Go to file
Philippe Guibert 2b22d1875b zebra: fix heap-use-after free on ns shutdown
The following ASAN issue has been observed:

> ERROR: AddressSanitizer: heap-use-after-free on address 0x6160000acba4 at pc 0x55910c5694d0 bp 0x7ffe3a8ac850 sp 0x7ffe3a8ac840
> READ of size 4 at 0x6160000acba4 thread T0
>         #0 0x55910c5694cf in ctx_info_from_zns zebra/zebra_dplane.c:3315
>     #1 0x55910c569696 in dplane_ctx_ns_init zebra/zebra_dplane.c:3331
>     #2 0x55910c56bf61 in dplane_ctx_nexthop_init zebra/zebra_dplane.c:3680
>     #3 0x55910c5711ca in dplane_nexthop_update_internal zebra/zebra_dplane.c:4490
>     #4 0x55910c571c5c in dplane_nexthop_delete zebra/zebra_dplane.c:4717
>     #5 0x55910c61e90e in zebra_nhg_uninstall_kernel zebra/zebra_nhg.c:3413
>     #6 0x55910c615d8a in zebra_nhg_decrement_ref zebra/zebra_nhg.c:1919
>     #7 0x55910c6404db in route_entry_update_nhe zebra/zebra_rib.c:454
>     #8 0x55910c64c904 in rib_re_nhg_free zebra/zebra_rib.c:2822
>     #9 0x55910c655be2 in rib_unlink zebra/zebra_rib.c:4212
>     #10 0x55910c6430f9 in zebra_rtable_node_cleanup zebra/zebra_rib.c:968
>     #11 0x7f26f275b8a9 in route_node_free lib/table.c:75
>     #12 0x7f26f275bae4 in route_table_free lib/table.c:111
>     #13 0x7f26f275b749 in route_table_finish lib/table.c:46
>     #14 0x55910c65db17 in zebra_router_free_table zebra/zebra_router.c:191
>     #15 0x55910c65dfb5 in zebra_router_terminate zebra/zebra_router.c:244
>     #16 0x55910c4f40db in zebra_finalize zebra/main.c:249
>     #17 0x7f26f2777108 in event_call lib/event.c:2011
>     #18 0x7f26f264180e in frr_run lib/libfrr.c:1212
>     #19 0x55910c4f49cb in main zebra/main.c:531
>     #20 0x7f26f2029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
>     #21 0x7f26f2029e3f in __libc_start_main_impl ../csu/libc-start.c:392
>     #22 0x55910c4b0114 in _start (/usr/lib/frr/zebra+0x1ae114)

It happens with FRR using the kernel. During shutdown, the
namespace identifier is attempted to be obtained by zebra, in an
attempt to prepare zebra dataplane nexthop messages.

Fix this by accessing the ns structure.

