Build #3,849

FreeRangeRouting Protocol Suite

Build: #3849 was successful Changes by Donatas Abraitis <donatas.abraitis@gmail.com>

Build result summary

Details

Completed
Duration
178 minutes
Labels
version=frr-7_4-dev-3155-g0894afd4cgit=https_//github_com/frrouting/frr_gitbuildurl=https_//ci1_netdef_org/browse/frr-frr-3849branch=master
Revision
0894afd4cf49511be5ac68f36115ca6acf6a5707 0894afd4cf49511be5ac68f36115ca6acf6a5707
Total tests
9993
Successful since
#3846 ()

Tests

Code commits

Author Commit Message Commit date
Donatas Abraitis <donatas.abraitis@gmail.com> Donatas Abraitis <donatas.abraitis@gmail.com> 0894afd4cf49511be5ac68f36115ca6acf6a5707 0894afd4cf49511be5ac68f36115ca6acf6a5707 Merge pull request #7336 from donaldsharp/sharp_one_one
sharpd: Fix nexthop group name collision
Donatas Abraitis <donatas.abraitis@gmail.com> Donatas Abraitis <donatas.abraitis@gmail.com> f41688b42365bbbd1d33729ac70ae7dba33288c4 f41688b42365bbbd1d33729ac70ae7dba33288c4 Merge pull request #7330 from donaldsharp/zebra_use_after_free
zebra: Fix use after free in debug path
Donatas Abraitis <donatas.abraitis@gmail.com> Donatas Abraitis <donatas.abraitis@gmail.com> 0dc864709481a66c37b095f2f9df598896df3cd5 0dc864709481a66c37b095f2f9df598896df3cd5 Merge pull request #7306 from donaldsharp/bgp_dest_print
Bgp dest print
Donald Sharp <sharpd@nvidia.com> Donald Sharp <sharpd@nvidia.com> 7e26b9d4a2f7d60e7021d5ea32f4b3c7bec7719f m 7e26b9d4a2f7d60e7021d5ea32f4b3c7bec7719f zebra: Fix use after free in debug path
When zebra is running with debugs turned on there
is a use after free reported by the address sanitizer:

2020/10/16 12:58:02 ZEBRA: rib_delnode: (0:254):4.5.6.16/32: rn 0x60b000026f20, re 0x6080000131a0, removing
2020/10/16 12:58:02 ZEBRA: rib_meta_queue_add: (0:254):4.5.6.16/32: queued rn 0x60b000026f20 into sub-queue 3
=================================================================
==3101430==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000011d28 at pc 0x555555705ab6 bp 0x7fffffffdab0 sp 0x7fffffffdaa8
READ of size 8 at 0x608000011d28 thread T0
    #0 0x555555705ab5 in re_list_const_first zebra/rib.h:222
    #1 0x555555705b54 in re_list_first zebra/rib.h:222
    #2 0x555555711a4f in process_subq_route zebra/zebra_rib.c:2248
    #3 0x555555711d2e in process_subq zebra/zebra_rib.c:2286
    #4 0x555555711ec7 in meta_queue_process zebra/zebra_rib.c:2320
    #5 0x7ffff74701f7 in work_queue_run lib/workqueue.c:291
    #6 0x7ffff7450e9c in thread_call lib/thread.c:1581
    #7 0x7ffff738eaf7 in frr_run lib/libfrr.c:1099
    #8 0x55555561a578 in main zebra/main.c:455
    #9 0x7ffff7079cc9 in __libc_start_main ../csu/libc-start.c:308
    #10 0x5555555e3429 in _start (/usr/lib/frr/zebra+0x8f429)
0x608000011d28 is located 8 bytes inside of 88-byte region [0x608000011d20,0x608000011d78)
freed by thread T0 here:
    #0 0x7ffff768bb6f in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.6+0xa9b6f)
    #1 0x7ffff739ccad in qfree lib/memory.c:129
    #2 0x555555709ee4 in rib_gc_dest zebra/zebra_rib.c:746
    #3 0x55555570ca76 in rib_process zebra/zebra_rib.c:1240
    #4 0x555555711a05 in process_subq_route zebra/zebra_rib.c:2245
    #5 0x555555711d2e in process_subq zebra/zebra_rib.c:2286
    #6 0x555555711ec7 in meta_queue_process zebra/zebra_rib.c:2320
    #7 0x7ffff74701f7 in work_queue_run lib/workqueue.c:291
    #8 0x7ffff7450e9c in thread_call lib/thread.c:1581
    #9 0x7ffff738eaf7 in frr_run lib/libfrr.c:1099
    #10 0x55555561a578 in main zebra/main.c:455
    #11 0x7ffff7079cc9 in __libc_start_main ../csu/libc-start.c:308
previously allocated by thread T0 here:
    #0 0x7ffff768c037 in calloc (/lib/x86_64-linux-gnu/libasan.so.6+0xaa037)
    #1 0x7ffff739cb98 in qcalloc lib/memory.c:110
    #2 0x555555712ace in zebra_rib_create_dest zebra/zebra_rib.c:2515
    #3 0x555555712c6c in rib_link zebra/zebra_rib.c:2576
    #4 0x555555712faa in rib_addnode zebra/zebra_rib.c:2607
    #5 0x555555715bf0 in rib_add_multipath_nhe zebra/zebra_rib.c:3012
    #6 0x555555715f56 in rib_add_multipath zebra/zebra_rib.c:3049
    #7 0x55555571788b in rib_add zebra/zebra_rib.c:3327
    #8 0x5555555e584a in connected_up zebra/connected.c:254
    #9 0x5555555e42ff in connected_announce zebra/connected.c:94
    #10 0x5555555e4fd3 in connected_update zebra/connected.c:195
    #11 0x5555555e61ad in connected_add_ipv4 zebra/connected.c:340
    #12 0x5555555f26f5 in netlink_interface_addr zebra/if_netlink.c:1213
    #13 0x55555560f756 in netlink_information_fetch zebra/kernel_netlink.c:350
    #14 0x555555612e49 in netlink_parse_info zebra/kernel_netlink.c:941
    #15 0x55555560f9f1 in kernel_read zebra/kernel_netlink.c:402
    #16 0x7ffff7450e9c in thread_call lib/thread.c:1581
    #17 0x7ffff738eaf7 in frr_run lib/libfrr.c:1099
    #18 0x55555561a578 in main zebra/main.c:455
    #19 0x7ffff7079cc9 in __libc_start_main ../csu/libc-start.c:308
SUMMARY: AddressSanitizer: heap-use-after-free zebra/rib.h:222 in re_list_const_first

This is happening because we are using the dest pointer after a call into
rib_gc_dest.  In process_subq_route, we call rib_process() and if the
dest is deleted dest pointer is now garbage.  We must reload the
dest pointer in this case.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
Donald Sharp <sharpd@nvidia.com> Donald Sharp <sharpd@nvidia.com> 09319b4e0fa9461af3c72eb9778c02a3af44007a m 09319b4e0fa9461af3c72eb9778c02a3af44007a bgpd: More bgp_node -> bgp_dest cleanup
Some more of the bgp_node usage snuck in from big commits in
the past month or so from feature work.  Do some work
to put it back to bgp_dest for incoming future work.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>

Jira issues

IssueDescriptionStatus
Unknown Issue TypeFRR-7Could not obtain issue details from Jira