proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-10-24 14:26:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
ff68181eda
mirror_frr/ldpd
History
Donald Sharp f568f8734f ldpd: Clean up use after free in shutdown 
Config data was being freed just prior to it
being used for cleanup in shutdown.  Prevent this
from happening.

./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-=================================================================
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142:==2274142==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d00000c880 at pc 0x0000004d94d1 bp 0x7ffd46637810 sp 0
x7ffd46637808
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-READ of size 4 at 0x61d00000c880 thread T0
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #0 0x4d94d0 in ldp_rtr_id_get /home/sharpd/frr8/ldpd/ldpd.c:983:20
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #1 0x56ff92 in gen_ldp_hdr /home/sharpd/frr8/ldpd/packet.c:47:19
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #2 0x56a4b0 in send_notification_full /home/sharpd/frr8/ldpd/notification.c:49:9
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #3 0x56c4b3 in send_notification /home/sharpd/frr8/ldpd/notification.c:117:2
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #4 0x573fb7 in session_shutdown /home/sharpd/frr8/ldpd/packet.c:666:3
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #5 0x4e2ef1 in adj_del /home/sharpd/frr8/ldpd/adjacency.c:145:3
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #6 0x55d425 in ldpe_shutdown /home/sharpd/frr8/ldpd/ldpe.c:231:3
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #7 0x55a9a0 in ldpe_dispatch_main /home/sharpd/frr8/ldpd/ldpe.c:631:3
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #8 0x7f0c00c035e6 in thread_call /home/sharpd/frr8/lib/thread.c:2006:2
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #9 0x5586f2 in ldpe /home/sharpd/frr8/ldpd/ldpe.c:138:3
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #10 0x4d46d2 in main /home/sharpd/frr8/ldpd/ldpd.c:339:3
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #11 0x7f0c00476d09 in __libc_start_main csu/../csu/libc-start.c:308:16
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #12 0x429cb9 in _start (/usr/lib/frr/ldpd+0x429cb9)
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-0x61d00000c880 is located 0 bytes inside of 2008-byte region [0x61d00000c880,0x61d00000d058)
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-freed by thread T0 here:
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #0 0x4a3aad in free (/usr/lib/frr/ldpd+0x4a3aad)
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #1 0x4de6c8 in config_clear /home/sharpd/frr8/ldpd/ldpd.c:2001:2
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #2 0x55d12d in ldpe_shutdown /home/sharpd/frr8/ldpd/ldpe.c:211:2
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #3 0x55a9a0 in ldpe_dispatch_main /home/sharpd/frr8/ldpd/ldpe.c:631:3
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #4 0x7f0c00c035e6 in thread_call /home/sharpd/frr8/lib/thread.c:2006:2
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #5 0x5586f2 in ldpe /home/sharpd/frr8/ldpd/ldpe.c:138:3
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #6 0x4d46d2 in main /home/sharpd/frr8/ldpd/ldpd.c:339:3
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #7 0x7f0c00476d09 in __libc_start_main csu/../csu/libc-start.c:308:16
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-previously allocated by thread T0 here:
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #0 0x4a3ea2 in calloc (/usr/lib/frr/ldpd+0x4a3ea2)
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #1 0x4d6146 in config_new_empty /home/sharpd/frr8/ldpd/ldpd.c:1967:10
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #2 0x558678 in ldpe /home/sharpd/frr8/ldpd/ldpe.c:134:11
--
./isis_rlfa_topo1.test_isis_rlfa_topo1/rt8.ldpd.asan.2274142-    #4 0x7f0c00476d09 in __libc_start_main csu/../csu/libc-start.c:308:16

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2022-12-05 08:49:57 -05:00
..
