Skip to content

Commit

Permalink
zebra: fix heap-use-after free on ns shutdown
Browse files Browse the repository at this point in the history
The following ASAN issue has been observed:

> ERROR: AddressSanitizer: heap-use-after-free on address 0x6160000acba4 at pc 0x55910c5694d0 bp 0x7ffe3a8ac850 sp 0x7ffe3a8ac840
> READ of size 4 at 0x6160000acba4 thread T0
>         #0 0x55910c5694cf in ctx_info_from_zns zebra/zebra_dplane.c:3315
>     #1 0x55910c569696 in dplane_ctx_ns_init zebra/zebra_dplane.c:3331
>     #2 0x55910c56bf61 in dplane_ctx_nexthop_init zebra/zebra_dplane.c:3680
>     #3 0x55910c5711ca in dplane_nexthop_update_internal zebra/zebra_dplane.c:4490
>     FRRouting#4 0x55910c571c5c in dplane_nexthop_delete zebra/zebra_dplane.c:4717
>     FRRouting#5 0x55910c61e90e in zebra_nhg_uninstall_kernel zebra/zebra_nhg.c:3413
>     FRRouting#6 0x55910c615d8a in zebra_nhg_decrement_ref zebra/zebra_nhg.c:1919
>     FRRouting#7 0x55910c6404db in route_entry_update_nhe zebra/zebra_rib.c:454
>     FRRouting#8 0x55910c64c904 in rib_re_nhg_free zebra/zebra_rib.c:2822
>     FRRouting#9 0x55910c655be2 in rib_unlink zebra/zebra_rib.c:4212
>     FRRouting#10 0x55910c6430f9 in zebra_rtable_node_cleanup zebra/zebra_rib.c:968
>     FRRouting#11 0x7f26f275b8a9 in route_node_free lib/table.c:75
>     FRRouting#12 0x7f26f275bae4 in route_table_free lib/table.c:111
>     FRRouting#13 0x7f26f275b749 in route_table_finish lib/table.c:46
>     FRRouting#14 0x55910c65db17 in zebra_router_free_table zebra/zebra_router.c:191
>     FRRouting#15 0x55910c65dfb5 in zebra_router_terminate zebra/zebra_router.c:244
>     FRRouting#16 0x55910c4f40db in zebra_finalize zebra/main.c:249
>     FRRouting#17 0x7f26f2777108 in event_call lib/event.c:2011
>     FRRouting#18 0x7f26f264180e in frr_run lib/libfrr.c:1212
>     FRRouting#19 0x55910c4f49cb in main zebra/main.c:531
>     FRRouting#20 0x7f26f2029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
>     FRRouting#21 0x7f26f2029e3f in __libc_start_main_impl ../csu/libc-start.c:392
>     FRRouting#22 0x55910c4b0114 in _start (/usr/lib/frr/zebra+0x1ae114)

It happens with FRR using the kernel. During shutdown, the
namespace identifier is attempted to be obtained by zebra, in an
attempt to prepare zebra dataplane nexthop messages.

Fix this by accessing the ns structure.

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
  • Loading branch information
pguibert6WIND authored and louis-6wind committed Oct 9, 2024
1 parent c8e6bac commit 40516f6
Show file tree
Hide file tree
Showing 3 changed files with 22 additions and 4 deletions.
4 changes: 3 additions & 1 deletion zebra/main.c
Original file line number Diff line number Diff line change
Expand Up @@ -238,7 +238,7 @@ void zebra_finalize(struct event *dummy)
zebra_ns_notify_close();

/* Final shutdown of ns resources */
ns_walk_func(zebra_ns_final_shutdown, NULL, NULL);
ns_walk_func(zebra_ns_kernel_shutdown, NULL, NULL);

zebra_rib_terminate();
zebra_router_terminate();
Expand All @@ -251,6 +251,8 @@ void zebra_finalize(struct event *dummy)

label_manager_terminate();

ns_walk_func(zebra_ns_final_shutdown, NULL, NULL);

ns_terminate();
frr_fini();
exit(0);
Expand Down
20 changes: 17 additions & 3 deletions zebra/zebra_ns.c
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,22 @@ int zebra_ns_early_shutdown(struct ns *ns,
return NS_WALK_CONTINUE;
}

/* During zebra shutdown, do kernel cleanup
* netlink sockets, ..
*/
int zebra_ns_kernel_shutdown(struct ns *ns, void *param_in __attribute__((unused)),
void **param_out __attribute__((unused)))
{
struct zebra_ns *zns = ns->info;

if (zns == NULL)
return NS_WALK_CONTINUE;

kernel_terminate(zns, true);

return NS_WALK_CONTINUE;
}

/* During zebra shutdown, do final cleanup
* after all dataplane work is complete.
*/
Expand All @@ -185,9 +201,7 @@ int zebra_ns_final_shutdown(struct ns *ns,
struct zebra_ns *zns = ns->info;

if (zns == NULL)
return 0;

kernel_terminate(zns, true);
return NS_WALK_CONTINUE;

zebra_ns_delete(ns);

Expand Down
2 changes: 2 additions & 0 deletions zebra/zebra_ns.h
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,8 @@ int zebra_ns_early_shutdown(struct ns *ns,
int zebra_ns_final_shutdown(struct ns *ns,
void *param_in __attribute__((unused)),
void **param_out __attribute__((unused)));
int zebra_ns_kernel_shutdown(struct ns *ns, void *param_in __attribute__((unused)),
void **param_out __attribute__((unused)));

void zebra_ns_startup_continue(struct zebra_dplane_ctx *ctx);

Expand Down

0 comments on commit 40516f6

Please sign in to comment.