From: Ondrej Zajicek <santiago@crfreenet.org>
Date: Sat, 22 Nov 2008 00:12:22 +0000 (+0100)
Subject: Fixes race condition leading to memory corruption and crash.
X-Git-Tag: v1.2.0~168
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fbde6c39084637c2f3f4d31261a44dbf367958d1;p=thirdparty%2Fbird.git

Fixes race condition leading to memory corruption and crash.

When protocol started, feeding was scheduled. If protocol
got down before feeding was executed, then function
responsible for connecting protocol to kernel routing
tables was called after the function responsible for
disconnecting, then resource pool of protocol was freed,
but freed linked list structures remains in the list.
---

diff --git a/nest/proto.c b/nest/proto.c
index fb24e5736..6c89f7e01 100644
--- a/nest/proto.c
+++ b/nest/proto.c
@@ -521,9 +521,10 @@ proto_feed_more(void *P)
 {
   struct proto *p = P;
 
-  DBG("Feeding protocol %s continued\n", p->name);
   if (p->core_state != FS_FEEDING)
     return;
+
+  DBG("Feeding protocol %s continued\n", p->name);
   if (rt_feed_baby(p))
     {
       p->core_state = FS_HAPPY;
@@ -542,6 +543,9 @@ proto_feed(void *P)
 {
   struct proto *p = P;
 
+  if (p->core_state != FS_FEEDING)
+    return;
+
   DBG("Feeding protocol %s\n", p->name);
   proto_add_announce_hook(p, p->table);
   if_feed_baby(p);