pimd: fix heap-use-after-free issue in igmp_source_delete() #14215
Conversation
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDTest incomplete. See below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: IncompleteAddresssanitizer topotests part 4: Incomplete(check logs for details)Successful on other platforms/tests
|
|
ci:rerun |
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDTest incomplete. See below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: IncompleteAddresssanitizer topotests part 4: Incomplete(check logs for details)Topotests debian 10 amd64 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9DEB10AMD64-13559/test Topology Tests failed for Topotests debian 10 amd64 part 9 Topotests Ubuntu 18.04 arm8 part 8: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 8: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-13559/artifact/TOPO8U18AMD64/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 8: No useful log foundSuccessful on other platforms/tests
|
|
ci:rerun to understand the pim failure |
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDSee below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: FailedTopotests Ubuntu 18.04 arm8 part 7: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 7: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-13562/artifact/TOPO7U18ARM8/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 7: No useful log foundSuccessful on other platforms/tests
|
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDTest incomplete. See below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: IncompleteTopotests debian 10 amd64 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9DEB10AMD64-13561/test Topology Tests failed for Topotests debian 10 amd64 part 9 Addresssanitizer topotests part 4: Incomplete(check logs for details)Topotests Ubuntu 18.04 i386 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9U18I386-13561/test Topology Tests failed for Topotests Ubuntu 18.04 i386 part 9 Topotests Ubuntu 18.04 arm8 part 8: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 8: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-13561/artifact/TOPO8U18AMD64/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 8: No useful log foundSuccessful on other platforms/tests
|
|
Investigating multicast failure https://ci1.netdef.org/browse/FRR-PULLREQ2-13561/ |
|
@Mergifyio backport stable/9.0 |
🟠 Waiting for conditions to match
|
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDSee below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: FailedTopotests debian 10 amd64 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9DEB10AMD64-13567/test Topology Tests failed for Topotests debian 10 amd64 part 9 Topotests Ubuntu 18.04 arm8 part 1: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 1: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-13567/artifact/TOPO1U18ARM8/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 1: No useful log foundSuccessful on other platforms/tests
|
Continuous Integration Result: SUCCESSFULContinuous Integration Result: SUCCESSFULCongratulations, this patch passed basic tests Tested-by: NetDEF / OpenSourceRouting.org CI System CI System Testrun URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-13567/ This is a comment from an automated CI system. |
please update once the investigation is complete. |
|
ci:rerun |
The failure are not related to the changes. |
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDTest incomplete. See below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: IncompleteAddresssanitizer topotests part 4: Incomplete(check logs for details)Successful on other platforms/tests
|
|
ci:rerun |
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDTest incomplete. See below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: IncompleteTopotests Ubuntu 18.04 i386 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9U18I386-13881/test Topology Tests failed for Topotests Ubuntu 18.04 i386 part 9 Topotests Ubuntu 18.04 arm8 part 8: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 8: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-13881/artifact/TOPO8U18AMD64/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 8: No useful log foundAddresssanitizer topotests part 0: Incomplete(check logs for details)Topotests Ubuntu 18.04 arm8 part 9: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 9: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-13881/artifact/TOPO9U18ARM8/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 9: No useful log foundAddresssanitizer topotests part 4: Incomplete(check logs for details)Successful on other platforms/tests
|
|
There is a bug already present for the multicast failure https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO8U18AMD64-13561/test/case/150661601 ci:rerun |
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDSee below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: FailedTopotests Ubuntu 18.04 arm8 part 6: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 6: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-13889/artifact/TOPO6U18ARM8/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 6: No useful log foundTopotests debian 10 amd64 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9DEB10AMD64-13889/test Topology Tests failed for Topotests debian 10 amd64 part 9 Successful on other platforms/tests
|
|
bgp, ospf failure. |
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDSee below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: FailedTopotests Ubuntu 18.04 arm8 part 6: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 6: No useful log foundTopotests Ubuntu 18.04 arm8 part 9: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 9: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-13900/artifact/TOPO9U18ARM8/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 9: No useful log foundSuccessful on other platforms/tests
CLANG Static Analyzer Summary
1 Static Analyzer issues remaining.See details at |
|
ospf failure |
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDTest incomplete. See below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: IncompleteAddresssanitizer topotests part 7: Incomplete(check logs for details)Addresssanitizer topotests part 4: Incomplete(check logs for details)Successful on other platforms/tests
|
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDTest incomplete. See below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: IncompleteTopotests Ubuntu 18.04 i386 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9U18I386-13923/test Topology Tests failed for Topotests Ubuntu 18.04 i386 part 9 Topotests Ubuntu 18.04 arm8 part 6: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 6: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-13923/artifact/TOPO6U18ARM8/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 6: No useful log foundAddresssanitizer topotests part 4: Incomplete(check logs for details)Successful on other platforms/tests
|
|
bgp, ospf failure. |
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDTest incomplete. See below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: IncompleteAddresssanitizer topotests part 4: Incomplete(check logs for details)Successful on other platforms/tests
|
|
No multicast failure.
