Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bgpd: fix memory type for static->prd_pretty #16585

Merged
merged 1 commit into from
Aug 15, 2024

Conversation

pguibert6WIND
Copy link
Member

A crash happens when executing the following command:

ubuntu2204hwe# conf
ubuntu2204hwe(config)# router bgp 65500
ubuntu2204hwe(config-router)# !
ubuntu2204hwe(config-router)# address-family ipv4 unicast
ubuntu2204hwe(config-router-af)# sid vpn export auto
ubuntu2204hwe(config-router-af)# exit-address-family
ubuntu2204hwe(config-router)# !
ubuntu2204hwe(config-router)# address-family ipv4 vpn
ubuntu2204hwe(config-router-af)# network 4.4.4.4/32 rd 55:55 label 556
ubuntu2204hwe(config-router-af)# network 5.5.5.5/32 rd 662:33 label 232
ubuntu2204hwe(config-router-af)# exit-address-family
ubuntu2204hwe(config-router)# exit
ubuntu2204hwe(config)# !
ubuntu2204hwe(config)# no router bgp

The crash analysis indicates a memory item has been freed.

#6 0x000076066a629c15 in mt_count_free (mt=0x56b57be85e00 <MTYPE_BGP_NAME>, ptr=0x60200038b4f0)
at lib/memory.c:73
#7 mt_count_free (ptr=0x60200038b4f0, mt=0x56b57be85e00 <MTYPE_BGP_NAME>) at lib/memory.c:69
#8 qfree (mt=mt@entry=0x56b57be85e00 <MTYPE_BGP_NAME>, ptr=0x60200038b4f0) at lib/memory.c:129
#9 0x000056b57bb09ce9 in bgp_free (bgp=) at bgpd/bgpd.c:4120
#10 0x000056b57bb0aa73 in bgp_unlock (bgp=) at ./bgpd/bgpd.h:2513
#11 peer_free (peer=0x62a000000200) at bgpd/bgpd.c:1313
#12 0x000056b57bb0aca8 in peer_unlock_with_caller (name=, peer=)
at bgpd/bgpd.c:1344
#13 0x000076066a6dbb2c in event_call (thread=thread@entry=0x7ffc8cae1d60) at lib/event.c:2011
#14 0x000076066a60aa88 in frr_run (master=0x613000000040) at lib/libfrr.c:1214
#15 0x000056b57b8b2c44 in main (argc=, argv=) at bgpd/bgp_main.c:543

Actually, the BGP_NAME item has not been used at allocation for static->prd_pretty, and this results in reaching 0 quicker at bgp deletion.

Fix this by reassigning MTYPE_BGP_NAME to prd_pretty.

Fixes: 16600df ("bgpd: fix show run of network route-distinguisher")

A crash happens when executing the following command:

> ubuntu2204hwe# conf
> ubuntu2204hwe(config)# router bgp 65500
> ubuntu2204hwe(config-router)#  !
> ubuntu2204hwe(config-router)#  address-family ipv4 unicast
> ubuntu2204hwe(config-router-af)#   sid vpn export auto
> ubuntu2204hwe(config-router-af)#  exit-address-family
> ubuntu2204hwe(config-router)#  !
> ubuntu2204hwe(config-router)#  address-family ipv4 vpn
> ubuntu2204hwe(config-router-af)#   network 4.4.4.4/32 rd 55:55 label 556
> ubuntu2204hwe(config-router-af)#   network 5.5.5.5/32 rd 662:33 label 232
> ubuntu2204hwe(config-router-af)#  exit-address-family
> ubuntu2204hwe(config-router)# exit
> ubuntu2204hwe(config)# !
> ubuntu2204hwe(config)# no router bgp

The crash analysis indicates a memory item has been freed.

> FRRouting#6  0x000076066a629c15 in mt_count_free (mt=0x56b57be85e00 <MTYPE_BGP_NAME>, ptr=0x60200038b4f0)
>     at lib/memory.c:73
> FRRouting#7  mt_count_free (ptr=0x60200038b4f0, mt=0x56b57be85e00 <MTYPE_BGP_NAME>) at lib/memory.c:69
> FRRouting#8  qfree (mt=mt@entry=0x56b57be85e00 <MTYPE_BGP_NAME>, ptr=0x60200038b4f0) at lib/memory.c:129
> FRRouting#9  0x000056b57bb09ce9 in bgp_free (bgp=<optimized out>) at bgpd/bgpd.c:4120
> FRRouting#10 0x000056b57bb0aa73 in bgp_unlock (bgp=<optimized out>) at ./bgpd/bgpd.h:2513
> FRRouting#11 peer_free (peer=0x62a000000200) at bgpd/bgpd.c:1313
> FRRouting#12 0x000056b57bb0aca8 in peer_unlock_with_caller (name=<optimized out>, peer=<optimized out>)
>     at bgpd/bgpd.c:1344
> FRRouting#13 0x000076066a6dbb2c in event_call (thread=thread@entry=0x7ffc8cae1d60) at lib/event.c:2011
> FRRouting#14 0x000076066a60aa88 in frr_run (master=0x613000000040) at lib/libfrr.c:1214
> FRRouting#15 0x000056b57b8b2c44 in main (argc=<optimized out>, argv=<optimized out>) at bgpd/bgp_main.c:543

Actually, the BGP_NAME item has not been used at allocation for
static->prd_pretty, and this results in reaching 0 quicker at bgp
deletion.

Fix this by reassigning MTYPE_BGP_NAME to prd_pretty.

Fixes: 16600df ("bgpd: fix show run of network route-distinguisher")

Signed-off-by: Philippe Guibert <[email protected]>
@ton31337
Copy link
Member

@Mergifyio backport stable/10.1

Copy link

mergify bot commented Aug 14, 2024

backport stable/10.1

✅ Backports have been created

@ton31337 ton31337 merged commit 4f70004 into FRRouting:master Aug 15, 2024
16 checks passed
donaldsharp added a commit that referenced this pull request Aug 15, 2024
bgpd: fix memory type for static->prd_pretty (backport #16585)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants