From d39ef961d1dde230c55fcc931b53f44cb34a1e63 Mon Sep 17 00:00:00 2001
From: Maria Matejka <mq@ucw.cz>
Date: Tue, 5 Apr 2022 15:09:56 +0200
Subject: BGP uses lp_save / lp_restore instead of linpool flushing

It is too cryptic to flush tmp_linpool in these cases and we don't want
anybody in the future to break this code by adding an allocation
somewhere which should persist over that flush.

Saving and restoring linpool state is safer.
---
 proto/bgp/packets.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 7e978919..a805cdf0 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -2323,6 +2323,9 @@ bgp_create_update(struct bgp_channel *c, byte *buf)
 
 again: ;
 
+  struct lp_state tmpp;
+  lp_save(tmp_linpool, &tmpp);
+
   /* Initialize write state */
   struct bgp_write_state s = {
     .proto = p,
@@ -2353,6 +2356,7 @@ again: ;
     if (EMPTY_LIST(buck->prefixes))
     {
       bgp_free_bucket(c, buck);
+      lp_restore(tmp_linpool, &tmpp);
       goto again;
     }
 
@@ -2366,7 +2370,10 @@ again: ;
       bgp_defer_bucket(c, buck);
 
     if (!res)
+    {
+      lp_restore(tmp_linpool, &tmpp);
       goto again;
+    }
 
     goto done;
   }
@@ -2377,7 +2384,7 @@ again: ;
 done:
   BGP_TRACE_RL(&rl_snd_update, D_PACKETS, "Sending UPDATE");
   p->stats.tx_updates++;
-  lp_flush(s.pool);
+  lp_restore(tmp_linpool, &tmpp);
 
   return res;
 }
@@ -2506,6 +2513,9 @@ bgp_rx_update(struct bgp_conn *conn, byte *pkt, uint len)
 
   bgp_start_timer(conn->hold_timer, conn->hold_time);
 
+  struct lp_state tmpp;
+  lp_save(tmp_linpool, &tmpp);
+
   /* Initialize parse state */
   struct bgp_parse_state s = {
     .proto = p,
@@ -2587,7 +2597,7 @@ bgp_rx_update(struct bgp_conn *conn, byte *pkt, uint len)
 
 done:
   rta_free(s.cached_rta);
-  lp_flush(s.pool);
+  lp_restore(tmp_linpool, &tmpp);
   return;
 }
 
-- 
cgit v1.2.3