proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-04-29 02:37:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ospf6d: crash in ospf6_decrement_retrans_count.

Browse Source 
Problem:
ospf6d crash is observed when lsack is received from the neighbour for
AS External LSA.

RCA:
The crash is observed in ospf6_decrement_retrans_count while decrementing
retransmit counter for the LSA when lsack is recived. This is because in
ospf6_flood_interace when new LSA is being added to the neighbour's list
the incrementing is happening on the received LSA instead of the already
present LSA in scope DB which is already carrying counters.

when this new LSA replaces the old one, the already present counters are
not copied on the new LSA this creates counter mismatch which results in
a crash when lsack is recevied due to counter going to negative.

Fix:
The fix involves following changes.
   1. In ospf6_flood_interace when LSA is being added to retrans list
      check if there is alreday lsa in the scoped db and increment
      the counter on that if present.
   2. In ospf6_lsdb_add copy the retrans counter from old to new lsa
      when its being replaced.

Signed-off-by: Manoj Naragund <mnaragund@vmware.com>
This commit is contained in:
Manoj Naragund 2022-03-17 16:58:02 +05:30
parent 30ba0aaa7f
commit 7c20ee06d3
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
ospf6d/ospf6_flood.c
View File

@ -464,11 +464,28 @@ void ospf6_flood_interface(struct ospf6_neighbor *from, struct ospf6_lsa *lsa,
lsa->header->type, lsa->header->id,
lsa->header->adv_router, on->retrans_list);
if (!old) {
struct ospf6_lsa *orig;
struct ospf6_lsdb *lsdb;
if (is_debug)
zlog_debug(
"Increment %s from retrans_list of %s",
lsa->name, on->name);
ospf6_increment_retrans_count(lsa);
/* Increment the retrans count on the original
* copy of LSA if present, to maintain the
* counter consistency.
*/
lsdb = ospf6_get_scoped_lsdb(lsa);
orig = ospf6_lsdb_lookup(
lsa->header->type, lsa->header->id,
lsa->header->adv_router, lsdb);
if (orig)
ospf6_increment_retrans_count(orig);
else
ospf6_increment_retrans_count(lsa);
ospf6_lsdb_add(ospf6_lsa_copy(lsa),
on->retrans_list);
thread_add_timer(

2
ospf6d/ospf6_lsdb.c
View File

@ -132,6 +132,8 @@ void ospf6_lsdb_add(struct ospf6_lsa *lsa, struct ospf6_lsdb *lsdb)
(*lsdb->hook_add)(lsa);
}
} else {
lsa->retrans_count = old->retrans_count;
if (OSPF6_LSA_IS_CHANGED(old, lsa)) {
if (OSPF6_LSA_IS_MAXAGE(lsa)) {
if (lsdb->hook_remove) {