Skip to content

Commit

Permalink
zebra: fix ns heap-after-free
Browse files Browse the repository at this point in the history
Fix heap-after-free seen with bgp_vrf_dynamic_route_leak /
test_bgp_vrf_dynamic_route_leak_topo1 topotest.

> =================================================================
> ==1899==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160000acba4 at pc 0x559fe9aee213 bp 0x7fffef3d3ef0 sp 0x7fffef3d3ee8
> READ of size 4 at 0x6160000acba4 thread T0
>     #0 0x559fe9aee212 in ctx_info_from_zns zebra/zebra_dplane.c:3331
>     #1 0x559fe9aee212 in dplane_ctx_ns_init zebra/zebra_dplane.c:3347
>     #2 0x559fe9af50a2 in dplane_ctx_nexthop_init zebra/zebra_dplane.c:3696
>     #3 0x559fe9afadd1 in dplane_nexthop_update_internal zebra/zebra_dplane.c:4503
>     FRRouting#4 0x559fe9afb0ff in dplane_nexthop_delete zebra/zebra_dplane.c:4730
>     FRRouting#5 0x559fe9b6fddf in zebra_nhg_uninstall_kernel zebra/zebra_nhg.c:3278
>     FRRouting#6 0x559fe9b700bf in zebra_nhg_decrement_ref zebra/zebra_nhg.c:1768
>     FRRouting#7 0x559fe9b8a5d3 in route_entry_update_nhe zebra/zebra_rib.c:457
>     FRRouting#8 0x559fe9b932f7 in rib_re_nhg_free zebra/zebra_rib.c:2691
>     FRRouting#9 0x559fe9b932f7 in rib_unlink zebra/zebra_rib.c:4088
>     FRRouting#10 0x559fe9b93485 in zebra_rtable_node_cleanup zebra/zebra_rib.c:958
>     FRRouting#11 0x7fd4040c6672 in route_node_free lib/table.c:75
>     FRRouting#12 0x7fd4040c7378 in route_table_free lib/table.c:111
>     FRRouting#13 0x7fd4040c7378 in route_table_finish lib/table.c:46
>     FRRouting#14 0x559fe9b9cd50 in zebra_router_free_table zebra/zebra_router.c:191
>     FRRouting#15 0x559fe9b9e3fe in zebra_router_terminate zebra/zebra_router.c:244
>     FRRouting#16 0x559fe9aa3c40 in zebra_finalize zebra/main.c:244
>     FRRouting#17 0x7fd4040da2c1 in event_call lib/event.c:1996
>     FRRouting#18 0x7fd40400dcc6 in frr_run lib/libfrr.c:1237
>     FRRouting#19 0x559fe9aa435e in main zebra/main.c:526
>     FRRouting#20 0x7fd403b0c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
>     FRRouting#21 0x7fd403b0c304 in __libc_start_main_impl ../csu/libc-start.c:360
>     FRRouting#22 0x559fe9a777a0 in _start (/usr/lib/frr/zebra+0x1a47a0)
>
> 0x6160000acba4 is located 36 bytes inside of 584-byte region [0x6160000acb80,0x6160000acdc8)
> freed by thread T0 here:
>     #0 0x7fd4044b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
>     #1 0x7fd40402d060 in qfree lib/memory.c:131
>     #2 0x559fe9b73aaa in zebra_ns_delete zebra/zebra_ns.c:74
>     #3 0x559fe9b7415a in zebra_ns_final_shutdown zebra/zebra_ns.c:192
>     FRRouting#4 0x7fd40404d45e in ns_walk_func lib/netns_linux.c:372
>     FRRouting#5 0x559fe9aa3c36 in zebra_finalize zebra/main.c:241
>     FRRouting#6 0x7fd4040da2c1 in event_call lib/event.c:1996
>     FRRouting#7 0x7fd40400dcc6 in frr_run lib/libfrr.c:1237
>     FRRouting#8 0x559fe9aa435e in main zebra/main.c:526
>     FRRouting#9 0x7fd403b0c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
>
> previously allocated by thread T0 here:
>     #0 0x7fd4044b83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
>     #1 0x7fd40402c76d in qcalloc lib/memory.c:106
>     #2 0x559fe9b73b9b in zebra_ns_new zebra/zebra_ns.c:55
>     #3 0x559fe9b74283 in zebra_ns_init zebra/zebra_ns.c:221
>     FRRouting#4 0x559fe9aa4159 in main zebra/main.c:440
>     FRRouting#5 0x7fd403b0c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
  • Loading branch information
louis-6wind committed Sep 25, 2024
1 parent 6eed208 commit 9c05c37
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions zebra/main.c
Original file line number Diff line number Diff line change
Expand Up @@ -237,12 +237,12 @@ void zebra_finalize(struct event *dummy)
ns_walk_func(zebra_ns_early_shutdown, NULL, NULL);
zebra_ns_notify_close();

/* Final shutdown of ns resources */
ns_walk_func(zebra_ns_final_shutdown, NULL, NULL);

zebra_rib_terminate();
zebra_router_terminate();

/* Final shutdown of ns resources */
ns_walk_func(zebra_ns_final_shutdown, NULL, NULL);

zebra_mpls_terminate();

zebra_pw_terminate();
Expand Down

0 comments on commit 9c05c37

Please sign in to comment.