Comment 0 for bug 1462550

Revision history for this message
Nischal Sheth (nsheth) wrote : BgpSession::WriteReady can access freed memory

BgpSession::WriteReady is called from the io thread. There are
2 problems in current implementation:

1. The peer_ in the BgpSession is not cleared when the BgpPeer
clears it's reference to the BgpSession. As a result, WriteReady
can access freed memory if the peer has been deleted.

2. Even if BgpPeer::clear_session is modified to clear the back
pointer to the peer in the BgpSession, there's a concurrency
problem since BgpSession::WriteReady can be called from the
io thread while the back pointer is being cleared.

Fix is to enqueue the BgpSession to a work queue when it gets
a WriteReady notification and do the actual processing in the
context of bgp::Config task.