Commits on Oct 17, 2020

1. zebra: Fix use after free in debug path …

   When zebra is running with debugs turned on there
   is a use after free reported by the address sanitizer:
   
   2020/10/16 12:58:02 ZEBRA: rib_delnode: (0:254):4.5.6.16/32: rn 0x60b000026f20, re 0x6080000131a0, removing
   2020/10/16 12:58:02 ZEBRA: rib_meta_queue_add: (0:254):4.5.6.16/32: queued rn 0x60b000026f20 into sub-queue 3
   =================================================================
   ==3101430==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000011d28 at pc 0x555555705ab6 bp 0x7fffffffdab0 sp 0x7fffffffdaa8
   READ of size 8 at 0x608000011d28 thread T0
       #0 0x555555705ab5 in re_list_const_first zebra/rib.h:222
       #1 0x555555705b54 in re_list_first zebra/rib.h:222
       #2 0x555555711a4f in process_subq_route zebra/zebra_rib.c:2248
       #3 0x555555711d2e in process_subq zebra/zebra_rib.c:2286
       #4 0x555555711ec7 in meta_queue_process zebra/zebra_rib.c:2320
       #5 0x7ffff74701f7 in work_queue_run lib/workqueue.c:291
       #6 0x7ffff7450e9c in thread_call lib/thread.c:1581
       #7 0x7ffff738eaf7 in frr_run lib/libfrr.c:1099
       #8 0x55555561a578 in main zebra/main.c:455
       #9 0x7ffff7079cc9 in __libc_start_main ../csu/libc-start.c:308
       #10 0x5555555e3429 in _start (/usr/lib/frr/zebra+0x8f429)
   0x608000011d28 is located 8 bytes inside of 88-byte region [0x608000011d20,0x608000011d78)
   freed by thread T0 here:
       #0 0x7ffff768bb6f in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.6+0xa9b6f)
       #1 0x7ffff739ccad in qfree lib/memory.c:129
       #2 0x555555709ee4 in rib_gc_dest zebra/zebra_rib.c:746
       #3 0x55555570ca76 in rib_process zebra/zebra_rib.c:1240
       #4 0x555555711a05 in process_subq_route zebra/zebra_rib.c:2245
       #5 0x555555711d2e in process_subq zebra/zebra_rib.c:2286
       #6 0x555555711ec7 in meta_queue_process zebra/zebra_rib.c:2320
       #7 0x7ffff74701f7 in work_queue_run lib/workqueue.c:291
       #8 0x7ffff7450e9c in thread_call lib/thread.c:1581
       #9 0x7ffff738eaf7 in frr_run lib/libfrr.c:1099
       #10 0x55555561a578 in main zebra/main.c:455
       #11 0x7ffff7079cc9 in __libc_start_main ../csu/libc-start.c:308
   previously allocated by thread T0 here:
       #0 0x7ffff768c037 in calloc (/lib/x86_64-linux-gnu/libasan.so.6+0xaa037)
       #1 0x7ffff739cb98 in qcalloc lib/memory.c:110
       #2 0x555555712ace in zebra_rib_create_dest zebra/zebra_rib.c:2515
       #3 0x555555712c6c in rib_link zebra/zebra_rib.c:2576
       #4 0x555555712faa in rib_addnode zebra/zebra_rib.c:2607
       #5 0x555555715bf0 in rib_add_multipath_nhe zebra/zebra_rib.c:3012
       #6 0x555555715f56 in rib_add_multipath zebra/zebra_rib.c:3049
       #7 0x55555571788b in rib_add zebra/zebra_rib.c:3327
       #8 0x5555555e584a in connected_up zebra/connected.c:254
       #9 0x5555555e42ff in connected_announce zebra/connected.c:94
       #10 0x5555555e4fd3 in connected_update zebra/connected.c:195
       #11 0x5555555e61ad in connected_add_ipv4 zebra/connected.c:340
       #12 0x5555555f26f5 in netlink_interface_addr zebra/if_netlink.c:1213
       #13 0x55555560f756 in netlink_information_fetch zebra/kernel_netlink.c:350
       #14 0x555555612e49 in netlink_parse_info zebra/kernel_netlink.c:941
       #15 0x55555560f9f1 in kernel_read zebra/kernel_netlink.c:402
       #16 0x7ffff7450e9c in thread_call lib/thread.c:1581
       #17 0x7ffff738eaf7 in frr_run lib/libfrr.c:1099
       #18 0x55555561a578 in main zebra/main.c:455
       #19 0x7ffff7079cc9 in __libc_start_main ../csu/libc-start.c:308
   SUMMARY: AddressSanitizer: heap-use-after-free zebra/rib.h:222 in re_list_const_first
   
   This is happening because we are using the dest pointer after a call into
   rib_gc_dest.  In process_subq_route, we call rib_process() and if the
   dest is deleted dest pointer is now garbage.  We must reload the
   dest pointer in this case.
   
   Signed-off-by: Donald Sharp <sharpd@nvidia.com>

   

   donaldsharp committed Oct 17, 2020
   Configuration menu

   • View commit details
   • Copy full SHA for 7e26b9d
   • Browse repository at this point

   Copy the full SHA

   7e26b9d View commit details

   Browse the repository at this point in the history