Go to file
zhou-run f5a2e39ba8 isisd: fix crash when obtaining the next hop to calculate LFA on LAN links
When a neighbor connection is disconnected, it may trigger LSP re-generation as a timer task, but this process may be delayed. As a result, the list of neighbors in area->adjacency_list may be inconsistent with the neighbors in lsp->tlvs->oldstyle_reach/extended_reach. For example, the area->adjacency_list may lack certain neighbors even though they are present in the LSP. When computing SPF, the call to isis_spf_build_adj_list() generates the spftree->sadj_list, which reflects the real neighbors in the area->adjacency_list. However, in the case of LAN links, spftree->sadj_list may include additional pseudo neighbors.
The pre-loading of tents through the call to isis_spf_preload_tent involves two steps:
1. isis_spf_process_lsp() is called to generate real neighbor vertices based on the root LSP and pseudo LSP.
2. isis_spf_add_local() is called to add corresponding next hops to the vertex->Adj_N list for the real neighbor vertices.
In the case of LAN links, the absence of corresponding real neighbors in the spftree->sadj_list prevents the execution of the second step. Consequently, the vertex->Adj_N list for the real neighbor vertices lacks corresponding next hops. This leads to a null pointer access when isis_lfa_compute() is called to calculate LFA.
As for P2P links, since there are no pseudo neighbors, only the second step is executed, which does not create real neighbor vertices and therefore does not encounter this issue.
The backtrace is as follows:
(gdb) bt
#0  0x00007fd065277fe1 in raise () from /lib/x86_64-linux-gnu/libpthread.so.0
#1  0x00007fd065398972 in core_handler (signo=11, siginfo=0x7ffc5c0636b0, context=0x7ffc5c063580) at ../lib/sigevent.c:261
#2  <signal handler called>
#3  0x00005564d82f8408 in isis_lfa_compute (area=0x5564d8b143f0, circuit=0x5564d8b21d10, spftree=0x5564d8b06bf0, resource=0x7ffc5c064410) at ../isisd/isis_lfa.c:2134
#4  0x00005564d82f8d78 in isis_spf_run_lfa (area=0x5564d8b143f0, spftree=0x5564d8b06bf0) at ../isisd/isis_lfa.c:2344
#5  0x00005564d8315964 in isis_run_spf_with_protection (area=0x5564d8b143f0, spftree=0x5564d8b06bf0) at ../isisd/isis_spf.c:1827
#6  0x00005564d8315c15 in isis_run_spf_cb (thread=0x7ffc5c064590) at ../isisd/isis_spf.c:1889
#7  0x00007fd0653b1f04 in thread_call (thread=0x7ffc5c064590) at ../lib/thread.c:1990
#8  0x00007fd06534a97b in frr_run (master=0x5564d88103c0) at ../lib/libfrr.c:1198
#9  0x00005564d82e7d5d in main (argc=5, argv=0x7ffc5c0647b8, envp=0x7ffc5c0647e8) at ../isisd/isis_main.c:273
(gdb) f 3
#3  0x00005564d82f8408 in isis_lfa_compute (area=0x5564d8b143f0, circuit=0x5564d8b21d10, spftree=0x5564d8b06bf0, resource=0x7ffc5c064410) at ../isisd/isis_lfa.c:2134
2134    ../isisd/isis_lfa.c: No such file or directory.
(gdb) p vadj_primary
$1 = (struct isis_vertex_adj *) 0x0
(gdb) p vertex->Adj_N->head
$2 = (struct listnode *) 0x0
(gdb) p (struct isis_vertex *)spftree->paths->l.list->head->next->next->next->next->data
$8 = (struct isis_vertex *) 0x5564d8b5b240
(gdb) p $8->type
$9 = VTYPE_NONPSEUDO_TE_IS
(gdb) p $8->N.id
$10 = "\000\000\000\000\000\002"
(gdb) p $8->Adj_N->count
$11 = 0
(gdb) p (struct isis_vertex *)spftree->paths->l.list->head->next->next->next->next->next->data
$12 = (struct isis_vertex *) 0x5564d8b73dd0
(gdb) p $12->type
$13 = VTYPE_NONPSEUDO_TE_IS
(gdb) p $12->N.id
$14 = "\000\000\000\000\000\003"
(gdb) p $12->Adj_N->count
$15 = 0
(gdb) p area->adjacency_list->count
$16 = 0
The backtrace provided above pertains to version 8.5.4, but it seems that the same issue exists in the code of the master branch as well.
The scenario where a vertex has no next hop is normal. For example, the "clear isis neighbor" command invokes isis_vertex_adj_del() to delete the next hop of a vertex. Upon reviewing all the instances where the vertex->Adj_N list is used, I found that only isis_lfa_compute() lacks a null check. Therefore, I believe that modifying this part will be sufficient. Additionally, the vertex->parents list for IP vertices is guaranteed not to be empty.
Test scenario:
Setting up LFA for LAN links and executing the "clear isis neighbor" command easily reproduces the issue.

