From: Ondrej Zajicek Date: Sun, 5 Jun 2022 02:03:43 +0000 (+0200) Subject: Babel: Do not try to remove multicast seqno request objects from neighbour list X-Git-Tag: v2.0.10~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ad686c55c3fad13f39e44ee5732c38296caff782;p=thirdparty%2Fbird.git Babel: Do not try to remove multicast seqno request objects from neighbour list The Babel seqno request code keeps track of which seqno requests are outstanding for a neighbour by putting them onto a per-neighbour list. When reusing a seqno request, it will try to remove this node, but if the seqno request in question was a multicast request with no neighbour attached this will result in a crash because it tries to remove a list node that wasn't added to any list. Fix this by making the list remove conditional. Also fix neighbor removal which were changing seqno requests to multicast ones instead of removing them. Fixes: ebd5751cdeb4 ("Babel: Seqno requests are properly decoupled from neighbors when the underlying interface disappears"). Based on the patch from Toke Høiland-Jørgensen , bug reported by Stefan Haller , thanks. --- diff --git a/proto/babel/babel.c b/proto/babel/babel.c index 4a7d550f5..71452a6f5 100644 --- a/proto/babel/babel.c +++ b/proto/babel/babel.c @@ -312,7 +312,9 @@ babel_add_seqno_request(struct babel_proto *p, struct babel_entry *e, /* Found older */ rem_node(NODE sr); - rem_node(&sr->nbr_node); + + if (sr->nbr) + rem_node(&sr->nbr_node); goto found; } @@ -452,10 +454,7 @@ babel_flush_neighbor(struct babel_proto *p, struct babel_neighbor *nbr) struct babel_seqno_request *sr; WALK_LIST_FIRST2(sr, nbr_node, nbr->requests) - { - sr->nbr = NULL; - rem_node(&sr->nbr_node); - } + babel_remove_seqno_request(p, sr); nbr->ifa = NULL; rem_node(NODE nbr);