[cmaster-next] [PATCH] zebra: fix segfault on exit when RIB debugging is enabled

Renato Westphal renato at opensourcerouting.org
Thu Dec 8 14:36:03 EST 2016


Fixes the following crash on exit:
(gdb) bt
0  _rnode_zlog (...) at zebra_rib.c:104
1  0x0000000000417726 in rib_unlink (...) at zebra_rib.c:2370
2  0x000000000042db80 in zebra_rtable_node_destroy (...) at zebra_vrf.c:336
3  0x00007ffff7b6ce2e in route_node_free (...) at table.c:81
4  0x00007ffff7b6ced7 in route_table_free (...) at table.c:118
5  0x00007ffff7b6cd88 in route_table_finish (...) at table.c:53
6  0x000000000042defa in zebra_vrf_delete (...) at zebra_vrf.c:278
7  0x00007ffff7b9e044 in vrf_delete (...) at vrf.c:162
8  0x00007ffff7b9e89f in vrf_terminate () at vrf.c:458
9  0x000000000041027c in sigint () at main.c:205
10 0x00007ffff7b953f2 in quagga_sigevent_process () at sigevent.c:111
11 0x00007ffff7b681dd in thread_fetch (...) at thread.c:1297
12 0x000000000040c7ed in main (...) at main.c:471

To fix the problem, free the table->info pointer only after
route_table_finish() is called for the table.

Signed-off-by: Renato Westphal <renato at opensourcerouting.org>
---
 zebra/zebra_vrf.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/zebra/zebra_vrf.c b/zebra/zebra_vrf.c
index bf42792..9297438 100644
--- a/zebra/zebra_vrf.c
+++ b/zebra/zebra_vrf.c
@@ -271,11 +271,14 @@ zebra_vrf_delete (struct vrf *vrf)
   /* release allocated memory */
   for (afi = AFI_IP; afi <= AFI_IP6; afi++)
     {
+      void *table_info;
+
       for (safi = SAFI_UNICAST; safi <= SAFI_MULTICAST; safi++)
 	{
 	  table = zvrf->table[afi][safi];
-	  XFREE (MTYPE_RIB_TABLE_INFO, table->info);
+	  table_info = table->info;
 	  route_table_finish (table);
+	  XFREE (MTYPE_RIB_TABLE_INFO, table_info);
 
 	  table = zvrf->stable[afi][safi];
 	  route_table_finish (table);
@@ -285,8 +288,9 @@ zebra_vrf_delete (struct vrf *vrf)
 	if (zvrf->other_table[afi][table_id])
 	  {
 	    table = zvrf->other_table[afi][table_id];
-	    XFREE (MTYPE_RIB_TABLE_INFO, table->info);
+	    table_info = table->info;
 	    route_table_finish (table);
+	    XFREE (MTYPE_RIB_TABLE_INFO, table_info);
 	  }
 
       route_table_finish (zvrf->rnh_table[afi]);
-- 
1.9.1





More information about the dev mailing list