proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-09 05:58:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

zebra: fix use of freed es during zebra shutdown

Browse Source 
This problem was reported by the sanitizer -
=================================================================
==24764==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d0000115c8 at pc 0x55cb9cfad312 bp 0x7fffa0552140 sp 0x7fffa0552138
READ of size 8 at 0x60d0000115c8 thread T0
    #0 0x55cb9cfad311 in zebra_evpn_remote_es_flush zebra/zebra_evpn_mh.c:2041
    #1 0x55cb9cfad311 in zebra_evpn_es_cleanup zebra/zebra_evpn_mh.c:2234
    #2 0x55cb9cf6ae78 in zebra_vrf_disable zebra/zebra_vrf.c:205
    #3 0x7fc8d478f114 in vrf_delete lib/vrf.c:229
    #4 0x7fc8d478f99a in vrf_terminate lib/vrf.c:541
    #5 0x55cb9ceba0af in sigint zebra/main.c:176
    #6 0x55cb9ceba0af in sigint zebra/main.c:130
    #7 0x7fc8d4765d20 in quagga_sigevent_process lib/sigevent.c:103
    #8 0x7fc8d4787e8c in thread_fetch lib/thread.c:1396
    #9 0x7fc8d4708782 in frr_run lib/libfrr.c:1092
    #10 0x55cb9ce931d8 in main zebra/main.c:488
    #11 0x7fc8d43ee09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
    #12 0x55cb9ce94c09 in _start (/usr/lib/frr/zebra+0x8ac09)
=================================================================

Signed-off-by: Anuradha Karuppiah <anuradhak@cumulusnetworks.com>
This commit is contained in:
Anuradha Karuppiah 2020-09-15 16:50:14 -07:00
parent 4d8b658c8c
commit e378f5020d
1 changed files with 32 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
zebra/zebra_evpn_mh.c
View File

@ -60,7 +60,7 @@ DEFINE_MTYPE_STATIC(ZEBRA, ZES_VTEP, "VTEP attached to the ES");
static void zebra_evpn_es_get_one_base_evpn(void); static void zebra_evpn_es_get_one_base_evpn(void);
static int zebra_evpn_es_evi_send_to_client(struct zebra_evpn_es *es, static int zebra_evpn_es_evi_send_to_client(struct zebra_evpn_es *es,
zebra_evpn_t *zevpn, bool add); zebra_evpn_t *zevpn, bool add);
static void zebra_evpn_local_es_del(struct zebra_evpn_es *es); static void zebra_evpn_local_es_del(struct zebra_evpn_es **esp);
static int zebra_evpn_local_es_update(struct zebra_if *zif, uint32_t lid, static int zebra_evpn_local_es_update(struct zebra_if *zif, uint32_t lid,
struct ethaddr *sysmac); struct ethaddr *sysmac);
@ -820,7 +820,7 @@ void zebra_evpn_if_cleanup(struct zebra_if *zif)
/* Delete associated Ethernet Segment */ /* Delete associated Ethernet Segment */
if (zif->es_info.es) if (zif->es_info.es)
zebra_evpn_local_es_del(zif->es_info.es); zebra_evpn_local_es_del(&zif->es_info.es);
} }
/***************************************************************************** /*****************************************************************************
@ -1107,15 +1107,17 @@ static struct zebra_evpn_es *zebra_evpn_es_new(esi_t *esi)
* This just frees appropriate memory, caller should have taken other * This just frees appropriate memory, caller should have taken other
* needed actions. * needed actions.
*/ */
static struct zebra_evpn_es *zebra_evpn_es_free(struct zebra_evpn_es *es) static void zebra_evpn_es_free(struct zebra_evpn_es **esp)
{ {
struct zebra_evpn_es *es = *esp;
/* If the ES has a local or remote reference it cannot be freed. /* If the ES has a local or remote reference it cannot be freed.
* Free is also prevented if there are MAC entries referencing * Free is also prevented if there are MAC entries referencing
* it. * it.
