Commits on Oct 16, 2024

1. zebra: fix heap-use-after free on ns shutdown …

   The following ASAN issue has been observed:
   
   > ERROR: AddressSanitizer: heap-use-after-free on address 0x6160000acba4 at pc 0x55910c5694d0 bp 0x7ffe3a8ac850 sp 0x7ffe3a8ac840
   > READ of size 4 at 0x6160000acba4 thread T0
   >         #0 0x55910c5694cf in ctx_info_from_zns zebra/zebra_dplane.c:3315
   >     #1 0x55910c569696 in dplane_ctx_ns_init zebra/zebra_dplane.c:3331
   >     #2 0x55910c56bf61 in dplane_ctx_nexthop_init zebra/zebra_dplane.c:3680
   >     #3 0x55910c5711ca in dplane_nexthop_update_internal zebra/zebra_dplane.c:4490
   >     #4 0x55910c571c5c in dplane_nexthop_delete zebra/zebra_dplane.c:4717
   >     #5 0x55910c61e90e in zebra_nhg_uninstall_kernel zebra/zebra_nhg.c:3413
   >     #6 0x55910c615d8a in zebra_nhg_decrement_ref zebra/zebra_nhg.c:1919
   >     #7 0x55910c6404db in route_entry_update_nhe zebra/zebra_rib.c:454
   >     #8 0x55910c64c904 in rib_re_nhg_free zebra/zebra_rib.c:2822
   >     #9 0x55910c655be2 in rib_unlink zebra/zebra_rib.c:4212
   >     #10 0x55910c6430f9 in zebra_rtable_node_cleanup zebra/zebra_rib.c:968
   >     #11 0x7f26f275b8a9 in route_node_free lib/table.c:75
   >     #12 0x7f26f275bae4 in route_table_free lib/table.c:111
   >     #13 0x7f26f275b749 in route_table_finish lib/table.c:46
   >     #14 0x55910c65db17 in zebra_router_free_table zebra/zebra_router.c:191
   >     #15 0x55910c65dfb5 in zebra_router_terminate zebra/zebra_router.c:244
   >     #16 0x55910c4f40db in zebra_finalize zebra/main.c:249
   >     #17 0x7f26f2777108 in event_call lib/event.c:2011
   >     #18 0x7f26f264180e in frr_run lib/libfrr.c:1212
   >     #19 0x55910c4f49cb in main zebra/main.c:531
   >     #20 0x7f26f2029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
   >     #21 0x7f26f2029e3f in __libc_start_main_impl ../csu/libc-start.c:392
   >     #22 0x55910c4b0114 in _start (/usr/lib/frr/zebra+0x1ae114)
   
   It happens with FRR using the kernel. During shutdown, the
   namespace identifier is attempted to be obtained by zebra, in an
   attempt to prepare zebra dataplane nexthop messages.
   
   Fix this by accessing the ns structure.
   
   Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
   (cherry picked from commit 7ae70eb)

   

   pguibert6WIND authored and mergify[bot] committed Oct 16, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 0ddb53e
   • Browse repository at this point

   Copy the full SHA

   0ddb53e View commit details

   Browse the repository at this point in the history