proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-05 18:16:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

bfdd: Prevent use after free ( again )

Browse Source 
Valgrind is still reporting:

466020-==466020==    by 0x11B9F4: main (bfdd.c:403)
466020-==466020==  Address 0x5a7d544 is 84 bytes inside a block of size 272 free'd
466020:==466020==    at 0x48399AB: free (vg_replace_malloc.c:538)
466020-==466020==    by 0x490A947: qfree (memory.c:140)
466020-==466020==    by 0x48F2AE8: if_delete (if.c:322)
466020-==466020==    by 0x48F250D: if_destroy_via_zapi (if.c:195)
466020-==466020==    by 0x497071E: zclient_interface_delete (zclient.c:2040)
466020-==466020==    by 0x49745F6: zclient_read (zclient.c:3687)
466020-==466020==    by 0x4955AEC: thread_call (thread.c:1684)
466020-==466020==    by 0x48FF64E: frr_run (libfrr.c:1126)
466020-==466020==    by 0x11B9F4: main (bfdd.c:403)
466020-==466020==  Block was alloc'd at
466020:==466020==    at 0x483AB65: calloc (vg_replace_malloc.c:760)
466020-==466020==    by 0x490A805: qcalloc (memory.c:115)
466020-==466020==    by 0x48F23D6: if_new (if.c:160)
466020-==466020==    by 0x48F257F: if_create_name (if.c:214)
466020-==466020==    by 0x48F3493: if_get_by_name (if.c:558)
466020-==466020==    by 0x49705F2: zclient_interface_add (zclient.c:1989)
466020-==466020==    by 0x49745E0: zclient_read (zclient.c:3684)
466020-==466020==    by 0x4955AEC: thread_call (thread.c:1684)
466020-==466020==    by 0x48FF64E: frr_run (libfrr.c:1126)
466020-==466020==    by 0x11B9F4: main (bfdd.c:403)

Apparently the bs->ifp pointer is being set even in cases when
the bs->key.ifname is not being set.  So go through and just
match the interface pointer and cut-to-the-chase.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
This commit is contained in:
Donald Sharp 2021-02-07 15:03:51 -05:00
parent 37a74717c7
commit 14b3514806
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bfdd/ptm_adapter.c
View File

@ -703,8 +703,10 @@ static void bfdd_sessions_disable_interface(struct interface *ifp)
TAILQ_FOREACH(bso, &bglobal.bg_obslist, bso_entry) {
bs = bso->bso_bs;
if (strcmp(ifp->name, bs->key.ifname))
if (bs->ifp != ifp)
continue;
/* Skip disabled sessions. */
if (bs->sock == -1) {
bs->ifp = NULL;