Skip to content

Commit a8e238a

Browse files
authored
[vnetorch] [vxlanorch] fix a set of memory usage issues (#2352)
* [vnetorch] fix use-after-free in removeBfdSession() * using a copy of monitor ip instead of a reference since the reference gets invalidated after the endpoint is erased Signed-off-by: Yakiv Huryk <yhuryk@nvidia.com>
1 parent 1aaccd6 commit a8e238a

File tree

2 files changed

+4
-2
lines changed

2 files changed

+4
-2
lines changed

orchagent/vnetorch.cpp

+2-1
Original file line numberDiff line numberDiff line change
@@ -1602,7 +1602,8 @@ void VNetRouteOrch::delEndpointMonitor(const string& vnet, NextHopGroupKey& next
16021602
if (nexthop_info_[vnet].find(ip) != nexthop_info_[vnet].end()) {
16031603
if (--nexthop_info_[vnet][ip].ref_count == 0)
16041604
{
1605-
removeBfdSession(vnet, nhk, nexthop_info_[vnet][ip].monitor_addr);
1605+
IpAddress monitor_addr = nexthop_info_[vnet][ip].monitor_addr;
1606+
removeBfdSession(vnet, nhk, monitor_addr);
16061607
}
16071608
}
16081609
}

orchagent/vxlanorch.cpp

+2-1
Original file line numberDiff line numberDiff line change
@@ -1110,13 +1110,14 @@ void VxlanTunnel::updateRemoteEndPointIpRef(const std::string remote_vtep, bool
11101110
it->second.ip_refcnt++;
11111111
}
11121112
SWSS_LOG_DEBUG("Incrementing remote end point %s reference to %d", remote_vtep.c_str(),
1113-
it->second.ip_refcnt);
1113+
tnl_users_[remote_vtep].ip_refcnt);
11141114
}
11151115
else
11161116
{
11171117
if (it == tnl_users_.end())
11181118
{
11191119
SWSS_LOG_ERROR("Cannot decrement ref. End point not referenced %s", remote_vtep.c_str());
1120+
return;
11201121
}
11211122
it->second.ip_refcnt--;
11221123

0 commit comments

Comments
 (0)