Commit Graph

34453 Commits

Author SHA1 Message Date
David Lamparter
a13d2933b7 zebra, lib: remove notify field from hello message
This is no longer used.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-23 15:20:11 +01:00
David Lamparter
25a1dccc56 lib: remove .receive_notify zclient option
This should just be set with `ZEBRA_ROUTE_NOTIFY_REQUEST` instead.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-23 15:05:10 +01:00
David Lamparter
7f7564bbb2 eigrpd: use default zclient options
`.receive_notify = false` is the default.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-23 15:01:54 +01:00
David Lamparter
f1a15bd2a4 staticd: replace receive_notify with request
Send `ZEBRA_ROUTE_NOTIFY_REQUEST` rather than relying on the options
field in zclient startup.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-23 14:59:09 +01:00
David Lamparter
adf7b9efd3 sharpd: replace receive_notify with request
Send `ZEBRA_ROUTE_NOTIFY_REQUEST` rather than relying on the options
field in zclient startup.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-23 14:57:58 +01:00
David Lamparter
500a09d2dc pbrd: replace receive_notify with request
Send `ZEBRA_ROUTE_NOTIFY_REQUEST` rather than relying on the options
field in zclient startup.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-23 14:57:36 +01:00
Donatas Abraitis
27be058232
Merge pull request #14858 from idryzhov/mgmtd-error-msg
mgmtd: fix reply when running ds is not locked
2023-11-23 08:09:45 +02:00
David Lamparter
6e7465c54e lib: remove distribute_{in,out} from interface
Both of these fields are just straight up completely unused.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-22 23:00:30 +01:00
David Lamparter
8b23c0b0bd *: convert struct interface->connected to DLIST
Replace `struct list *` with `DLIST(if_connected, ...)`.

NB: while converting this, I found multiple places using connected
prefixes assuming they were IPv4 without checking:

- vrrpd/vrrp.c: vrrp_socket()
- zebra/irdp_interface.c: irdp_get_prefix(), irdp_if_start(),
  irdp_advert_off()

(these fixes are really hard to split off into separate commits as that
would require going back and reapplying the change but with the old list
handling)

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2023-11-22 23:00:30 +01:00
Mark Stapp
d1e11d48d4
Merge pull request #14862 from louis-6wind/fix-ctx-iptable
zebra: fix dplane_ctx_iptable use-after-free
2023-11-22 15:47:47 -05:00
Louis Scalbert
45140bb9e1 zebra: fix dplane_ctx_iptable use-after-free
Fix a crash because a use-after-free.

