From e04704c3a913f3e45f11d49fc9ee5f0f549b5307 Mon Sep 17 00:00:00 2001 From: Louis Scalbert Date: Tue, 18 Oct 2022 14:23:14 +0200 Subject: [PATCH] isisd: fix crash when a sys-id a configured after a flex-algo definition A isisd crash happens when the IS-IS system-id is defined after a flex-algo definition and before IS-IS segment-routing. After the isisd startup, do: > router isis 1 > is-type level-1 > flex-algo 128 > advertise-definition > dataplane sr-mpls > affinity include-all blue green > net 49.0000.0000.0000.1000.00 It causes this crash: > #0 raise (sig=) at ../sysdeps/unix/sysv/linux/raise.c:50 > #1 0x00007fb9403c2ac4 in core_handler (signo=6, siginfo=0x7ffd6a538130, context=0x7ffd6a538000) at /build/tools-build-framework/output/_packages/cp-routing/src/lib/sigevent.c:262 > #2 > #3 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 > #4 0x00007fb9400c0859 in __GI_abort () at abort.c:79 > #5 0x00007fb940400608 in _zlog_assert_failed ( xref=0x559ed6e3baa0 <_xref.21401>, extra=0x0) at /build/tools-build-framework/output/_packages/cp-routing/src/lib/zlog.c:557 > #6 0x0000559ed6d8191e in copy_tlv_router_cap (router_cap=0x559ed7d7b8b0) at /build/tools-build-framework/output/_packages/cp-routing/src/isisd/isis_tlvs.c:3681 > #7 0x0000559ed6d86133 in pack_tlvs (tlvs=0x559ed7d7b4f0, stream=0x559ed7d7c1e0, fragment_tlvs=0x559ed7d7c7d0, new_fragment=0x559ed6d863ab , new_fragment_arg=0x559ed7d70c50) at /build/tools-build-framework/output/_packages/cp-routing/src/isisd/isis_tlvs.c:5393 > #8 0x0000559ed6d8644b in isis_fragment_tlvs (tlvs=0x559ed7d7b4f0, size=1470) at /build/tools-build-framework/output/_packages/cp-routing/src/isisd/isis_tlvs.c:5476 > #9 0x0000559ed6d4b014 in lsp_build (lsp=0x559ed7d7adb0, area=0x559ed7d40a40) at /build/tools-build-framework/output/_packages/cp-routing/src/isisd/isis_lsp.c:1361 > #10 0x0000559ed6d4b496 in lsp_generate (area=0x559ed7d40a40, level=1) at /build/tools-build-framework/output/_packages/cp-routing/src/isisd/isis_lsp.c:1434 > #11 0x0000559ed6d9fee5 in isis_instance_area_address_create ( args=0x7ffd6a54fe70) at /build/tools-build-framework/output/_packages/cp-routing/src/isisd/isis_nb_config.c:229 > #12 0x00007fb940393e1f in nb_callback_create (context=0x7ffd6a550480, nb_node=0x559ed7b8ad70, event=NB_EV_APPLY, dnode=0x559ed7d54e20, resource=0x559ed7d7aa28, errmsg=0x7ffd6a550490 "", errmsg_len=8192) at /build/tools-build-framework/output/_packages/cp-routing/src/lib/northbound.c:1035 isis_lsp_set_router_capability_fad() only sets cap_fad[fa->algorithm] when segment-routing is enabled. cap_fad[fa->algorithm] admin-group data pointers are not allocated when segment-routing is off. However, when setting the flex-algo definition into router capabilities, cap_fad[fa->algorithm] is copied. Flex-algo definitions are set even segment-routing is not set (which complies with the flex-algo IETF draft). When copying the router capability later, a crash happens because a admin-group pointer is NULL. Set cap_fad[fa->algorithm] even if segment-routing is off. Fixes: 93b0b7fc84 ("isisd: add isis flex-algo lsp advertisement") Signed-off-by: Louis Scalbert --- isisd/isis_lsp.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/isisd/isis_lsp.c b/isisd/isis_lsp.c index 45b6dab58cfb..e9eb44c4e743 100644 --- a/isisd/isis_lsp.c +++ b/isisd/isis_lsp.c @@ -1117,6 +1117,14 @@ static void lsp_build(struct isis_lsp *lsp, struct isis_area *area) cap.router_id.s_addr = area->isis->router_id; + for (ALL_LIST_ELEMENTS_RO(area->flex_algos->flex_algos, node, + fa)) { + if (!fa->advertise_definition) + continue; + isis_lsp_set_router_capability_fad( + area, &cap_fad[fa->algorithm], fa); + } + /* Add SR Sub-TLVs if SR is enabled. */ if (area->srdb.enabled) { struct isis_sr_db *srdb = &area->srdb; @@ -1135,9 +1143,6 @@ static void lsp_build(struct isis_lsp *lsp, struct isis_area *area) for (ALL_LIST_ELEMENTS_RO(area->flex_algos->flex_algos, node, fa)) { if (fa->advertise_definition) { - isis_lsp_set_router_capability_fad( - area, &cap_fad[fa->algorithm], - fa); rcap_fad = &cap_fad[fa->algorithm]; } else rcap_fad = NULL;