*/ */
if ((es->flags & (ZEBRA_EVPNES_LOCAL | ZEBRA_EVPNES_REMOTE)) || if ((es->flags & (ZEBRA_EVPNES_LOCAL | ZEBRA_EVPNES_REMOTE)) ||
listcount(es->mac_list)) listcount(es->mac_list))
return es; return;
if (IS_ZEBRA_DEBUG_EVPN_MH_ES) if (IS_ZEBRA_DEBUG_EVPN_MH_ES)
zlog_debug("es %s free", es->esi_str); zlog_debug("es %s free", es->esi_str);
@ -1137,7 +1139,7 @@ static struct zebra_evpn_es *zebra_evpn_es_free(struct zebra_evpn_es *es)
XFREE(MTYPE_ZES, es); XFREE(MTYPE_ZES, es);
return NULL; *esp = NULL;
} }
/* Inform BGP about local ES addition */ /* Inform BGP about local ES addition */
@ -1348,9 +1350,10 @@ static void zebra_evpn_es_local_info_set(struct zebra_evpn_es *es,
false /* force_clear_static */); false /* force_clear_static */);
} }
static void zebra_evpn_es_local_info_clear(struct zebra_evpn_es *es) static void zebra_evpn_es_local_info_clear(struct zebra_evpn_es **esp)
{ {
struct zebra_if *zif; struct zebra_if *zif;
struct zebra_evpn_es *es = *esp;
if (!(es->flags & ZEBRA_EVPNES_LOCAL)) if (!(es->flags & ZEBRA_EVPNES_LOCAL))
return; return;
@ -1372,16 +1375,17 @@ static void zebra_evpn_es_local_info_clear(struct zebra_evpn_es *es)
list_delete_node(zmh_info->local_es_list, &es->local_es_listnode); list_delete_node(zmh_info->local_es_list, &es->local_es_listnode);
/* free up the ES if there is no remote reference */ /* free up the ES if there is no remote reference */
zebra_evpn_es_free(es); zebra_evpn_es_free(esp);
} }
/* Delete an ethernet segment and inform BGP */ /* Delete an ethernet segment and inform BGP */
static void zebra_evpn_local_es_del(struct zebra_evpn_es *es) static void zebra_evpn_local_es_del(struct zebra_evpn_es **esp)
{ {
struct zebra_evpn_es_evi *es_evi; struct zebra_evpn_es_evi *es_evi;
struct listnode *node = NULL; struct listnode *node = NULL;
struct listnode *nnode = NULL; struct listnode *nnode = NULL;
struct zebra_if *zif; struct zebra_if *zif;
struct zebra_evpn_es *es = *esp;
if (!CHECK_FLAG(es->flags, ZEBRA_EVPNES_LOCAL)) if (!CHECK_FLAG(es->flags, ZEBRA_EVPNES_LOCAL))
return; return;
@ -1401,12 +1405,14 @@ static void zebra_evpn_local_es_del(struct zebra_evpn_es *es)
if (es->flags & ZEBRA_EVPNES_READY_FOR_BGP) if (es->flags & ZEBRA_EVPNES_READY_FOR_BGP)
zebra_evpn_es_send_del_to_client(es); zebra_evpn_es_send_del_to_client(es);
zebra_evpn_es_local_info_clear(es); zebra_evpn_es_local_info_clear(esp);
} }
/* eval remote info associated with the ES */ /* eval remote info associated with the ES */
static void zebra_evpn_es_remote_info_re_eval(struct zebra_evpn_es *es) static void zebra_evpn_es_remote_info_re_eval(struct zebra_evpn_es **esp)
{ {
struct zebra_evpn_es *es = *esp;
/* if there are remote VTEPs the ES-EVI is classified as "remote" */ /* if there are remote VTEPs the ES-EVI is classified as "remote" */
if (listcount(es->es_vtep_list)) { if (listcount(es->es_vtep_list)) {
if (!(es->flags & ZEBRA_EVPNES_REMOTE)) { if (!(es->flags & ZEBRA_EVPNES_REMOTE)) {
@ -1421,7 +1427,7 @@ static void zebra_evpn_es_remote_info_re_eval(struct zebra_evpn_es *es)
if (IS_ZEBRA_DEBUG_EVPN_MH_ES) if (IS_ZEBRA_DEBUG_EVPN_MH_ES)
zlog_debug("remote es %s del; nhg 0x%x", zlog_debug("remote es %s del; nhg 0x%x",
es->esi_str, es->nhg_id); es->esi_str, es->nhg_id);
zebra_evpn_es_free(es); zebra_evpn_es_free(esp);
} }
} }
} }
@ -1442,7 +1448,7 @@ static int zebra_evpn_local_es_update(struct zebra_if *zif, uint32_t lid,
if (!lid || is_zero_mac(sysmac)) { if (!lid || is_zero_mac(sysmac)) {
/* if in ES is attached to zif delete it */ /* if in ES is attached to zif delete it */