> =================================================================
> ==1249835==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000074210 at pc 0x7fa1b42a652c bp 0x7ffc477a2aa0 sp 0x7ffc477a2a98
> READ of size 8 at 0x604000074210 thread T0
>     #0 0x7fa1b42a652b in list_delete_all_node git/frr/lib/linklist.c:299:20
>     #1 0x7fa1b42a683f in list_delete git/frr/lib/linklist.c:312:2
>     #2 0x5ee515 in dplane_ctx_free_internal git/frr/zebra/zebra_dplane.c:858:4
>     #3 0x5ee59c in dplane_ctx_free git/frr/zebra/zebra_dplane.c:884:2
>     #4 0x5ee544 in dplane_ctx_fini git/frr/zebra/zebra_dplane.c:905:2
>     #5 0x7045c0 in rib_process_dplane_results git/frr/zebra/zebra_rib.c:4928:4
>     #6 0x7fa1b4434fb2 in event_call git/frr/lib/event.c:1970:2
>     #7 0x7fa1b42a0ccf in frr_run git/frr/lib/libfrr.c:1213:3
>     #8 0x556808 in main git/frr/zebra/main.c:488:2
>     #9 0x7fa1b3d0bd09 in __libc_start_main csu/../csu/libc-start.c:308:16
>     #10 0x4453e9 in _start (/usr/lib/frr/zebra+0x4453e9)
>
> 0x604000074210 is located 0 bytes inside of 40-byte region [0x604000074210,0x604000074238)
> freed by thread T0 here:
>     #0 0x4bf1dd in free (/usr/lib/frr/zebra+0x4bf1dd)
>     #1 0x7fa1b42df0c0 in qfree git/frr/lib/memory.c:130:2
>     #2 0x7fa1b42a68ce in list_free_internal git/frr/lib/linklist.c:24:2
>     #3 0x7fa1b42a6870 in list_delete git/frr/lib/linklist.c:313:2
>     #4 0x5ee515 in dplane_ctx_free_internal git/frr/zebra/zebra_dplane.c:858:4
>     #5 0x5ee59c in dplane_ctx_free git/frr/zebra/zebra_dplane.c:884:2
>     #6 0x5ee544 in dplane_ctx_fini git/frr/zebra/zebra_dplane.c:905:2
>     #7 0x7045c0 in rib_process_dplane_results git/frr/zebra/zebra_rib.c:4928:4
>     #8 0x7fa1b4434fb2 in event_call git/frr/lib/event.c:1970:2
>     #9 0x7fa1b42a0ccf in frr_run git/frr/lib/libfrr.c:1213:3
>     #10 0x556808 in main git/frr/zebra/main.c:488:2
>     #11 0x7fa1b3d0bd09 in __libc_start_main csu/../csu/libc-start.c:308:16
>
> previously allocated by thread T0 here:
>     #0 0x4bf5d2 in calloc (/usr/lib/frr/zebra+0x4bf5d2)
>     #1 0x7fa1b42dee18 in qcalloc git/frr/lib/memory.c:105:27
>     #2 0x7fa1b42a3784 in list_new git/frr/lib/linklist.c:18:9
>     #3 0x6d165f in pbr_iptable_alloc_intern git/frr/zebra/zebra_pbr.c:1015:29
>     #4 0x7fa1b426ad1f in hash_get git/frr/lib/hash.c:147:13
>     #5 0x6d15f2 in zebra_pbr_add_iptable git/frr/zebra/zebra_pbr.c:1030:13
>     #6 0x5db2a3 in zread_iptable git/frr/zebra/zapi_msg.c:3759:3
>     #7 0x5e365d in zserv_handle_commands git/frr/zebra/zapi_msg.c:4039:3
>     #8 0x7e09fc in zserv_process_messages git/frr/zebra/zserv.c:520:3
>     #9 0x7fa1b4434fb2 in event_call git/frr/lib/event.c:1970:2
>     #10 0x7fa1b42a0ccf in frr_run git/frr/lib/libfrr.c:1213:3
>     #11 0x556808 in main git/frr/zebra/main.c:488:2
>     #12 0x7fa1b3d0bd09 in __libc_start_main csu/../csu/libc-start.c:308:16

Fixes: 1cc380679e ("zebra: Actually free all memory associated ctx->u.iptable.interface_name_list")
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
2023-11-22 18:32:24 +01:00
Donatas Abraitis
af22ff0bd5
Merge pull request #14830 from fdumontet6WIND/snmpv2
tests: bgp_snmp_bgp4v2mib fix some random failure
2023-11-22 14:45:15 +02:00
Christian Hopps
79b7b8df1f
Merge pull request #14815 from idryzhov/lib-mgmt-deps
Remove lib dependency on mgmtd
2023-11-22 10:51:40 +01:00
Francois Dumontet
a5bee822f4 tests: bgp_snmp_bgp4v2mib fix some random failure
avoid to consider additionnal traps randomly received later

Signed-off-by: Francois Dumontet <francois.dumontet@6wind.com>
2023-11-22 07:24:00 +00:00
Donatas Abraitis
b84476e0bb
Merge pull request #14850 from donaldsharp/IFNAMSIZ_GET_YOUR_SHIT_TOGETHER
*: Let's use the native IFNAMSIZ instead of INTERFACE_NAMSIZ
2023-11-22 09:13:58 +02:00
Donatas Abraitis
9d8e384d12 lib: Print debug config in files after we have prefix-lists
Without this if we enter something like `debug bgp updates in x.x.x.x prefix-list y`,
prefix-list can't be lookup up, because when we read the config, debug does not know
anything about this prefix-list.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-11-22 08:20:01 +02:00
Donatas Abraitis
22f6b2bafe bgpd: Optimize prefix-list lookup for debug messages
Pass prefix-list pointers at configuration time.

