forked from Mirror/frr
6037ea350c
When the user modifies an SRv6 SID and then removes all SIDs, staticd crashes: ``` 2025/03/23 08:37:22.691860 STATIC: lib/memory.c:74: mt_count_free(): assertion (mt->n_alloc) failed STATIC: Received signal 6 at 1742715442 (si_addr 0x8200007cf0); aborting... STATIC: zlog_signal+0x390 fcc704a844b8 ffffd7450390 /usr/lib/frr/libfrr.so.0 (mapped at 0xfcc704800000) STATIC: core_handler+0x1f8 fcc704b79990 ffffd7450590 /usr/lib/frr/libfrr.so.0 (mapped at 0xfcc704800000) STATIC: ---- signal ---- STATIC: ? fcc705c008f8 ffffd74507a0 linux-vdso.so.1 (mapped at 0xfcc705c00000) STATIC: pthread_key_delete+0x1a0 fcc70458f1f0 ffffd7451a00 /lib/aarch64-linux-gnu/libc.so.6 (mapped at 0xfcc704510000) STATIC: raise+0x1c fcc70454a67c ffffd7451ad0 /lib/aarch64-linux-gnu/libc.so.6 (mapped at 0xfcc704510000) STATIC: abort+0xe4 fcc704537130 ffffd7451af0 /lib/aarch64-linux-gnu/libc.so.6 (mapped at 0xfcc704510000) STATIC: _zlog_assert_failed+0x3c4 fcc704c407c8 ffffd7451c40 /usr/lib/frr/libfrr.so.0 (mapped at 0xfcc704800000) STATIC: mt_count_free+0x12c fcc704a93c74 ffffd7451dc0 /usr/lib/frr/libfrr.so.0 (mapped at 0xfcc704800000) STATIC: qfree+0x28 fcc704a93fa0 ffffd7451e70 /usr/lib/frr/libfrr.so.0 (mapped at 0xfcc704800000) STATIC: static_srv6_sid_free+0x1c adc1df8fa544 ffffd7451e90 /usr/lib/frr/staticd (mapped at 0xadc1df8a0000) STATIC: delete_static_srv6_sid+0x14 adc1df8faafc ffffd7451eb0 /usr/lib/frr/staticd (mapped at 0xadc1df8a0000) STATIC: list_delete_all_node+0x104 fcc704a60eec ffffd7451ed0 /usr/lib/frr/libfrr.so.0 (mapped at 0xfcc704800000) STATIC: list_delete+0x8c fcc704a61054 ffffd7451f00 /usr/lib/frr/libfrr.so.0 (mapped at 0xfcc704800000) STATIC: static_srv6_cleanup+0x20 adc1df8fabdc ffffd7451f20 /usr/lib/frr/staticd (mapped at 0xadc1df8a0000) STATIC: sigint+0x40 adc1df8be544 ffffd7451f30 /usr/lib/frr/staticd (mapped at 0xadc1df8a0000) STATIC: frr_sigevent_process+0x148 fcc704b79460 ffffd7451f40 /usr/lib/frr/libfrr.so.0 (mapped at 0xfcc704800000) STATIC: event_fetch+0x1c4 fcc704bc0834 ffffd7451f60 /usr/lib/frr/libfrr.so.0 (mapped at 0xfcc704800000) STATIC: frr_run+0x650 fcc704a5d230 ffffd7452080 /usr/lib/frr/libfrr.so.0 (mapped at 0xfcc704800000) STATIC: main+0x1d0 adc1df8be75c ffffd7452270 /usr/lib/frr/staticd (mapped at 0xadc1df8a0000) STATIC: __libc_init_first+0x7c fcc7045373fc ffffd74522b0 /lib/aarch64-linux-gnu/libc.so.6 (mapped at 0xfcc704510000) STATIC: __libc_start_main+0x98 fcc7045374cc ffffd74523c0 /lib/aarch64-linux-gnu/libc.so.6 (mapped at 0xfcc704510000) STATIC: _start+0x30 adc1df8be0f0 ffffd7452420 /usr/lib/frr/staticd (mapped at 0xadc1df8a0000) ``` Tracking this down, the crash occurs because every time we modify a SID, staticd executes some callbacks to modify the SID and finally it calls `apply_finish`, which re-adds the SID to the list `srv6_sids`. This leads to having the same SID multiple times in the `srv6_sids` list. When we delete all SIDs, staticd attempts to deallocate the same SID multiple times, which leads to the crash. This commit fixes the issue by moving the code that adds the SID to the list from the `apply_finish` callback to the `create` callback. This ensures that the SID is inserted into the list only once, when it is created. For all subsequent modifications, the SID is modified but not added to the list. Signed-off-by: Carmine Scarpitta <cscarpit@cisco.com> |
||
|---|---|---|
| .github | ||
| alpine | ||
| babeld | ||
| bfdd | ||
| bgpd | ||
| debian | ||
| doc | ||
| docker | ||
| eigrpd | ||
| fpm | ||
| gdb | ||
| grpc | ||
| include | ||
| isisd | ||
| ldpd | ||
| lib | ||
| m4 | ||
| mgmtd | ||
| mlag | ||
| nhrpd | ||
| ospf6d | ||
| ospfclient | ||
| ospfd | ||
| pathd | ||
| pbrd | ||
| pceplib | ||
| pimd | ||
| pkgsrc | ||
| python | ||
| qpb | ||
| redhat | ||
| ripd | ||
| ripngd | ||
| sharpd | ||
| snapcraft | ||
| staticd | ||
| tests | ||
| tools | ||
| vrrpd | ||
| vtysh | ||
| watchfrr | ||
| yang | ||
| zebra | ||
| .clang-format | ||
| .dockerignore | ||
| .flake8 | ||
| .git-blame-ignore-revs | ||
| .gitignore | ||
| .isort.cfg | ||
| .pylintrc | ||
| .travis.yml | ||
| bootstrap.sh | ||
| buildtest.sh | ||
| config.version.in | ||
| configure.ac | ||
| COPYING | ||
| Makefile.am | ||
| README.md | ||
| stamp-h.in | ||
| version.h | ||
FRRouting
FRR is free software that implements and manages various IPv4 and IPv6 routing protocols. It runs on nearly all distributions of Linux and BSD and supports all modern CPU architectures.
FRR currently supports the following protocols:
- BGP
- OSPFv2
- OSPFv3
- RIPv1
- RIPv2
- RIPng
- IS-IS
- PIM-SM/MSDP
- LDP
- BFD
- Babel
- PBR
- OpenFabric
- VRRP
- EIGRP (alpha)
- NHRP (alpha)
Installation & Use
For source tarballs, see the releases page.
For Debian and its derivatives, use the APT repository at https://deb.frrouting.org/.
Instructions on building and installing from source for supported platforms may be found in the developer docs.
Once installed, please refer to the user guide for instructions on use.
Community
The FRRouting email list server is located here and offers the following public lists:
| Topic | List |
|---|---|
| Development | dev@lists.frrouting.org |
| Users & Operators | frog@lists.frrouting.org |
| Announcements | announce@lists.frrouting.org |
For chat, we currently use Slack. You can join by clicking the "Slack" link under the Participate section of our website.
Contributing
FRR maintains developer's documentation which contains the project workflow and expectations for contributors. Some technical documentation on project internals is also available.
We welcome and appreciate all contributions, no matter how small!
Security
To report security issues, please use our security mailing list:
security [at] lists.frrouting.org