.gitignore *: cleanup .gitignore files 2018-09-08 21:30:42 +02:00
accept.c ldpd: Convert thread_cancel to THREAD_OFF 2022-07-21 08:30:50 -04:00
address.c ldpd: replace inet_ntoa 2020-10-22 15:49:56 -04:00
adjacency.c ldpd: Convert thread_cancel to THREAD_OFF 2022-07-21 08:30:50 -04:00
control.c ldpd: Convert thread_cancel to THREAD_OFF 2022-07-21 08:30:50 -04:00
control.h lib: standardize use of queue.h 2017-08-17 17:47:05 +02:00
hello.c *: use compiler.h MIN/MAX macros instead of everyone having one 2021-11-11 09:39:52 -05:00
init.c *: use compiler.h MIN/MAX macros instead of everyone having one 2021-11-11 09:39:52 -05:00
interface.c ldpd: Convert thread_cancel to THREAD_OFF 2022-07-21 08:30:50 -04:00
keepalive.c ldpd: replace inet_ntoa 2020-10-22 15:49:56 -04:00
l2vpn.c ldpd: process pw-status in received order 2020-07-20 09:08:15 -04:00
labelmapping.c *: Replace IPV4_MAX_PREFIXLEN to IPV4_MAX_BITLEN 2021-07-01 17:44:09 +03:00
lde_lib.c ldpd: Convert thread_cancel to THREAD_OFF 2022-07-21 08:30:50 -04:00
lde.c ldpd: Convert thread_cancel to THREAD_OFF 2022-07-21 08:30:50 -04:00
lde.h *: Change thread->func to return void instead of int 2022-02-23 19:56:04 -05:00
ldp_debug.c ldpd: Adding support for LDP IGP Synchronization 2020-09-09 10:45:41 -04:00
ldp_debug.h ldpd: Adding support for LDP IGP Synchronization 2020-09-09 10:45:41 -04:00
ldp_snmp.c *: fix for -Wstrict-prototypes 2021-09-02 13:00:35 +02:00
ldp_vty_cmds.c build, vtysh: extract vtysh commands from .xref 2022-10-26 17:12:34 +01:00
ldp_vty_conf.c *: explicitly print "exit" at the end of every node config 2021-08-23 22:08:20 +03:00
ldp_vty_exec.c *: Add camelCase JSON keys in addition to PascalCase 2022-02-03 10:48:06 +02:00
ldp_vty.h ldpd: make allowing broken-lsps to be installed with pop operation configurable 2021-05-03 09:02:36 -04:00
ldp_zebra.c *: convert zclient callbacks to table 2021-10-20 13:28:46 +02:00
ldp.h ldpd: Adding support for LDP IGP Synchronization 2020-09-09 10:45:41 -04:00
ldpd.c ldpd: Convert thread_cancel to THREAD_OFF 2022-07-21 08:30:50 -04:00
ldpd.h *: use FRR interface name definition everywhere 2022-05-02 13:00:12 -03:00
ldpe.c ldpd: Clean up use after free in shutdown 2022-12-05 08:49:57 -05:00
ldpe.h *: Change thread->func to return void instead of int 2022-02-23 19:56:04 -05:00
log.c ldpd: fix printfrr format specifiers in the child processes 2020-12-09 11:55:10 -03:00
log.h ldpd: split log.c into two files 2017-06-05 12:05:22 -03:00
logmsg.c ldpd: replace inet_ntoa 2020-10-22 15:49:56 -04:00
Makefile build: non-recursive ldpd 2017-08-04 19:09:11 +02:00
neighbor.c ldpd: Make ldpd happy with clang-16 2022-10-26 07:40:48 -04:00
notification.c ldpd: Add support for the read-only snmp mib objects that are statistics 2021-03-16 10:23:34 -04:00
packet.c ldpd: Convert thread_cancel to THREAD_OFF 2022-07-21 08:30:50 -04:00
pfkey.c *: fix config.h/zebra.h include order 2018-09-08 21:30:42 +02:00
rlfa.c ldpd: add support for RLFA clients 2021-01-08 22:22:11 -03:00
rlfa.h ldpd: add support for RLFA clients 2021-01-08 22:22:11 -03:00
socket.c *: Do not cast to the same type 2020-04-08 17:15:06 +03:00
subdir.am build, vtysh: extract vtysh commands from .xref 2022-10-26 17:12:34 +01:00
util.c *: Convert numeric 32 into IPV4_MAX_BITLEN for prefixlen 2021-07-01 23:50:39 +03:00