From 17f0c194731d3866a0105cd2b059708f389301d3 Mon Sep 17 00:00:00 2001
From: Thomas Haller <thaller@redhat.com>
Date: Fri, 18 Aug 2017 11:30:56 +0200
Subject: [PATCH] platform: fix updating object in
 nmp_cache_update_netlink_route()

_idxcache_update() may remove @entry_old or it may update @entry_old
in-place.

We must assign @out_obj_old before and not touch @entry_old after
_idxcache_update().

Fixes: cdd8c6579919e542fb643a2070bb7ea49faef694
---
 src/platform/nmp-object.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/platform/nmp-object.c b/src/platform/nmp-object.c
index b51172b54b..9d2a2bad5b 100644
--- a/src/platform/nmp-object.c
+++ b/src/platform/nmp-object.c
@@ -813,8 +813,10 @@ nmp_object_cmp (const NMPObject *obj1, const NMPObject *obj2)
 	klass1 = NMP_OBJECT_GET_CLASS (obj1);
 	klass2 = NMP_OBJECT_GET_CLASS (obj2);
 
-	if (klass1 != klass2)
+	if (klass1 != klass2) {
+		nm_assert (klass1->obj_type != klass2->obj_type);
 		return klass1->obj_type < klass2->obj_type ? -1 : 1;
+	}
 
 	if (klass1->cmd_obj_cmp)
 		return klass1->cmd_obj_cmp (obj1, obj2);
@@ -2179,13 +2181,15 @@ nmp_cache_update_netlink_route (NMPCache *cache,
 	entry_old = _lookup_entry (cache, obj_hand_over);
 	entry_new = NULL;
 
+	NM_SET_OUT (out_obj_old, nmp_object_ref (nm_dedup_multi_entry_get_obj (entry_old)));
+
 	if (!entry_old) {
 
 		if (!nmp_object_is_alive (obj_hand_over))
 			goto update_done;
 
 		_idxcache_update (cache,
-		                  entry_old,
+		                  NULL,
 		                  obj_hand_over,
 		                  is_dump,
 		                  &entry_new);
@@ -2215,7 +2219,6 @@ nmp_cache_update_netlink_route (NMPCache *cache,
 	ops_type = NMP_CACHE_OPS_UPDATED;
 
 update_done:
-	NM_SET_OUT (out_obj_old, nmp_object_ref (nm_dedup_multi_entry_get_obj (entry_old)));
 	NM_SET_OUT (out_obj_new, nmp_object_ref (nm_dedup_multi_entry_get_obj (entry_new)));
 
 	/* a RTM_GETROUTE event may signal that another object was replaced.