diff options
| author | Josh Bailey <joshb@google.com> | 2011-07-20 20:51:07 -0700 |
|---|---|---|
| committer | Josh Bailey <joshb@google.com> | 2011-07-20 20:51:07 -0700 |
| commit | 78d92e1721538ec41feb2b1c34712675b830087b (patch) | |
| tree | b05abed8b5fa33567676bcf0c32b7f56d2660709 | |
| parent | 0b597ef00ec7c7eebd836e2b1d5a266efcd60005 (diff) | |
bgpd: Fix a crash caused by mistakenly dequeueing the bestpath on the
multipath list. This causes the multipath list to get truncated
but the multipath count still reflects what it was before truncation.
When we install the route to zebra we fail to fill the nexthop
array with the number of nexthop pointers indicated by the
multipath count and this leads to a NULL pointer crash in
stream_put_in_addr().
Changes:
* bgpd/bgp_mpath.c
* bgp_info_mpath_update(): If new_mpath is the bestpath we should
just move to the next mp_list node. Move dequeue of new_mpath and
the code that updates next_mpath to inside the check that
new_mpath is not the bestpath.
| -rw-r--r-- | bgpd/bgp_mpath.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/bgpd/bgp_mpath.c b/bgpd/bgp_mpath.c index 44823c4b..1709c244 100644 --- a/bgpd/bgp_mpath.c +++ b/bgpd/bgp_mpath.c @@ -521,12 +521,13 @@ bgp_info_mpath_update (struct bgp_node *rn, struct bgp_info *new_best, */ new_mpath = listgetdata (mp_node); list_delete_node (mp_list, mp_node); - if (new_mpath == next_mpath) - next_mpath = bgp_info_mpath_next (new_mpath); - bgp_info_mpath_dequeue (new_mpath); if ((mpath_count < maxpaths) && (new_mpath != new_best) && bgp_info_nexthop_cmp (prev_mpath, new_mpath)) { + if (new_mpath == next_mpath) + next_mpath = bgp_info_mpath_next (new_mpath); + bgp_info_mpath_dequeue (new_mpath); + bgp_info_mpath_enqueue (prev_mpath, new_mpath); prev_mpath = new_mpath; mpath_changed = 1; |