Signed-off-by: zhou-run <zhou.run@h3c.com>
(cherry picked from commit a970bb51b5)
2024-07-02 12:02:18 +00:00
.github github: Mark the build as failed if 'do not merge' label is set 2023-12-22 10:29:52 +02:00
alpine docker: Fix post function for Alpine build (package) 2024-03-12 20:34:30 +00:00
babeld *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
bfdd *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
bgpd Merge pull request #16283 from FRRouting/mergify/bp/stable/10.0/pr-15838 2024-06-25 07:31:50 -04:00
debian FRR Release 10.0.1 2024-06-06 11:30:49 -05:00
doc pimd: fix dr-priority range 2024-05-09 13:54:46 +00:00
docker docker: Do not use pip Python package manager 2024-03-12 20:34:30 +00:00
eigrpd *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
fpm *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
gdb lib: add simplified native msg support 2023-12-26 08:34:56 -05:00
grpc *: manual SPDX License ID conversions 2023-02-09 14:09:07 +01:00
include lib: Drop include/linux/mroute[6].h 2024-03-12 20:34:30 +00:00
isisd isisd: fix crash when obtaining the next hop to calculate LFA on LAN links 2024-07-02 12:02:18 +00:00
ldpd *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
lib Merge pull request #16203 from FRRouting/mergify/bp/stable/10.0/pr-16191 2024-06-14 15:31:52 +03:00
m4 build: add recursion limit for AX_RECURSIVE_EVAL 2024-01-27 19:01:19 +01:00
mgmtd mgmtd: change error message 2024-03-07 07:26:36 +00:00
mlag build: fix AM_LDFLAGS usage (and gcov) 2021-07-21 17:10:08 +02:00
nhrpd nhrpd: cleans up shortcut cache entries on termination 2024-06-05 21:40:05 +00:00
ospf6d ospf6d: OSPFv3 route change comparision fixed for ASBR-only change 2024-06-02 15:22:21 +00:00
ospfclient *: Convert event.h to frrevent.h 2023-03-24 08:32:17 -04:00
ospfd ospfd: protect call to get_edge() in ospf_te.c 2024-05-24 19:32:20 +00:00
pathd *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
pbrd *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
pceplib Merge pull request #15215 from donaldsharp/pceplib_fixup 2024-01-25 09:59:59 +02:00
pimd pimd: fix crash when mixing ssm/any-source joins 2024-05-31 15:00:16 +00:00
pkgsrc build: homologize path handling 2024-01-27 19:02:52 +01:00
python build: remove mgmtd exception from xref2vtysh 2024-01-28 23:28:40 +02:00
qpb qpb: Add missing #include nexthop.h 2024-02-10 00:44:50 +01:00
redhat FRR Release 10.0.1 2024-06-06 11:30:49 -05:00
ripd ripd: Change the start value of sequence 1 to 0 2024-07-01 17:37:46 +00:00
ripngd ripngd: fix "clear ipv6 ripng" command 2024-03-09 10:16:38 +00:00
sharpd *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
snapcraft debian, redhat, snapcraft: Libyang min version is 2.1.128 2024-04-17 15:11:31 +00:00
staticd Merge pull request #15285 from idryzhov/staticd-nexthop-refcounter 2024-02-08 15:53:30 -05:00
tests tests: improve tests for aspath exclude and bgp access list 2024-06-24 21:09:28 +00:00
tools tools: Handle seq num for BGP as-path in frr-reload.py 2024-04-30 11:57:47 +00:00
vrrpd *: create a single registry of daemons' default port values 2024-02-01 11:40:02 -05:00
vtysh vtysh: Fix show route-map command when calling via do 2024-04-20 13:07:05 +00:00
watchfrr build: homologize path handling 2024-01-27 19:02:52 +01:00
yang pimd: fix dr-priority range 2024-05-09 13:54:46 +00:00
zebra zebra: fix evpn mh bond member proto reinstall 2024-06-21 06:47:48 +00:00
.clang-format tools: add more libyang iter macros to .clang-format 2023-12-28 17:52:57 +00:00
.dockerignore docker: Make docker image on CentOS 7 2019-11-26 19:29:30 +00:00
.flake8 style: add format checker config that matches FRR style standards 2023-04-18 05:18:26 -04:00
.git-blame-ignore-revs tools: Ignore mass renaming of topotests for git blame 2021-05-11 14:14:26 +03:00
.gitignore tests: add YANG notification test 2024-01-30 14:54:47 -05:00
.isort.cfg style: add format checker config that matches FRR style standards 2023-04-18 05:18:26 -04:00
.pylintrc style: add format checker config that matches FRR style standards 2023-04-18 05:18:26 -04:00
.travis.yml lib: libyang2 add missed conversion 2021-05-17 22:13:59 -04:00
bootstrap.sh build: turn on automake warnings (& symlinks) 2021-04-21 15:42:37 +02:00
buildtest.sh build: update packaging & docs for dir changes 2024-01-27 19:01:19 +01:00
config.version.in build: carry --with-pkg-extra-version into tarballs 2018-10-24 15:11:50 +02:00
configure.ac FRR Release 10.0.1 2024-06-06 11:30:49 -05:00
COPYING *: sort out & explain licenses used in FRR 2023-02-09 12:46:13 +01:00
Makefile.am build: homologize path handling 2024-01-27 19:02:52 +01:00
README.md doc: Fix the link that points to Slack invitation in README 2022-03-24 13:13:37 +02:00
stamp-h.in Initial revision 2002-12-13 20:15:29 +00:00
version.h build: make builddir include path consistent 2021-04-21 15:42:33 +02:00

