mirror of
https://github.com/FRRouting/frr.git
synced 2025-04-30 13:37:17 +02:00
![]() A heap use after free when enabling bmp mirror on a non connected BMP
target.
> Apr 22 14:06:49 vRR-DUT systemd[1]: Started bfdd.
> Apr 22 14:06:51 vRR-DUT bgpd[1522]: [VTCF0-ZHP6C] bmp: missing TX OPEN message for peer Static announcement
> Apr 22 14:06:51 vRR-DUT bgpd[1522]: [K3RM9-4A4HY] bmp: missing RX OPEN message for peer Static announcement
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: =================================================================
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: ==1522==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f0000321d0 at pc 0x7fe7f11c548e bp 0x7fff49f80d40 sp 0x7fff49f80d30
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: READ of size 8 at 0x60f0000321d0 thread T0
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #0 0x7fe7f11c548d in typesafe_list_add /build/make-pkg/output/_packages/cp-routing/src/lib/typesafe.h:161
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #1 0x7fe7f11c9347 in bmp_mirrorq_add_tail /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_bmp.c:116
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #2 0x7fe7f11d030f in bmp_mirror_packet /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_bmp.c:867
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #3 0x55c756de3e20 in hook_call_bgp_packet_dump /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_packet.c:55
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #4 0x55c756dfd5ea in bgp_process_packet /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_packet.c:3699
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #5 0x7fe7f5375237 in event_call (/lib/x86_64-linux-gnu/libfrr.so.0+0x375237)
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #6 0x7fe7f5242ecf in frr_run (/lib/x86_64-linux-gnu/libfrr.so.0+0x242ecf)
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #7 0x55c756c71804 in main /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_main.c:545
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #8 0x7fe7f4c29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #9 0x7fe7f4c29e3f in __libc_start_main_impl ../csu/libc-start.c:392
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #10 0x55c756c6e384 in _start (/usr/bin/bgpd+0x272384)
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: 0x60f0000321d0 is located 0 bytes inside of 162-byte region [0x60f0000321d0,0x60f000032272)
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: freed by thread T0 here:
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #0 0x7fe7f58b4537 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #1 0x7fe7f526f918 in qfree (/lib/x86_64-linux-gnu/libfrr.so.0+0x26f918)
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #2 0x7fe7f11d057b in bmp_mirror_packet /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_bmp.c:875
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #3 0x55c756de3e20 in hook_call_bgp_packet_dump /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_packet.c:55
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #4 0x55c756dfd5ea in bgp_process_packet /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_packet.c:3699
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #5 0x7fe7f5375237 in event_call (/lib/x86_64-linux-gnu/libfrr.so.0+0x375237)
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #6 0x7fe7f5242ecf in frr_run (/lib/x86_64-linux-gnu/libfrr.so.0+0x242ecf)
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #7 0x55c756c71804 in main /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_main.c:545
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #8 0x7fe7f4c29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: previously allocated by thread T0 here:
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #0 0x7fe7f58b4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #1 0x7fe7f526f7c6 in qcalloc (/lib/x86_64-linux-gnu/libfrr.so.0+0x26f7c6)
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #2 0x7fe7f11cfd38 in bmp_mirror_packet /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_bmp.c:835
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #3 0x55c756de3e20 in hook_call_bgp_packet_dump /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_packet.c:55
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #4 0x55c756dfd5ea in bgp_process_packet /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_packet.c:3699
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #5 0x7fe7f5375237 in event_call (/lib/x86_64-linux-gnu/libfrr.so.0+0x375237)
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #6 0x7fe7f5242ecf in frr_run (/lib/x86_64-linux-gnu/libfrr.so.0+0x242ecf)
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #7 0x55c756c71804 in main /build/make-pkg/output/_packages/cp-routing/src/bgpd/bgp_main.c:545
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: #8 0x7fe7f4c29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: SUMMARY: AddressSanitizer: heap-use-after-free /build/make-pkg/output/_packages/cp-routing/src/lib/typesafe.h:161 in typesafe_list_add
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Shadow bytes around the buggy address:
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: 0x0c1e7fffe3e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: 0x0c1e7fffe3f0: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa 00 00
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: 0x0c1e7fffe400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: 0x0c1e7fffe410: 00 00 00 00 fa fa fa fa fa fa fa fa 00 00 00 00
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: 0x0c1e7fffe420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: =>0x0c1e7fffe430: 00 fa fa fa fa fa fa fa fa fa[fd]fd fd fd fd fd
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: 0x0c1e7fffe440: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: 0x0c1e7fffe450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: 0x0c1e7fffe460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: 0x0c1e7fffe470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: 0x0c1e7fffe480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Shadow byte legend (one shadow byte represents 8 application bytes):
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Addressable: 00
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Partially addressable: 01 02 03 04 05 06 07
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Heap left redzone: fa
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Freed heap region: fd
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Stack left redzone: f1
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Stack mid redzone: f2
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Stack right redzone: f3
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Stack after return: f5
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Stack use after scope: f8
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Global redzone: f9
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Global init order: f6
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Poisoned by user: f7
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Container overflow: fc
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Array cookie: ac
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Intra object redzone: bb
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: ASan internal: fe
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Left alloca redzone: ca
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Right alloca redzone: cb
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: Shadow gap: cc
> Apr 22 14:06:52 vRR-DUT bgpd[1522]: ==1522==ABORTING
> Apr 22 14:06:52 vRR-DUT yams[449]: CONFIG: [{'name': 'ttyS0'}]
> Apr 22 14:06:52 vRR-DUT zebra[652]: [GE156-FS0MJ][EC 100663299] stream_read_try: read failed on fd 50: Connection reset by peer
> Apr 22 14:06:52 vRR-DUT systemd[1]: bgpd.service: Main process exited, code=exited, status=1/FAILURE
> Apr 22 14:06:52 vRR-DUT zebra[652]: [GE156-FS0MJ][EC 100663299] stream_read_try: read failed on fd 39: Connection reset by peer
> Apr 22 14:06:52 vRR-DUT systemd[1]: bgpd.service: Failed with result 'exit-code'.
> Apr 22 14:06:52 vRR-DUT zebra[652]: [N5M5Y-J5BPG][EC 4043309121] Client 'bgp' (session id 0) encountered an error and is shutting down.
> Apr 22 14:06:52 vRR-DUT systemd[1]: bgpd.service: Consumed 2.361s CPU time.
> Apr 22 14:06:52 vRR-DUT zebra[652]: [N5M5Y-J5BPG][EC 4043309121] Client 'bgp' (session id 1) encountered an error and is shutting down.
> Apr 22 14:06:52 vRR-DUT zebra[652]: [JPSA8-5KYEA] client 39 disconnected 0 bgp routes removed from the rib
> Apr 22 14:06:52 vRR-DUT zebra[652]: [S929C-NZR3N] client 39 disconnected 0 bgp nhgs removed from the rib
> Apr 22 14:06:52 vRR-DUT zebra[652]: [KQB7H-NPVW9] /build/make-pkg/output/_packages/cp-routing/src/zebra/zebra_ptm.c:1285 failed to find process pid registration
> Apr 22 14:06:52 vRR-DUT zebra[652]: [JPSA8-5KYEA] client 50 disconnected 0 bgp routes removed from the rib
> Apr 22 14:06:52 vRR-DUT zebra[652]: [S929C-NZR3N] client 50 disconnected 0 bgp nhgs removed from the rib
>
Do not enqueue item in the mirror queue if no reference count has been
found in the connection list.
