->next_hop = new->attrs->nh.gw;
   }
@@ -1082,11 +1082,20 @@ rip_reload_routes(struct channel *C)
   rip_kick_timer(p);
 }
 
+static struct rte_owner_class rip_rte_owner_class;
+
+static inline struct rip_proto *
+rip_rte_proto(struct rte *rte)
+{
+  return (rte->src->owner->class == &rip_rte_owner_class) ?
+    SKIP_BACK(struct rip_proto, p.sources, rte->src->owner) : NULL;
+}
+
 static int
 rip_rte_better(struct rte *new, struct rte *old)
 {
   ASSERT_DIE(new->src == old->src);
-  struct rip_proto *p = (struct rip_proto *) new->src->proto;
+  struct rip_proto *p = rip_rte_proto(new);
 
   u32 new_metric = ea_get_int(new->attrs->eattrs, EA_RIP_METRIC, p->infinity);
   u32 old_metric = ea_get_int(old->attrs->eattrs, EA_RIP_METRIC, p->infinity);
@@ -1121,8 +1130,7 @@ rip_init(struct proto_config *CF)
   P->rt_notify = rip_rt_notify;
   P->neigh_notify = rip_neigh_notify;
   P->reload_routes = rip_reload_routes;
-  P->rte_better = rip_rte_better;
-  P->rte_igp_metric = rip_rte_igp_metric;
+  P->sources.class = &rip_rte_owner_class;
 
   return P;
 }
@@ -1197,7 +1205,7 @@ rip_reconfigure(struct proto *P, struct proto_config *CF)
 static void
 rip_get_route_info(rte *rte, byte *buf)
 {
-  struct rip_proto *p = (struct rip_proto *) rte->src->proto;
+  struct rip_proto *p = rip_rte_proto(rte);
   u32 rt_metric = ea_get_int(rte->attrs->eattrs, EA_RIP_METRIC, p->infinity);
   u32 rt_tag = ea_get_int(rte->attrs->eattrs, EA_RIP_TAG, 0);
 
@@ -1324,6 +1332,12 @@ rip_dump(struct proto *P)
 }
 
 
+static struct rte_owner_class rip_rte_owner_class = {
+  .get_route_info =	rip_get_route_info,
+  .rte_better =		rip_rte_better,
+  .rte_igp_metric =	rip_rte_igp_metric,
+};
+
 struct protocol proto_rip = {
   .name =		"RIP",
   .template =		"rip%d",
@@ -1338,6 +1352,5 @@ struct protocol proto_rip = {
   .start =		rip_start,
   .shutdown =		rip_shutdown,
   .reconfigure =	rip_reconfigure,
-  .get_route_info =	rip_get_route_info,
   .get_attr =		rip_get_attr
 };