Icon

FRRouting

FRR is free software that implements and manages various IPv4 and IPv6 routing protocols. It runs on nearly all distributions of Linux and BSD and supports all modern CPU architectures.

FRR currently supports the following protocols:

  • BGP
  • OSPFv2
  • OSPFv3
  • RIPv1
  • RIPv2
  • RIPng
  • IS-IS
  • PIM-SM/MSDP
  • LDP
  • BFD
  • Babel
  • PBR
  • OpenFabric
  • VRRP
  • EIGRP (alpha)
  • NHRP (alpha)

Installation & Use

For source tarballs, see the releases page.

For Debian and its derivatives, use the APT repository at https://deb.frrouting.org/.

Instructions on building and installing from source for supported platforms may be found in the developer docs.

Once installed, please refer to the user guide for instructions on use.

Community

The FRRouting email list server is located here and offers the following public lists:

Topic List
Development dev@lists.frrouting.org
Users & Operators frog@lists.frrouting.org
Announcements announce@lists.frrouting.org

For chat, we currently use Slack. You can join by clicking the "Slack" link under the Participate section of our website.

Contributing

FRR maintains developer's documentation which contains the project workflow and expectations for contributors. Some technical documentation on project internals is also available.

We welcome and appreciate all contributions, no matter how small!

Security

To report security issues, please use our security mailing list:

security [at] lists.frrouting.org