summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJosh Bailey <joshb@google.com>2011-07-20 20:51:07 -0700
committerJosh Bailey <joshb@google.com>2011-07-20 20:51:07 -0700
commit78d92e1721538ec41feb2b1c34712675b830087b (patch)
treeb05abed8b5fa33567676bcf0c32b7f56d2660709
parent0b597ef00ec7c7eebd836e2b1d5a266efcd60005 (diff)
bgpd: Fix a crash caused by mistakenly dequeueing the bestpath on the
multipath list. This causes the multipath list to get truncated but the multipath count still reflects what it was before truncation. When we install the route to zebra we fail to fill the nexthop array with the number of nexthop pointers indicated by the multipath count and this leads to a NULL pointer crash in stream_put_in_addr(). Changes: * bgpd/bgp_mpath.c * bgp_info_mpath_update(): If new_mpath is the bestpath we should just move to the next mp_list node. Move dequeue of new_mpath and the code that updates next_mpath to inside the check that new_mpath is not the bestpath.
-rw-r--r--bgpd/bgp_mpath.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/bgpd/bgp_mpath.c b/bgpd/bgp_mpath.c
index 44823c4b..1709c244 100644
--- a/bgpd/bgp_mpath.c
+++ b/bgpd/bgp_mpath.c
@@ -521,12 +521,13 @@ bgp_info_mpath_update (struct bgp_node *rn, struct bgp_info *new_best,
*/
new_mpath = listgetdata (mp_node);
list_delete_node (mp_list, mp_node);
- if (new_mpath == next_mpath)
- next_mpath = bgp_info_mpath_next (new_mpath);
- bgp_info_mpath_dequeue (new_mpath);
if ((mpath_count < maxpaths) && (new_mpath != new_best) &&
bgp_info_nexthop_cmp (prev_mpath, new_mpath))
{
+ if (new_mpath == next_mpath)
+ next_mpath = bgp_info_mpath_next (new_mpath);
+ bgp_info_mpath_dequeue (new_mpath);
+
bgp_info_mpath_enqueue (prev_mpath, new_mpath);
prev_mpath = new_mpath;
mpath_changed = 1;