Fixes:
|
||
---|---|---|
.. | ||
rfapi | ||
rfp-example | ||
.gitignore | ||
bgp_addpath.c | ||
bgp_addpath.h | ||
bgp_addpath_types.h | ||
bgp_advertise.c | ||
bgp_advertise.h | ||
bgp_aspath.c | ||
bgp_aspath.h | ||
bgp_attr.c | ||
bgp_attr.h | ||
bgp_attr_evpn.c | ||
bgp_attr_evpn.h | ||
bgp_bfd.c | ||
bgp_bfd.h | ||
bgp_bmp.c | ||
bgp_bmp.h | ||
bgp_btoa.c | ||
bgp_clist.c | ||
bgp_clist.h | ||
bgp_community.c | ||
bgp_community.h | ||
bgp_community_alias.c | ||
bgp_community_alias.h | ||
bgp_conditional_adv.c | ||
bgp_conditional_adv.h | ||
bgp_damp.c | ||
bgp_damp.h | ||
bgp_debug.c | ||
bgp_debug.h | ||
bgp_dump.c | ||
bgp_dump.h | ||
bgp_ecommunity.c | ||
bgp_ecommunity.h | ||
bgp_encap_tlv.c | ||
bgp_encap_tlv.h | ||
bgp_encap_types.h | ||
bgp_errors.c | ||
bgp_errors.h | ||
bgp_evpn.c | ||
bgp_evpn.h | ||
bgp_evpn_mh.c | ||
bgp_evpn_mh.h | ||
bgp_evpn_private.h | ||
bgp_evpn_vty.c | ||
bgp_evpn_vty.h | ||
bgp_filter.c | ||
bgp_filter.h | ||
bgp_flowspec.c | ||
bgp_flowspec.h | ||
bgp_flowspec_private.h | ||
bgp_flowspec_util.c | ||
bgp_flowspec_util.h | ||
bgp_flowspec_vty.c | ||
bgp_fsm.c | ||
bgp_fsm.h | ||
bgp_io.c | ||
bgp_io.h | ||
bgp_keepalives.c | ||
bgp_keepalives.h | ||
bgp_label.c | ||
bgp_label.h | ||
bgp_labelpool.c | ||
bgp_labelpool.h | ||
bgp_lcommunity.c | ||
bgp_lcommunity.h | ||
bgp_mac.c | ||
bgp_mac.h | ||
bgp_main.c | ||
bgp_memory.c | ||
bgp_memory.h | ||
bgp_mpath.c | ||
bgp_mpath.h | ||
bgp_mplsvpn.c | ||
bgp_mplsvpn.h | ||
bgp_mplsvpn_snmp.c | ||
bgp_mplsvpn_snmp.h | ||
bgp_network.c | ||
bgp_network.h | ||
bgp_nexthop.c | ||
bgp_nexthop.h | ||
bgp_nhg.c | ||
bgp_nhg.h | ||
bgp_nht.c | ||
bgp_nht.h | ||
bgp_open.c | ||
bgp_open.h | ||
bgp_packet.c | ||
bgp_packet.h | ||
bgp_pbr.c | ||
bgp_pbr.h | ||
bgp_rd.c | ||
bgp_rd.h | ||
bgp_regex.c | ||
bgp_regex.h | ||
bgp_route.c | ||
bgp_route.h | ||
bgp_routemap.c | ||
bgp_routemap_nb.c | ||
bgp_routemap_nb.h | ||
bgp_routemap_nb_config.c | ||
bgp_rpki.c | ||
bgp_rpki.h | ||
bgp_script.c | ||
bgp_script.h | ||
bgp_snmp.c | ||
bgp_snmp.h | ||
bgp_snmp_bgp4.c | ||
bgp_snmp_bgp4.h | ||
bgp_snmp_bgp4v2.c | ||
bgp_snmp_bgp4v2.h | ||
bgp_table.c | ||
bgp_table.h | ||
bgp_trace.c | ||
bgp_trace.h | ||
bgp_updgrp.c | ||
bgp_updgrp.h | ||
bgp_updgrp_adv.c | ||
bgp_updgrp_packet.c | ||
bgp_vnc_types.h | ||
bgp_vpn.c | ||
bgp_vpn.h | ||
bgp_vty.c | ||
bgp_vty.h | ||
bgp_zebra.c | ||
bgp_zebra.h | ||
bgpd.c | ||
bgpd.h | ||
Makefile | ||
subdir.am |