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
(cherry picked from commit 7ae70eb5ef)
2024-10-16 13:16:15 +00:00
.github github: Mark the build as failed if 'do not merge' label is set 2023-12-22 10:29:52 +02:00
alpine docker: Set ABUILD_APK_INDEX_OPTS for frr build 2024-09-12 09:52:23 +03:00
babeld babeld: Do not remove route when replacing 2024-09-23 11:41:40 +00:00
bfdd bfdd: add no variants to interval configurations 2024-10-02 12:41:32 +00:00
bgpd bgpd: fix route selection with AIGP 2024-10-15 14:25:09 +00:00
debian FRR Release 10.0.2 2024-09-12 10:30:00 +03:00
doc bgpd: Actually make --v6-with-v4-nexthops it work 2024-10-02 15:09:25 +00:00
docker docker: Set ABUILD_APK_INDEX_OPTS for libyang 2024-09-12 09:52:22 +03:00
eigrpd *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
fpm *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
gdb lib: add simplified native msg support 2023-12-26 08:34:56 -05:00
grpc *: manual SPDX License ID conversions 2023-02-09 14:09:07 +01:00
include lib: Drop include/linux/mroute[6].h 2024-03-12 20:34:30 +00:00
isisd isisd: fix wrong check for MT commands 2024-10-08 05:11:18 +00:00
ldpd ldpd: fix wrong gtsm count 2024-07-02 17:50:23 +00:00
lib bgpd: Move some non BGP-specific route-map functions to lib 2024-10-11 11:17:09 +00:00
m4 build: add recursion limit for AX_RECURSIVE_EVAL 2024-01-27 19:01:19 +01:00
mgmtd mgmtd: don't add implicit state data when reading config from file 2024-08-10 08:11:52 +00:00
mlag build: fix AM_LDFLAGS usage (and gcov) 2021-07-21 17:10:08 +02:00
nhrpd Merge pull request #16719 from FRRouting/mergify/bp/stable/10.0/pr-16699 2024-10-03 09:33:41 +03:00
ospf6d ospf6d: OSPFv3 route change comparision fixed for ASBR-only change 2024-06-02 15:22:21 +00:00
ospfclient *: Convert event.h to frrevent.h 2023-03-24 08:32:17 -04:00
ospfd ospfd: Fix heap corruption vulnerability when parsing SR-Algorithm TLV 2024-09-18 23:56:53 +00:00
pathd *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
pbrd *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
pceplib Merge pull request #15215 from donaldsharp/pceplib_fixup 2024-01-25 09:59:59 +02:00
pimd pimd: Fix crash in pimd 2024-08-24 08:13:31 +00:00
pkgsrc build: homologize path handling 2024-01-27 19:02:52 +01:00
python build: remove mgmtd exception from xref2vtysh 2024-01-28 23:28:40 +02:00
qpb qpb: Add missing #include nexthop.h 2024-02-10 00:44:50 +01:00
redhat FRR Release 10.0.2 2024-09-12 10:30:00 +03:00
ripd ripd: fix show run output for distribute-list 2024-08-08 18:29:25 +00:00
ripngd ripngd: fix "clear ipv6 ripng" command 2024-03-09 10:16:38 +00:00
sharpd *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
snapcraft debian, redhat, snapcraft: Libyang min version is 2.1.128 2024-04-17 15:11:31 +00:00
staticd zebra: fix missing static routes 2024-07-15 18:46:25 +00:00
tests tests: fix and adjust topotest/bgp_aigp 2024-10-15 14:25:09 +00:00
tools tools: Handle seq num for BGP as-path in frr-reload.py 2024-04-30 11:57:47 +00:00
vrrpd vrrpd: iterate over all ancillary messages 2024-10-08 13:32:34 +00:00
vtysh vtysh: Fix show route-map command when calling via do 2024-04-20 13:07:05 +00:00
watchfrr build: homologize path handling 2024-01-27 19:02:52 +01:00
yang yang: Added missed prefix to the yang file 2024-07-24 10:39:45 +00:00
zebra zebra: fix heap-use-after free on ns shutdown 2024-10-16 13:16:15 +00:00
.clang-format *: Modify clang-format column limit to 100 2024-10-03 19:52:25 +00:00
.dockerignore docker: Make docker image on CentOS 7 2019-11-26 19:29:30 +00:00
.flake8 style: add format checker config that matches FRR style standards 2023-04-18 05:18:26 -04:00
.git-blame-ignore-revs tools: Ignore mass renaming of topotests for git blame 2021-05-11 14:14:26 +03:00
.gitignore tests: add YANG notification test 2024-01-30 14:54:47 -05:00
.isort.cfg style: add format checker config that matches FRR style standards 2023-04-18 05:18:26 -04:00
.pylintrc style: add format checker config that matches FRR style standards 2023-04-18 05:18:26 -04:00
.travis.yml lib: libyang2 add missed conversion 2021-05-17 22:13:59 -04:00
bootstrap.sh build: turn on automake warnings (& symlinks) 2021-04-21 15:42:37 +02:00
buildtest.sh build: update packaging & docs for dir changes 2024-01-27 19:01:19 +01:00
config.version.in build: carry --with-pkg-extra-version into tarballs 2018-10-24 15:11:50 +02:00
configure.ac FRR Release 10.0.2 2024-09-12 10:30:00 +03:00
COPYING *: sort out & explain licenses used in FRR 2023-02-09 12:46:13 +01:00
Makefile.am build: homologize path handling 2024-01-27 19:02:52 +01:00
README.md doc: Fix the link that points to Slack invitation in README 2022-03-24 13:13:37 +02:00
stamp-h.in Initial revision 2002-12-13 20:15:29 +00:00
version.h build: make builddir include path consistent 2021-04-21 15:42:33 +02:00

Icon

FRRouting

FRR is free software that implements and manages various IPv4 and IPv6 routing protocols. It runs on nearly all distributions of Linux and BSD and supports all modern CPU architectures.

FRR currently supports the following protocols:

  • BGP
  • OSPFv2
  • OSPFv3
  • RIPv1
  • RIPv2
  • RIPng
  • IS-IS
  • PIM-SM/MSDP
  • LDP
  • BFD
  • Babel
  • PBR
  • OpenFabric
  • VRRP
  • EIGRP (alpha)
  • NHRP (alpha)

Installation & Use

For source tarballs, see the releases page.

For Debian and its derivatives, use the APT repository at https://deb.frrouting.org/.

Instructions on building and installing from source for supported platforms may be found in the developer docs.

Once installed, please refer to the user guide for instructions on use.

Community

The FRRouting email list server is located here and offers the following public lists:

Topic List
Development dev@lists.frrouting.org
Users & Operators frog@lists.frrouting.org
Announcements announce@lists.frrouting.org

For chat, we currently use Slack. You can join by clicking the "Slack" link under the Participate section of our website.

Contributing

FRR maintains developer's documentation which contains the project workflow and expectations for contributors. Some technical documentation on project internals is also available.

We welcome and appreciate all contributions, no matter how small!

Security

To report security issues, please use our security mailing list:

security [at] lists.frrouting.org