mirror of
https://git.proxmox.com/git/mirror_frr
synced 2025-07-25 07:28:41 +00:00
c929e1ab43
To avoid USE:
```
==587645==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000074050 at pc 0x55b34337d96c bp 0x7ffda59bb4c0 sp 0x7ffda59bb4b0
READ of size 8 at 0x604000074050 thread T0
0 0x55b34337d96b in bgp_attr_flush bgpd/bgp_attr.c:1289
1 0x55b34368ef85 in bgp_conditional_adv_routes bgpd/bgp_conditional_adv.c:111
2 0x55b34368ff58 in bgp_conditional_adv_timer bgpd/bgp_conditional_adv.c:301
3 0x7f7d41cdf81c in event_call lib/event.c:1980
4 0x7f7d41c1da37 in frr_run lib/libfrr.c:1214
5 0x55b343371e22 in main bgpd/bgp_main.c:510
6 0x7f7d41517082 in __libc_start_main ../csu/libc-start.c:308
7 0x55b3433769fd in _start (/usr/lib/frr/bgpd+0x2e29fd)
0x604000074050 is located 0 bytes inside of 40-byte region [0x604000074050,0x604000074078)
freed by thread T0 here:
#0 0x7f7d4207540f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
1 0x55b343396afd in community_free bgpd/bgp_community.c:41
2 0x55b343396afd in community_free bgpd/bgp_community.c:28
3 0x55b343397373 in community_intern bgpd/bgp_community.c:458
4 0x55b34337bed4 in bgp_attr_intern bgpd/bgp_attr.c:967
5 0x55b34368165b in bgp_advertise_attr_intern bgpd/bgp_advertise.c:106
6 0x55b3435277d7 in bgp_adj_out_set_subgroup bgpd/bgp_updgrp_adv.c:587
7 0x55b34368f36b in bgp_conditional_adv_routes bgpd/bgp_conditional_adv.c:125
8 0x55b34368ff58 in bgp_conditional_adv_timer bgpd/bgp_conditional_adv.c:301
9 0x7f7d41cdf81c in event_call lib/event.c:1980
10 0x7f7d41c1da37 in frr_run lib/libfrr.c:1214
11 0x55b343371e22 in main bgpd/bgp_main.c:510
12 0x7f7d41517082 in __libc_start_main ../csu/libc-start.c:308
previously allocated by thread T0 here:
#0 0x7f7d42075a06 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:153
1 0x7f7d41c3c28e in qcalloc lib/memory.c:105
2 0x55b3433976e8 in community_dup bgpd/bgp_community.c:514
3 0x55b34350273a in route_set_community bgpd/bgp_routemap.c:2589
4 0x7f7d41c96c06 in route_map_apply_ext lib/routemap.c:2690
5 0x55b34368f2d8 in bgp_conditional_adv_routes bgpd/bgp_conditional_adv.c:107
6 0x55b34368ff58 in bgp_conditional_adv_timer bgpd/bgp_conditional_adv.c:301
7 0x7f7d41cdf81c in event_call lib/event.c:1980
8 0x7f7d41c1da37 in frr_run lib/libfrr.c:1214
9 0x55b343371e22 in main bgpd/bgp_main.c:510
10 0x7f7d41517082 in __libc_start_main ../csu/libc-start.c:308
```
And also a crash:
```
(gdb) bt
0 raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
1 0x00007ff3b7048ce0 in core_handler (signo=6, siginfo=0x7ffc8cf724b0, context=<optimized out>)
at lib/sigevent.c:246
2 <signal handler called>
3 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
4 0x00007ff3b6bb8859 in __GI_abort () at abort.c:79
5 0x00007ff3b6c2326e in __libc_message (action=action@entry=do_abort,
fmt=fmt@entry=0x7ff3b6d4d298 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
6 0x00007ff3b6c2b2fc in malloc_printerr (
str=str@entry=0x7ff3b6d4f628 "double free or corruption (fasttop)") at malloc.c:5347
7 0x00007ff3b6c2cc65 in _int_free (av=0x7ff3b6d82b80 <main_arena>, p=0x555c8fa70a10, have_lock=0)
at malloc.c:4266
8 0x0000555c8da94bd3 in community_free (com=0x7ffc8cf72e70) at bgpd/bgp_community.c:41
9 community_free (com=com@entry=0x7ffc8cf72e70) at bgpd/bgp_community.c:28
10 0x0000555c8da8afc1 in bgp_attr_flush (attr=attr@entry=0x7ffc8cf73040) at bgpd/bgp_attr.c:1290
