From: claudio <claudio@openbsd.org>
Date: Mon, 6 Aug 2018 08:13:31 +0000 (+0000)
Subject: Pass the stale timestamp to path_remove_stale() removes a asp->peer dereference
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=6229769b6e72f782c08ac1910b9654829f0056e8;p=openbsd

Pass the stale timestamp to path_remove_stale() removes a asp->peer dereference
---

diff --git a/usr.sbin/bgpd/rde.c b/usr.sbin/bgpd/rde.c
index f548b11a9f4..9f32fee5dfc 100644
--- a/usr.sbin/bgpd/rde.c
+++ b/usr.sbin/bgpd/rde.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde.c,v 1.409 2018/08/06 08:10:12 claudio Exp $ */
+/*	$OpenBSD: rde.c,v 1.410 2018/08/06 08:13:31 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -3273,7 +3273,7 @@ peer_flush(struct rde_peer *peer, u_int8_t aid)
 	/* walk through per peer RIB list and remove all stale prefixes. */
 	for (asp = TAILQ_FIRST(&peer->path_h); asp != NULL; asp = nasp) {
 		nasp = TAILQ_NEXT(asp, peer_l);
-		rprefixes += path_remove_stale(asp, aid);
+		rprefixes += path_remove_stale(asp, aid, peer->staletime[aid]);
 	}
 
 	/* Deletions are performed in path_remove() */
diff --git a/usr.sbin/bgpd/rde.h b/usr.sbin/bgpd/rde.h
index 551beb07b25..7fcf39daec6 100644
--- a/usr.sbin/bgpd/rde.h
+++ b/usr.sbin/bgpd/rde.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde.h,v 1.183 2018/08/03 16:31:22 claudio Exp $ */
+/*	$OpenBSD: rde.h,v 1.184 2018/08/06 08:13:31 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Claudio Jeker <claudio@openbsd.org> and
@@ -474,7 +474,7 @@ int		 path_update(struct rib *, struct rde_peer *,
 		     struct filterstate *, struct bgpd_addr *, int, int);
 int		 path_compare(struct rde_aspath *, struct rde_aspath *);
 void		 path_remove(struct rde_aspath *);
-u_int32_t	 path_remove_stale(struct rde_aspath *, u_int8_t);
+u_int32_t	 path_remove_stale(struct rde_aspath *, u_int8_t, time_t);
 void		 path_destroy(struct rde_aspath *);
 int		 path_empty(struct rde_aspath *);
 struct rde_aspath *path_copy(struct rde_aspath *, const struct rde_aspath *);
diff --git a/usr.sbin/bgpd/rde_rib.c b/usr.sbin/bgpd/rde_rib.c
index 1efcd0fd5bb..5b973ae2abc 100644
--- a/usr.sbin/bgpd/rde_rib.c
+++ b/usr.sbin/bgpd/rde_rib.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde_rib.c,v 1.173 2018/08/03 16:31:22 claudio Exp $ */
+/*	$OpenBSD: rde_rib.c,v 1.174 2018/08/06 08:13:31 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Claudio Jeker <claudio@openbsd.org>
@@ -590,15 +590,13 @@ path_remove(struct rde_aspath *asp)
 /* remove all stale routes or if staletime is 0 remove all routes for
    a specified AID. */
 u_int32_t
-path_remove_stale(struct rde_aspath *asp, u_int8_t aid)
+path_remove_stale(struct rde_aspath *asp, u_int8_t aid, time_t staletime)
 {
 	struct prefix	*p, *np;
-	time_t		 staletime;
 	u_int32_t	 rprefixes;
 	int		 has_updates;
 
 	rprefixes=0;
-	staletime = asp->peer->staletime[aid];
 	/*
 	 * Same magic as in path_remove() but probably not needed here.
 	 * This is called when a session flapped and during that time