bgpd: Fix use-after-free for ORF case

[ton31337]

No description provided.

[greptile-apps]

Greptile Summary

This PR fixes a use-after-free bug in bgp_packet.c where updgrp_peer->orf_plist[afi][safi] could retain a stale pointer to freed memory when the ORF prefix-list entry is removed.

• The old code only copied peer->orf_plist[afi][safi] into updgrp_peer->orf_plist[afi][safi] when the former was non-NULL, meaning a removal/free that set peer->orf_plist to NULL was never propagated to the update-group peer, leaving a dangling pointer.
• The fix removes the conditional guard and unconditionally syncs the pointer (including NULL), ensuring the update-group peer always reflects the current (possibly cleared) prefix-list state.

Confidence Score: 5/5

This is a minimal, targeted bug fix with no regressions — assigning NULL to updgrp_peer->orf_plist when the peer's ORF prefix list is cleared is safe and correct.

The change is a one-conditional removal that closes a clear memory-safety hole: previously, clearing peer->orf_plist after a free was never reflected in updgrp_peer->orf_plist, leaving it pointing at freed memory. The fix unconditionally synchronises the two pointers (including when the value is NULL), which is harmless in the non-ORF path and necessary in the ORF-removal path.

No files require special attention.

Important Files Changed

Filename	Overview
bgpd/bgp_packet.c	Removed the if (peer->orf_plist[afi][safi]) guard so that the NULL state is always propagated to updgrp_peer->orf_plist, eliminating the use-after-free when the ORF prefix list is cleared.

Sequence Diagram

sequenceDiagram
    participant Peer
    participant bgp_route_refresh_receive
    participant peer_orf_plist as peer->orf_plist[afi][safi]
    participant updgrp_peer_orf as updgrp_peer->orf_plist[afi][safi]

    Peer->>bgp_route_refresh_receive: ROUTE-REFRESH with ORF Remove-All
    bgp_route_refresh_receive->>peer_orf_plist: prefix_bgp_orf_remove_all() set to NULL
    Note over peer_orf_plist: pointer is now NULL (memory freed)

    Note over bgp_route_refresh_receive: OLD CODE (bug): only syncs when non-NULL
    bgp_route_refresh_receive--xupdgrp_peer_orf: skipped — updgrp_peer retains freed pointer (UAF!)

    Note over bgp_route_refresh_receive: NEW CODE (fix): always syncs
    bgp_route_refresh_receive->>updgrp_peer_orf: "updgrp_peer->orf_plist = NULL (safe)"

Loading

_{Reviews (1): Last reviewed commit: "bgpd: Fix use-after-free for ORF case" | Re-trigger Greptile}

[ton31337]

@Mergifyio backport stable/10.6 stable/10.5 stable/10.4 stable/10.3 stable/10.2

[mergify]

backport stable/10.6 stable/10.5 stable/10.4 stable/10.3 stable/10.2

✅ Backports have been created

Details

• #22087 bgpd: Fix use-after-free for ORF case (backport #22080) has been created for branch stable/10.6
• #22088 bgpd: Fix use-after-free for ORF case (backport #22080) has been created for branch stable/10.5
• #22089 bgpd: Fix use-after-free for ORF case (backport #22080) has been created for branch stable/10.4
• #22090 bgpd: Fix use-after-free for ORF case (backport #22080) has been created for branch stable/10.3
• #22091 bgpd: Fix use-after-free for ORF case (backport #22080) has been created for branch stable/10.2