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-11-22 08:06:33 +02:00
Donatas Abraitis
c0215ed188 bgpd: Add an ability to filter UPDATEs using neighbor with prefix-list
Before this patch we didn't have an option to filter debug UPDATE messages
by specifying an arbitrary prefix, prefix-list or so. We had/have only an option
to specify:

```
* debug bgp updates in 10.0.0.1
* debug bgp updates prefix 10.0.1.0/24
```

Now adding:

```
* debug bgp updates <in|out> 10.0.0.1 prefix-list plist
```

CLI output:

```
r2# show debugging
MGMT debugging status:

Zebra debugging status:

BGP debugging status:
  BGP updates debugging is on (inbound) for 192.168.2.6 with prefix-list debug

Staticd debugging status

r2# show running-config | include prefix-list debug
debug bgp updates in 192.168.2.6 prefix-list debug
r2#
```

Logs:

```
BGP: [PCFFM-WMARW] 192.168.2.3(r3) rcvd UPDATE wlen 0 attrlen 28 alen 5
BGP: [PCFFM-WMARW] 192.168.2.3(r3) rcvd UPDATE wlen 0 attrlen 28 alen 4
BGP: [PCFFM-WMARW] 192.168.2.3(r3) rcvd UPDATE wlen 0 attrlen 0 alen 0
BGP: [M59KS-A3ZXZ] bgp_update_receive: rcvd End-of-RIB for IPv4 Unicast from 192.168.2.3 in vrf default
BGP: [PCFFM-WMARW] 192.168.2.4(r4) rcvd UPDATE wlen 0 attrlen 28 alen 5
BGP: [PCFFM-WMARW] 192.168.2.4(r4) rcvd UPDATE wlen 0 attrlen 28 alen 4
BGP: [PCFFM-WMARW] 192.168.2.4(r4) rcvd UPDATE wlen 0 attrlen 0 alen 0
BGP: [M59KS-A3ZXZ] bgp_update_receive: rcvd End-of-RIB for IPv4 Unicast from 192.168.2.4 in vrf default
BGP: [PCFFM-WMARW] 192.168.1.1(r1) rcvd UPDATE wlen 0 attrlen 29 alen 5
BGP: [PCFFM-WMARW] 192.168.2.6(r6) rcvd UPDATE wlen 0 attrlen 28 alen 5
BGP: [XXWBM-V772F] 192.168.2.6(r6) rcvd UPDATE w/ attr: nexthop 192.168.2.6, origin ?, metric 0, path 65006
BGP: [YCKEM-GB33T] 192.168.2.6(r6) rcvd 172.16.16.254/32 IPv4 unicast <<<<<<<<<<<<
BGP: [PCFFM-WMARW] 192.168.2.6(r6) rcvd UPDATE wlen 0 attrlen 28 alen 4
BGP: [PCFFM-WMARW] 192.168.2.6(r6) rcvd UPDATE wlen 0 attrlen 0 alen 0
BGP: [M59KS-A3ZXZ] bgp_update_receive: rcvd End-of-RIB for IPv4 Unicast from 192.168.2.6 in vrf default
BGP: [PCFFM-WMARW] 192.168.2.5(r5) rcvd UPDATE wlen 0 attrlen 28 alen 5
BGP: [PCFFM-WMARW] 192.168.2.5(r5) rcvd UPDATE wlen 0 attrlen 28 alen 4
BGP: [PCFFM-WMARW] 192.168.2.5(r5) rcvd UPDATE wlen 0 attrlen 0 alen 0
BGP: [M59KS-A3ZXZ] bgp_update_receive: rcvd End-of-RIB for IPv4 Unicast from 192.168.2.5 in vrf default
BGP: [PCFFM-WMARW] 192.168.1.1(r1) rcvd UPDATE wlen 0 attrlen 29 alen 5
BGP: [PCFFM-WMARW] 192.168.7.7(r7) rcvd UPDATE wlen 0 attrlen 0 alen 0
BGP: [M59KS-A3ZXZ] bgp_update_receive: rcvd End-of-RIB for IPv4 Unicast from 192.168.7.7 in vrf default
```

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-11-22 08:06:33 +02:00
Donatas Abraitis
1315b7a7b4 doc: Add debug bgp updates <in|out> NEIGHBOR route-map RMAP cmd
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-11-22 08:06:33 +02:00
Igor Ryzhov
354b3c4328 mgmtd: fix reply when running ds is not locked
At this stage, we should send a SET_CFG reply, not COMMIT_CFG reply.
Commit request is not yet initialized.

Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
2023-11-21 23:18:40 +02:00
Donald Sharp
71f7ecb571 zebra: Cleanup zrouter.stale_client_list on shutdown
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:41:18 -05:00
Donald Sharp
cbf96217a9 zebra: Cleanup hash's on zebra shutdown
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:41:18 -05:00
Donald Sharp
a7628b1b2d zebra: Cleanup svd_nh_table on shutdown
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:41:18 -05:00
Donald Sharp
30c0efd68c zebra: Unregister mpls hooks on zebra shutdown
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:41:18 -05:00
Donald Sharp
82463eb1a9 zebra: On shutdown, ensure dg_update_list is emptied
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:41:18 -05:00
Donald Sharp
a1c1b9d9c5 zebra: On shutdown, ensure ctx's in rib_dplane_q are freed
a) Rename rib_init to zebra_rib_init() to better follow how
things are named

b) on shutdown cycle through the rib_dplane_q and free
up any contexts sitting in it.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:41:18 -05:00
Donald Sharp
7bf3c2fb19 bgpd: On shutdown do not create a workqueue for the self peer
When bgp is shutting down, it calls bgp_fsm_change_status
on everything including a self peer, which goes through
and cleans the tables of the self peer data structures
as if it's a real peer.  Add a bit of code to just
not do the work at all.  This allows unlocks to flow
a bit further and for the self peer to be deleted
on shutdown.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:41:18 -05:00
Donald Sharp
0b81a7524d bgpd: MTYPE_BGP was being overused split up
The MTYPE_BGP memory type was being over used as
both the handler for the bgp instance itself as
well as memory associated with name strings.
Let's separate out the two.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:41:18 -05:00
Donald Sharp
318a8c98b4 zebra: Cleanup dplane provider owned ctx's on shutdown
On shutdown go through and ensure that any contexts the
dplane provider holds are freed.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:41:18 -05:00
Donald Sharp
88a54b123d *: Cleanup keychain on shutdown
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:41:18 -05:00
Donald Sharp
a3dfb08662 bfdd: Free zclient memory on shutdown
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:41:18 -05:00
Donald Sharp
65b65f47c8 zebra: On shutdown, cleanup dplane providers
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:39:07 -05:00
Donald Sharp
d3adb8a8f6 zebra: On shutdown cleanup zns memory.
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 12:39:07 -05:00
Philippe Guibert
fc1177fe20 bgpd, topotests: apply route-map after rt vpn export
A route-map can be programmed to remove the route-target which
has been set with 'rt vpn export' command, but fails to remove
it.

Fix this by applying the route-map, then considering the resulting
extended community-list.
Add some tests to catch this issue.

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
2023-11-21 18:10:38 +01:00
Philippe Guibert
3dd3b7f6fc doc: explain rt list exportation with route-maps
Explain that an export route target list can be configured
alternatively by using route-maps.

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
2023-11-21 18:10:38 +01:00
Philippe Guibert
309e692d10 topotests: bgp_vpnv4_ebgp, check 'extcommunity rt' presence
Add a test to check that the presence of a route-map at
exportation with a 'set extcommunity rt' is enough to allow
the prefix to be exported.

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
2023-11-21 18:10:38 +01:00
Philippe Guibert
b43ea569d9 bgpd: fix bgp node created at withdraw event
The prefixes unexportation triggers an attempt to create
the VPN prefix node if that prefix was not already present.

For instance, if a given prefix is not exported because of
a route-map filtering, the withdraw process will try to
create the node with the 'bgp_afi_node_get()' command.

Fix this by replacing this call by the 'bgp_safi_node_lookup()'
function.

Fixes: ddb5b4880b ("bgpd: vpn-vrf route leaking")
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
2023-11-21 18:10:38 +01:00
Philippe Guibert
e746985295 bgpd: fix export prefixes when rt extcomm set by route-map
When exporting BGP prefixes, it is necessary to configure
the route target extended communities with the following
command:

> rt vpn export <RouteTarget>

But the customer may need to configure the route-target to
apply to bgp updates, solely based on a route-map criterium.
by using the below route-map configured like that:

> route-map vpn export <routemapname>

Fix this by allowing to export bgp updates based on the
presence of route-targets on either route-map or vpn
configured rt. the exportation process is stopped
if no route target is available in the ecommunity list.

Fixes: ddb5b4880b ("bgpd: vpn-vrf route leaking")
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
2023-11-21 18:10:38 +01:00
Philippe Guibert
7243e9daa4 bgpd: fix wrong event called when removing a set rule
The following route-map set rules events are destroyed with
the 'match_destroy' API whereas there is a 'set_destroy' API
available.
Fix this for the following set commands:
> set distance
> set extcommunity rt
> set extcommunity nt
> set extcommunity color
> set extcommunity soo

Fixes: 48cb7ea99d ("bgpd: North-bound implementation for bgp rmaps")
Fixes: c9a2561444 ("bgpd: Implement Node Target Extended Communities")
Fixes: b80ebc2d8c ("bgpd: add colored extended communities support")

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
2023-11-21 18:10:38 +01:00
Philippe Guibert
d6d2527448 pathd: fix 'no msd' command not possible under pcc node
It should be possible to reset the configured msd value,
and not mentioning the previous msd value.