if (old_es) if (old_es)
zebra_evpn_local_es_del(old_es); zebra_evpn_local_es_del(&zif->es_info.es);
return 0; return 0;
} }
@ -1467,7 +1473,7 @@ static int zebra_evpn_local_es_update(struct zebra_if *zif, uint32_t lid,
/* release the old_es against the zif */ /* release the old_es against the zif */
if (old_es) if (old_es)
zebra_evpn_local_es_del(old_es); zebra_evpn_local_es_del(&zif->es_info.es);
es = zebra_evpn_es_find(&esi); es = zebra_evpn_es_find(&esi);
if (es) { if (es) {
@ -1497,23 +1503,23 @@ static int zebra_evpn_remote_es_del(esi_t *esi, struct in_addr vtep_ip)
es = zebra_evpn_es_find(esi); es = zebra_evpn_es_find(esi);
if (!es) { if (!es) {
zlog_warn("remote es %s vtep %pI4 del failed, es missing", zlog_warn("remote es %s vtep %pI4 del failed, es missing",
esi_to_str(esi, buf, sizeof(buf)), esi_to_str(esi, buf, sizeof(buf)), &vtep_ip);
&vtep_ip);
return -1; return -1;
} }
zebra_evpn_es_vtep_del(es, vtep_ip); zebra_evpn_es_vtep_del(es, vtep_ip);
zebra_evpn_es_remote_info_re_eval(es); zebra_evpn_es_remote_info_re_eval(&es);
return 0; return 0;
} }
/* force delete a remote ES on the way down */ /* force delete a remote ES on the way down */
static void zebra_evpn_remote_es_flush(struct zebra_evpn_es *es) static void zebra_evpn_remote_es_flush(struct zebra_evpn_es **esp)
{ {
struct zebra_evpn_es_vtep *es_vtep; struct zebra_evpn_es_vtep *es_vtep;
struct listnode *node; struct listnode *node;
struct listnode *nnode; struct listnode *nnode;
struct zebra_evpn_es *es = *esp;
for (ALL_LIST_ELEMENTS(es->es_vtep_list, node, nnode, es_vtep)) { for (ALL_LIST_ELEMENTS(es->es_vtep_list, node, nnode, es_vtep)) {
if (IS_ZEBRA_DEBUG_EVPN_MH_ES) if (IS_ZEBRA_DEBUG_EVPN_MH_ES)
@ -1521,8 +1527,8 @@ static void zebra_evpn_remote_es_flush(struct zebra_evpn_es *es)
es->esi_str, es->esi_str,
inet_ntoa(es_vtep->vtep_ip)); inet_ntoa(es_vtep->vtep_ip));
zebra_evpn_es_vtep_free(es_vtep); zebra_evpn_es_vtep_free(es_vtep);
zebra_evpn_es_remote_info_re_eval(es);
} }
zebra_evpn_es_remote_info_re_eval(esp);
} }
static int zebra_evpn_remote_es_add(esi_t *esi, struct in_addr vtep_ip) static int zebra_evpn_remote_es_add(esi_t *esi, struct in_addr vtep_ip)
@ -1539,15 +1545,15 @@ static int zebra_evpn_remote_es_add(esi_t *esi, struct in_addr vtep_ip)
if (!es) { if (!es) {
es = zebra_evpn_es_new(esi); es = zebra_evpn_es_new(esi);
if (!es) { if (!es) {
zlog_warn("remote es %s vtep %pI4 add failed, es missing", zlog_warn(
esi_to_str(esi, buf, sizeof(buf)), "remote es %s vtep %pI4 add failed, es missing",
&vtep_ip); esi_to_str(esi, buf, sizeof(buf)), &vtep_ip);
return -1; return -1;
} }
} }
zebra_evpn_es_vtep_add(es, vtep_ip); zebra_evpn_es_vtep_add(es, vtep_ip);
zebra_evpn_es_remote_info_re_eval(es); zebra_evpn_es_remote_info_re_eval(&es);
return 0; return 0;
} }
@ -1587,7 +1593,7 @@ void zebra_evpn_es_mac_deref_entry(zebra_mac_t *mac)
list_delete_node(es->mac_list, &mac->es_listnode); list_delete_node(es->mac_list, &mac->es_listnode);
if (!listcount(es->mac_list)) if (!listcount(es->mac_list))
zebra_evpn_es_free(es); zebra_evpn_es_free(&es);
} }
/* Associate a MAC entry with a local or remote ES. Returns false if there /* Associate a MAC entry with a local or remote ES. Returns false if there
@ -1694,8 +1700,9 @@ void zebra_evpn_es_cleanup(void)
RB_FOREACH_SAFE(es, zebra_es_rb_head, RB_FOREACH_SAFE(es, zebra_es_rb_head,
&zmh_info->es_rb_tree, es_next) { &zmh_info->es_rb_tree, es_next) {
zebra_evpn_local_es_del(es); zebra_evpn_local_es_del(&es);
zebra_evpn_remote_es_flush(es); if (es)
zebra_evpn_remote_es_flush(&es);
} }
} }