proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-03 11:01:48 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

pimd: fix invalid memory access join_timer_stop

Browse Source 
Issue:
==16837== Invalid read of size 8
==16837==    at 0x17971C: pim_neighbor_find (pim_neighbor.c:431)
==16837==    by 0x186439: join_timer_stop (pim_upstream.c:348)
==16837==    by 0x186794: pim_upstream_del (pim_upstream.c:231)
==16837==    by 0x189A66: pim_upstream_terminate (pim_upstream.c:1951)
==16837==    by 0x17111B: pim_instance_terminate (pim_instance.c:54)
==16837==    by 0x17111B: pim_vrf_delete (pim_instance.c:172)
==16837==    by 0x4F1D6C8: vrf_delete (vrf.c:264)
==16837==    by 0x19006F: pim_terminate (pimd.c:160)
==16837==    by 0x1B2E4D: pim_sigterm (pim_signals.c:51)
==16837==    by 0x4F08FA2: frr_sigevent_process (sigevent.c:130)
==16837==    by 0x4F1A2CC: thread_fetch (thread.c:1771)
==16837==    by 0x4ED4F92: frr_run (libfrr.c:1197)
==16837==    by 0x15D81A: main (pim_main.c:176)

Root Cause:
In the pim_terminate flow, the interface is deleted
before the pim_interface clean up. Because of this,
the pim_interface is having garbage value.

Fix:
Release the pim interface memory and then delete the
interface.

Signed-off-by: Sarita Patra <saritap@vmware.com>
This commit is contained in:
Sarita Patra 2022-06-24 03:04:37 -07:00
parent c6c4b5e68f
commit bc26d1bb61
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
pimd/pim_instance.c
View File

@ -238,5 +238,20 @@ void pim_vrf_init(void)
void pim_vrf_terminate(void)
{
struct vrf *vrf;
RB_FOREACH (vrf, vrf_name_head, &vrfs_by_name) {
struct pim_instance *pim;
pim = vrf->info;
if (!pim)
continue;
pim_ssmpingd_destroy(pim);
pim_instance_terminate(pim);
vrf->info = NULL;
}
vrf_terminate();
}