11 0x0000555c8dbc0760 in bgp_conditional_adv_routes (peer=peer@entry=0x555c8fa627c0,
afi=afi@entry=AFI_IP, safi=SAFI_UNICAST, table=table@entry=0x555c8fa510b0, rmap=0x555c8fa71cb0,
update_type=UPDATE_TYPE_ADVERTISE) at bgpd/bgp_conditional_adv.c:111
12 0x0000555c8dbc0b75 in bgp_conditional_adv_timer (t=<optimized out>)
at bgpd/bgp_conditional_adv.c:301
13 0x00007ff3b705b84c in event_call (thread=thread@entry=0x7ffc8cf73440) at lib/event.c:1980
14 0x00007ff3b700bf98 in frr_run (master=0x555c8f27c090) at lib/libfrr.c:1214
15 0x0000555c8da85f05 in main (argc=<optimized out>, argv=0x7ffc8cf736a8) at bgpd/bgp_main.c:510
```
Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| rfapi | ||
| rfp-example | ||
| .gitignore | ||
| bgp_addpath_types.h | ||
| bgp_addpath.c | ||
| bgp_addpath.h | ||
| bgp_advertise.c | ||
| bgp_advertise.h | ||
| bgp_aspath.c | ||
| bgp_aspath.h | ||
| bgp_attr_evpn.c | ||
| bgp_attr_evpn.h | ||
| bgp_attr.c | ||
| bgp_attr.h | ||
| bgp_bfd.c | ||
| bgp_bfd.h | ||
| bgp_bmp.c | ||
| bgp_bmp.h | ||
| bgp_btoa.c | ||
| bgp_clist.c | ||
| bgp_clist.h | ||
| bgp_community_alias.c | ||
| bgp_community_alias.h | ||
| bgp_community.c | ||
| bgp_community.h | ||
| bgp_conditional_adv.c | ||
| bgp_conditional_adv.h | ||
| bgp_damp.c | ||
| bgp_damp.h | ||
| bgp_debug.c | ||
| bgp_debug.h | ||
| bgp_dump.c | ||
| bgp_dump.h | ||
| bgp_ecommunity.c | ||
| bgp_ecommunity.h | ||
| bgp_encap_tlv.c | ||
| bgp_encap_tlv.h | ||
| bgp_encap_types.h | ||
| bgp_errors.c | ||
| bgp_errors.h | ||
| bgp_evpn_mh.c | ||
| bgp_evpn_mh.h | ||
| bgp_evpn_private.h | ||
| bgp_evpn_vty.c | ||
| bgp_evpn_vty.h | ||
| bgp_evpn.c | ||
| bgp_evpn.h | ||
| bgp_filter.c | ||
| bgp_filter.h | ||
| bgp_flowspec_private.h | ||
| bgp_flowspec_util.c | ||
| bgp_flowspec_util.h | ||
| bgp_flowspec_vty.c | ||
| bgp_flowspec.c | ||
| bgp_flowspec.h | ||
| bgp_fsm.c | ||
| bgp_fsm.h | ||
| bgp_io.c | ||
| bgp_io.h | ||
| bgp_keepalives.c | ||
| bgp_keepalives.h | ||
| bgp_label.c | ||
| bgp_label.h | ||
| bgp_labelpool.c | ||
| bgp_labelpool.h | ||
| bgp_lcommunity.c | ||
| bgp_lcommunity.h | ||
| bgp_mac.c | ||
| bgp_mac.h | ||
| bgp_main.c | ||
| bgp_memory.c | ||
| bgp_memory.h | ||
| bgp_mpath.c | ||
| bgp_mpath.h | ||
| bgp_mplsvpn_snmp.c | ||
| bgp_mplsvpn_snmp.h | ||
| bgp_mplsvpn.c | ||
| bgp_mplsvpn.h | ||
| bgp_network.c | ||
| bgp_network.h | ||
| bgp_nexthop.c | ||
| bgp_nexthop.h | ||
| bgp_nht.c | ||
| bgp_nht.h | ||
| bgp_open.c | ||
| bgp_open.h | ||
| bgp_packet.c | ||
| bgp_packet.h | ||
| bgp_pbr.c | ||
| bgp_pbr.h | ||
| bgp_rd.c | ||
| bgp_rd.h | ||
| bgp_regex.c | ||
| bgp_regex.h | ||
| bgp_route.c | ||
| bgp_route.h | ||
| bgp_routemap_nb_config.c | ||
| bgp_routemap_nb.c | ||
| bgp_routemap_nb.h | ||
| bgp_routemap.c | ||
| bgp_rpki.c | ||
| bgp_rpki.h | ||
| bgp_script.c | ||
| bgp_script.h | ||
| bgp_snmp_bgp4.c | ||
| bgp_snmp_bgp4.h | ||
| bgp_snmp_bgp4v2.c | ||
| bgp_snmp_bgp4v2.h | ||
| bgp_snmp.c | ||
| bgp_snmp.h | ||
| bgp_table.c | ||
| bgp_table.h | ||
| bgp_trace.c | ||
| bgp_trace.h | ||
| bgp_updgrp_adv.c | ||
| bgp_updgrp_packet.c | ||
| bgp_updgrp.c | ||
| bgp_updgrp.h | ||
| bgp_vnc_types.h | ||
| bgp_vpn.c | ||
| bgp_vpn.h | ||
| bgp_vty.c | ||
| bgp_vty.h | ||
| bgp_zebra.c | ||
| bgp_zebra.h | ||
| bgpd.c | ||
| bgpd.h | ||
| Makefile | ||
| subdir.am | ||