> ubuntu2204(config-sr-te-pcep-pcc)# no msd
> % Command incomplete: no msd
> ubuntu2204(config-sr-te-pcep-pcc)#

Fix this by defining the msd parameter optional, and
separating the 'no msd' command from the 'msd' command.

Fixe: efba0985fc ("pathd: Add optional support for PCEP to pathd")

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
2023-11-21 18:02:10 +01:00
Philippe Guibert
4730aeb5e5 pathd: fix space before pcep port in running-config
The below running-configuration has extra spaces before the pce
port configuration:

> segment-routing
>  traffic-engineering
>   pce test
>    address ip 192.0.2.2   port 1234
>

Fix this by keeping only one space.

>    address ip 192.0.2.2 port 1234

Fixes: efba0985fc ("pathd: Add optional support for PCEP to pathd")
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
2023-11-21 18:02:10 +01:00
Donald Sharp
01af05fbd5
Merge pull request #14834 from opensourcerouting/zclient-nexthop-update
*: move common NHT update decoding bits into lib/
2023-11-21 10:56:47 -05:00
Donald Sharp
b41f7b1b8e
Merge pull request #14845 from opensourcerouting/fix/bgp_conditional_double_free
bgpd: Prevent USE case for conditional advertisements with `set` actions
2023-11-21 10:48:33 -05:00
Russ White
86fb83c68b
Merge pull request #14757 from ryndia/aspath_fix
bgpd:aspath leak fix
2023-11-21 10:39:59 -05:00
Donald Sharp
07b91ca096 *: Let's use the native IFNAMSIZ instead of INTERFACE_NAMSIZ
INTERFACE_NAMSIZ is just a redefine of IFNAMSIZ and IFNAMSIZ
is the standard for interface name length on all platforms
that FRR currently compiles on.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2023-11-21 08:08:29 -05:00
Igor Ryzhov
d532771eaa mgmtd, staticd: output staticd configuration from mgmtd
As mgmtd now implements vty for staticd, it's logical to output the
configuration from there as well. Fully-converted backend daemons should
not handle vty commands at all.

Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
2023-11-21 13:28:40 +02:00
Igor Ryzhov
a22f5a5289 mgmtd: add node for writing configuration
Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
2023-11-21 13:13:05 +02:00
Igor Ryzhov
0d2e1985a8 lib: load nb callbacks even with ignore_cbs set
Don't skip NB callbacks loading when ignore_cbs is set for a YANG
module. It allows us to use cli_show, cli_show_end and cli_cmp callbacks
in mgmtd and output configuration directly from it instead of backend
daemons.

Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
2023-11-21 13:13:05 +02:00
Donatas Abraitis
77ff93b8f5
Merge pull request #14710 from teletajp/fix_show_ospf_gr_helper_cmd
ospfd:fix show_ip_ospf_gr_helper
2023-11-21 11:39:31 +02:00
Donatas Abraitis
d410587bab bgpd: Flush attrs only if we don't have to announce a conditional route
To avoid USE:

```
==587645==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000074050 at pc 0x55b34337d96c bp 0x7ffda59bb4c0 sp 0x7ffda59bb4b0
READ of size 8 at 0x604000074050 thread T0
    0 0x55b34337d96b in bgp_attr_flush bgpd/bgp_attr.c:1289
    1 0x55b34368ef85 in bgp_conditional_adv_routes bgpd/bgp_conditional_adv.c:111
    2 0x55b34368ff58 in bgp_conditional_adv_timer bgpd/bgp_conditional_adv.c:301
    3 0x7f7d41cdf81c in event_call lib/event.c:1980
    4 0x7f7d41c1da37 in frr_run lib/libfrr.c:1214
    5 0x55b343371e22 in main bgpd/bgp_main.c:510
    6 0x7f7d41517082 in __libc_start_main ../csu/libc-start.c:308
    7 0x55b3433769fd in _start (/usr/lib/frr/bgpd+0x2e29fd)

0x604000074050 is located 0 bytes inside of 40-byte region [0x604000074050,0x604000074078)
freed by thread T0 here:
    #0 0x7f7d4207540f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
    1 0x55b343396afd in community_free bgpd/bgp_community.c:41
    2 0x55b343396afd in community_free bgpd/bgp_community.c:28
    3 0x55b343397373 in community_intern bgpd/bgp_community.c:458
    4 0x55b34337bed4 in bgp_attr_intern bgpd/bgp_attr.c:967
    5 0x55b34368165b in bgp_advertise_attr_intern bgpd/bgp_advertise.c:106
    6 0x55b3435277d7 in bgp_adj_out_set_subgroup bgpd/bgp_updgrp_adv.c:587
    7 0x55b34368f36b in bgp_conditional_adv_routes bgpd/bgp_conditional_adv.c:125
    8 0x55b34368ff58 in bgp_conditional_adv_timer bgpd/bgp_conditional_adv.c:301
    9 0x7f7d41cdf81c in event_call lib/event.c:1980
    10 0x7f7d41c1da37 in frr_run lib/libfrr.c:1214
    11 0x55b343371e22 in main bgpd/bgp_main.c:510
    12 0x7f7d41517082 in __libc_start_main ../csu/libc-start.c:308

previously allocated by thread T0 here:
    #0 0x7f7d42075a06 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:153
    1 0x7f7d41c3c28e in qcalloc lib/memory.c:105
    2 0x55b3433976e8 in community_dup bgpd/bgp_community.c:514
    3 0x55b34350273a in route_set_community bgpd/bgp_routemap.c:2589
    4 0x7f7d41c96c06 in route_map_apply_ext lib/routemap.c:2690
    5 0x55b34368f2d8 in bgp_conditional_adv_routes bgpd/bgp_conditional_adv.c:107
    6 0x55b34368ff58 in bgp_conditional_adv_timer bgpd/bgp_conditional_adv.c:301
    7 0x7f7d41cdf81c in event_call lib/event.c:1980
    8 0x7f7d41c1da37 in frr_run lib/libfrr.c:1214
    9 0x55b343371e22 in main bgpd/bgp_main.c:510
    10 0x7f7d41517082 in __libc_start_main ../csu/libc-start.c:308
```

And also a crash:

```
(gdb) bt
0  raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
1  0x00007ff3b7048ce0 in core_handler (signo=6, siginfo=0x7ffc8cf724b0, context=<optimized out>)
    at lib/sigevent.c:246
2  <signal handler called>
3  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
4  0x00007ff3b6bb8859 in __GI_abort () at abort.c:79
5  0x00007ff3b6c2326e in __libc_message (action=action@entry=do_abort,
    fmt=fmt@entry=0x7ff3b6d4d298 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
6  0x00007ff3b6c2b2fc in malloc_printerr (
    str=str@entry=0x7ff3b6d4f628 "double free or corruption (fasttop)") at malloc.c:5347
7  0x00007ff3b6c2cc65 in _int_free (av=0x7ff3b6d82b80 <main_arena>, p=0x555c8fa70a10, have_lock=0)
    at malloc.c:4266
8  0x0000555c8da94bd3 in community_free (com=0x7ffc8cf72e70) at bgpd/bgp_community.c:41
9  community_free (com=com@entry=0x7ffc8cf72e70) at bgpd/bgp_community.c:28
10 0x0000555c8da8afc1 in bgp_attr_flush (attr=attr@entry=0x7ffc8cf73040) at bgpd/bgp_attr.c:1290
11 0x0000555c8dbc0760 in bgp_conditional_adv_routes (peer=peer@entry=0x555c8fa627c0,
    afi=afi@entry=AFI_IP, safi=SAFI_UNICAST, table=table@entry=0x555c8fa510b0, rmap=0x555c8fa71cb0,
    update_type=UPDATE_TYPE_ADVERTISE) at bgpd/bgp_conditional_adv.c:111
12 0x0000555c8dbc0b75 in bgp_conditional_adv_timer (t=<optimized out>)
    at bgpd/bgp_conditional_adv.c:301
13 0x00007ff3b705b84c in event_call (thread=thread@entry=0x7ffc8cf73440) at lib/event.c:1980
14 0x00007ff3b700bf98 in frr_run (master=0x555c8f27c090) at lib/libfrr.c:1214
15 0x0000555c8da85f05 in main (argc=<optimized out>, argv=0x7ffc8cf736a8) at bgpd/bgp_main.c:510
```

Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
2023-11-21 10:49:36 +02:00