proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-02 20:27:14 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

pimd: crash fix when RP is removed

Browse Source 
pimd crash at pim_msg_build_jp_groups (
grp=grp@entry=0x7ffca55b5d1e, sgs=sgs@entry=0x17821a0, size=20)
 at pimd/pim_msg.c:198

Fix for https://github.com/FRRouting/frr/issues/6849

Root Cause:
===========
pimd has crashed because pim_upstream_rpf_clear function sets the
up->rpf.source_nexthop.interface pointer to NULL and has not removed
the upstream source node from the neighbor. When the upstream gets
deleted the source is not removed from neighbor
neigh->upstream_jp_agg->groups->sources list. This source node has
pointer to upstream freed memory. Hence when on_neighbor_jp_timer expires,
it tries to access the upstream pointer and crashed.

Fix:
====
Before setting the interface pointer to NULL, remove the node from
neigh->upstream_jp_agg->groups->sources list. Also the upstream state
has to be changed to Not joined.

Removed extra line changes.

Signed-off-by: Mobashshera Rasool <mrasool@vmware.com>
This commit is contained in:
Mobashshera Rasool 2020-08-04 06:24:29 +00:00
parent de5f29dabd
commit 4b67fe2df3
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
pimd/pim_rpf.c
View File

@ -346,6 +346,7 @@ void pim_upstream_rpf_clear(struct pim_instance *pim,
struct pim_upstream *up)
{
if (up->rpf.source_nexthop.interface) {
pim_upstream_switch(pim, up, PIM_UPSTREAM_NOTJOINED);
up->rpf.source_nexthop.interface = NULL;
up->rpf.source_nexthop.mrib_nexthop_addr.u.prefix4.s_addr =
PIM_NET_INADDR_ANY;