Merge pull request #16441 from FRRouting/mergify/bp/dev/10.1/pr-16437

bgpd: backpressure - Avoid use after free (backport #16437)
FRRouting · Jul 23, 2024 · 5bc6621 · 5bc6621
2 parents 743eecd + 4c68489
commit 5bc6621
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/bgpd/bgp_evpn.c b/bgpd/bgp_evpn.c
@@ -6338,9 +6338,9 @@ void bgp_evpn_free(struct bgp *bgp, struct bgpevpn *vpn)
 	     dest = dest_next) {
 		dest_next = zebra_announce_next(&bm->zebra_announce_head, dest);
 		if (dest->za_vpn == vpn) {
+			zebra_announce_del(&bm->zebra_announce_head, dest);
 			bgp_path_info_unlock(dest->za_bgp_pi);
 			bgp_dest_unlock_node(dest);
-			zebra_announce_del(&bm->zebra_announce_head, dest);
 		}
 	}
 

diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
@@ -3930,9 +3930,9 @@ int bgp_delete(struct bgp *bgp)
 		dest_next = zebra_announce_next(&bm->zebra_announce_head, dest);
 		dest_table = bgp_dest_table(dest);
 		if (dest_table->bgp == bgp) {
+			zebra_announce_del(&bm->zebra_announce_head, dest);
 			bgp_path_info_unlock(dest->za_bgp_pi);
 			bgp_dest_unlock_node(dest);
-			zebra_announce_del(&bm->zebra_announce_head, dest);
 		}
 	}