mirror_frr/pathd
Donald Sharp aa5ced0ac8 isisd, lib, ospfd, pathd: Null out free'd pointer
The commands:

router isis 1
  mpls-te on
  no mpls-te on
  mpls-te on
  no mpls-te on
!

Will crash

Valgrind gives us this:
==652336== Invalid read of size 8
==652336==    at 0x49AB25C: typed_rb_min (typerb.c:495)
==652336==    by 0x4943B54: vertices_const_first (link_state.h:424)
==652336==    by 0x493DCE4: vertices_first (link_state.h:424)
==652336==    by 0x493DADC: ls_ted_del_all (link_state.c:1010)
==652336==    by 0x47E77B: isis_instance_mpls_te_destroy (isis_nb_config.c:1871)
==652336==    by 0x495BE20: nb_callback_destroy (northbound.c:1131)
==652336==    by 0x495B5AC: nb_callback_configuration (northbound.c:1356)
==652336==    by 0x4958127: nb_transaction_process (northbound.c:1473)
==652336==    by 0x4958275: nb_candidate_commit_apply (northbound.c:906)
==652336==    by 0x49585B8: nb_candidate_commit (northbound.c:938)
==652336==    by 0x495CE4A: nb_cli_classic_commit (northbound_cli.c:64)
==652336==    by 0x495D6C5: nb_cli_apply_changes_internal (northbound_cli.c:250)
==652336==  Address 0x6f928e0 is 272 bytes inside a block of size 320 free'd
==652336==    at 0x48399AB: free (vg_replace_malloc.c:538)
==652336==    by 0x494BA30: qfree (memory.c:141)
==652336==    by 0x493D99D: ls_ted_del (link_state.c:997)
==652336==    by 0x493DC20: ls_ted_del_all (link_state.c:1018)
==652336==    by 0x47E77B: isis_instance_mpls_te_destroy (isis_nb_config.c:1871)
==652336==    by 0x495BE20: nb_callback_destroy (northbound.c:1131)
==652336==    by 0x495B5AC: nb_callback_configuration (northbound.c:1356)
==652336==    by 0x4958127: nb_transaction_process (northbound.c:1473)
==652336==    by 0x4958275: nb_candidate_commit_apply (northbound.c:906)
==652336==    by 0x49585B8: nb_candidate_commit (northbound.c:938)
==652336==    by 0x495CE4A: nb_cli_classic_commit (northbound_cli.c:64)
==652336==    by 0x495D6C5: nb_cli_apply_changes_internal (northbound_cli.c:250)
==652336==  Block was alloc'd at
==652336==    at 0x483AB65: calloc (vg_replace_malloc.c:760)
==652336==    by 0x494B6F8: qcalloc (memory.c:116)
==652336==    by 0x493D7D2: ls_ted_new (link_state.c:967)
==652336==    by 0x47E4DD: isis_instance_mpls_te_create (isis_nb_config.c:1832)
==652336==    by 0x495BB29: nb_callback_create (northbound.c:1034)
==652336==    by 0x495B547: nb_callback_configuration (northbound.c:1348)
==652336==    by 0x4958127: nb_transaction_process (northbound.c:1473)
==652336==    by 0x4958275: nb_candidate_commit_apply (northbound.c:906)
==652336==    by 0x49585B8: nb_candidate_commit (northbound.c:938)
==652336==    by 0x495CE4A: nb_cli_classic_commit (northbound_cli.c:64)
==652336==    by 0x495D6C5: nb_cli_apply_changes_internal (northbound_cli.c:250)
==652336==    by 0x495D23E: nb_cli_apply_changes (northbound_cli.c:268)

Let's null out the pointer.  After this change.  Valgrind no longer reports issues
and isisd no longer crashes.

Fixes: #10939
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2022-03-31 15:59:46 -04:00
..
.gitignore pathd: New SR-TE policy management daemon 2020-12-18 16:34:02 +01:00
Makefile pathd: New SR-TE policy management daemon 2020-12-18 16:34:02 +01:00
path_cli.c pathd: bad order of nai adjacencies for ipv6 2022-03-23 17:04:55 +01:00
path_debug.c *: make sure config.h or zebra.h is first 2021-04-23 12:06:35 +02:00
path_debug.h pathd: New SR-TE policy management daemon 2020-12-18 16:34:02 +01:00
path_errors.c pathd: Fix spelling mistakes 2022-02-14 12:53:48 -05:00
path_errors.h pathd: Handle PCInitiated configuration, main thread. (3/4) 2021-06-22 12:04:03 +02:00
path_main.c *: Convert quagga_signal_X to frr_signal_X 2021-11-11 14:41:27 -05:00
path_nb_config.c pathd: Handle PCInitiated configuration, main thread. (3/4) 2021-06-22 12:04:03 +02:00
path_nb_state.c pathd: New SR-TE policy management daemon 2020-12-18 16:34:02 +01:00
path_nb.c *: explicitly print "exit" at the end of every node config 2021-08-23 22:08:20 +03:00
path_nb.h lib: northbound cli show/cmd functions must not modify data nodes 2021-10-13 20:12:35 +03:00
path_pcep_cli.c *: fix for -Wstrict-prototypes 2021-09-02 13:00:35 +02:00
path_pcep_cli.h pathd: Add optional support for PCEP to pathd 2020-12-18 16:47:52 +01:00
path_pcep_config.c pathd: Fix spelling mistakes 2022-02-14 12:53:48 -05:00
path_pcep_config.h pathd: Handle PCInitiated configuration, main thread. (3/4) 2021-06-22 12:04:03 +02:00
path_pcep_controller.c *: Change thread->func to return void instead of int 2022-02-23 19:56:04 -05:00
path_pcep_controller.h *: Change thread->func to return void instead of int 2022-02-23 19:56:04 -05:00
path_pcep_debug.c pathd: Handle PCInitiated messages, thread controller. (2/4) 2021-06-22 12:04:03 +02:00
path_pcep_debug.h pathd: Remove unused function 2021-06-05 12:55:48 -04:00
path_pcep_lib.c *: Change thread->func to return void instead of int 2022-02-23 19:56:04 -05:00
path_pcep_lib.h pathd: Handle PCInitiated messages, thread controller. (2/4) 2021-06-22 12:04:03 +02:00
path_pcep_pcc.c pathd: Handle srp_id correctly (2/2) 2021-06-28 17:08:48 +02:00
path_pcep_pcc.h pathd: Handle PCInitiated messages, thread controller. (2/4) 2021-06-22 12:04:03 +02:00
path_pcep.c pathd: Handle PCInitiated configuration, main thread. (3/4) 2021-06-22 12:04:03 +02:00
path_pcep.h pathd: Handle PCInitiated configuration, main thread. (3/4) 2021-06-22 12:04:03 +02:00
path_ted.c isisd, lib, ospfd, pathd: Null out free'd pointer 2022-03-31 15:59:46 -04:00
path_ted.h pathd. TED support . Client to link State - [part 1/4] 2021-05-10 12:36:46 +02:00
path_zebra.c *: convert zclient callbacks to table 2021-10-20 13:28:46 +02:00
path_zebra.h pathd: New SR-TE policy management daemon 2020-12-18 16:34:02 +01:00
pathd.c *: Change thread->func to return void instead of int 2022-02-23 19:56:04 -05:00
pathd.h pathd: rework config printing code 2021-08-23 22:08:20 +03:00
subdir.am build: fix AM_LDFLAGS usage (and gcov) 2021-07-21 17:10:08 +02:00