pimd: Fix crash when up->channel_oil is NULL

[usrivastava-nvidia]

The up->channel_oil is being de-referenced
without any NULL check.
In events like VRF migration, where the timer fires in some cases when the up->channel_oil is already deleted it could lead to intermittent crash.

[greptile-apps]

Greptile Summary

This PR adds NULL checks for up->channel_oil in five timer-driven code paths in pimd/pim_dm.c and pimd/pim_upstream.c to prevent a crash when the oil entry is freed (e.g. during VRF migration) before a pending timer fires.

• pimd/pim_dm.c: Guards pim_dm_prune_iff_on_timer so that channel_oil->installed is only accessed when channel_oil is non-NULL before calling oil_if_set and pim_upstream_mroute_update.
• pimd/pim_upstream.c: Applies the same NULL guard pattern to on_graft_timer, on_staterefresh_timer, on_prune_timer, pim_upstream_sg_running_proc, and pim_upstream_sg_running, all of which previously dereferenced channel_oil unconditionally.

Confidence Score: 5/5

Safe to merge — the change is a targeted defensive fix that prevents NULL dereference crashes without altering any control flow when channel_oil is present.

All six changed call sites follow the same straightforward pattern: a simple short-circuit guard is added before an unconditional pointer dereference. The guards are consistent with how similar NULL checks appear elsewhere in the codebase, and no logic is changed for the non-NULL path.

No files require special attention. Both changed files are small, focused, and the pattern is uniform across all touch points.

Important Files Changed

Filename	Overview
pimd/pim_dm.c	Adds NULL guard for channel_oil in pim_dm_prune_iff_on_timer before accessing ->installed and calling downstream mroute functions.
pimd/pim_upstream.c	Adds NULL guards for channel_oil in timer/callback functions (on_graft_timer, on_staterefresh_timer, on_prune_timer, pim_upstream_sg_running_proc, pim_upstream_sg_running) to prevent crash when channel_oil is freed during VRF migration.

Sequence Diagram

sequenceDiagram
    participant Timer as Timer Event
    participant Handler as Timer Handler
    participant Oil as channel_oil
    participant MRoute as MRoute Subsystem

    Note over Oil: VRF migration frees channel_oil
    Timer->>Handler: fires (up still alive)
    Handler->>Handler: "up = EVENT_ARG(t)"
    Handler->>Handler: check !up → OK
    Handler->>Oil: "(BEFORE fix) up->channel_oil->installed → CRASH"
    Handler->>Oil: "(AFTER fix) up->channel_oil != NULL?"
    alt channel_oil is NULL
        Handler->>Handler: return early (no crash)
    else channel_oil exists and installed
        Handler->>MRoute: pim_mroute_update_counters / oil_if_set
    end

Loading

_{Reviews (1): Last reviewed commit: "pimd: Fix crash when up->channel_oil is ..." | Re-trigger Greptile}

[Jafaral]

@Mergifyio backport stable/10.6 stable/10.5 stable/10.4

[mergify]

backport stable/10.6 stable/10.5 stable/10.4

✅ Backports have been created

Details

• #21963 pimd: Fix crash when up->channel_oil is NULL (backport #21961) has been created for branch stable/10.6
• #21964 pimd: Fix crash when up->channel_oil is NULL (backport #21961) has been created for branch stable/10.5
• #21965 pimd: Fix crash when up->channel_oil is NULL (backport #21961) has been created for branch stable/10.4