From f2f4a37344f03619873144e0e8ce4d773a3e3dcb Mon Sep 17 00:00:00 2001 From: evgeny Date: Mon, 14 Sep 2026 11:29:31 +0300 Subject: [PATCH] =?UTF-8?q?routing:=20fix=20use-after-free=20=D0=B2=20rout?= =?UTF-8?q?e=5Fping=5Fcancel=5Ffor=5Fconn=20(=D1=87=D1=82=D0=B5=D0=BD?= =?UTF-8?q?=D0=B8=D0=B5=20request=5Fid=20=D0=BF=D0=BE=D1=81=D0=BB=D0=B5=20?= =?UTF-8?q?u=5Ffree)=20+=20=D1=84=D0=BE=D1=80=D0=BC=D0=B0=D1=82=20%08x?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/routing_layer/route_ping.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/routing_layer/route_ping.c b/src/routing_layer/route_ping.c index 51fb6207..6310e7fc 100644 --- a/src/routing_layer/route_ping.c +++ b/src/routing_layer/route_ping.c @@ -120,24 +120,24 @@ void route_ping_cancel_for_conn(struct NAT_DETECTION* nd, struct ETCP_CONN* conn struct route_ping_pending* p = *cur; struct nat_check_arg* na = (struct nat_check_arg*)p->arg; - DEBUG_DEBUG(DEBUG_CATEGORY_BGP, " checking pending req_id=%016llx via=%s link->etcp=%s", + DEBUG_DEBUG(DEBUG_CATEGORY_BGP, " checking pending req_id=%08x via=%s link->etcp=%s", (unsigned)p->request_id, p->via_conn ? p->via_conn->log_name : "NULL", (na && na->link && na->link->etcp) ? na->link->etcp->log_name : "NULL"); if ((na && na->link && na->link->etcp == conn) || p->via_conn == conn) { *cur = p->next; + uint32_t rid = p->request_id; if (p->timeout_timer) { uasync_cancel_timeout(nd->inst->ua, p->timeout_timer); p->timeout_timer = NULL; } p->cancelled = 1; - na->link = NULL; + if (na) na->link = NULL; u_free(na); u_free(p); cancelled++; - DEBUG_INFO(DEBUG_CATEGORY_BGP, "cancel_for_conn: cancelled req_id=%016llx", - (unsigned)p->request_id); + DEBUG_INFO(DEBUG_CATEGORY_BGP, "cancel_for_conn: cancelled req_id=%08x", (unsigned)rid); } else { cur = &(*cur)->next; }