ci:rerun |
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDTest incomplete. See below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: IncompleteAddresssanitizer topotests part 4: Incomplete(check logs for details)Topotests debian 10 amd64 part 1: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO1DEB10AMD64-13938/test Topology Tests failed for Topotests debian 10 amd64 part 1 Topotests Ubuntu 18.04 arm8 part 8: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 8: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-13938/artifact/TOPO8U18AMD64/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 8: No useful log foundSuccessful on other platforms/tests
|
|
ci:rerun |
Continuous Integration Result: FAILEDTest incomplete. See below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: IncompleteAddresssanitizer topotests part 4: Incomplete(check logs for details)Topotests Ubuntu 18.04 amd64 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9U18AMD64-13941/test Topology Tests failed for Topotests Ubuntu 18.04 amd64 part 9 Topotests Ubuntu 18.04 i386 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9U18I386-13941/test Topology Tests failed for Topotests Ubuntu 18.04 i386 part 9 Successful on other platforms/tests
|
|
ci:rerun |
Continuous Integration Result: FAILEDTest incomplete. See below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: IncompleteTopotests Ubuntu 18.04 i386 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9U18I386-13992/test Topology Tests failed for Topotests Ubuntu 18.04 i386 part 9 Topotests Ubuntu 18.04 arm8 part 0: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 0: No useful log foundAddresssanitizer topotests part 4: Incomplete(check logs for details)Addresssanitizer topotests part 7: Incomplete(check logs for details)Addresssanitizer topotests part 3: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-ASANP3-13992/test Topology Tests failed for Addresssanitizer topotests part 3 Successful on other platforms/tests
|
|
ci:rerun |
Continuous Integration Result: FAILEDSee below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: FailedTopotests Ubuntu 18.04 arm8 part 5: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 5: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-14129/artifact/TOPO5U18ARM8/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 5: No useful log foundTopotests Ubuntu 18.04 i386 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9U18I386-14129/test Topology Tests failed for Topotests Ubuntu 18.04 i386 part 9 Topotests Ubuntu 18.04 arm8 part 8: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 8: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-14129/artifact/TOPO8U18AMD64/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 8: No useful log foundTopotests Ubuntu 18.04 i386 part 2: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO2U18I386-14129/test Topology Tests failed for Topotests Ubuntu 18.04 i386 part 2 Topotests Ubuntu 18.04 arm8 part 0: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 0: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-14129/artifact/TOPO0U18ARM8/TopotestDetails/Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO0U18ARM8-14129/test Topology Tests failed for Topotests Ubuntu 18.04 arm8 part 0 Topotests Ubuntu 18.04 amd64 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9U18AMD64-14129/test Topology Tests failed for Topotests Ubuntu 18.04 amd64 part 9 Successful on other platforms/tests
|
|
ci:rerun |
Continuous Integration Result: FAILEDSee below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: FailedTopotests Ubuntu 18.04 amd64 part 9: Failed (click for details)Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9U18AMD64-14160/test Topology Tests failed for Topotests Ubuntu 18.04 amd64 part 9 Successful on other platforms/tests
|
|
ci:rerun |
Continuous Integration Result: FAILEDTest incomplete. See below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: IncompleteRedhat 8 amd64 build: Incomplete(check logs for details)Successful on other platforms/tests
|
|
@patrasar : Please rebase. |
|
ci:rerun |
|
@patrasar rebase plz ? |
ERROR: AddressSanitizer: heap-use-after-free on address 0x6160000801f0 at pc 0x5598c27c213f bp 0x7ffc04462060 sp 0x7ffc04462050
READ of size 4 at 0x6160000801f0 thread T0
#0 0x5598c27c213e in igmp_source_delete pimd/pim_igmpv3.c:340
#1 0x5598c27c277f in igmp_source_delete_expired pimd/pim_igmpv3.c:405
#2 0x5598c27b34c7 in igmp_group_timer pimd/pim_igmp.c:1324
#3 0x7fb78e68e1a7 in event_call lib/event.c:1995
#4 0x7fb78e5d28a5 in frr_run lib/libfrr.c:1213
FRRouting#5 0x5598c27c781d in main pimd/pim_main.c:162
FRRouting#6 0x7fb78dbeac86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
FRRouting#7 0x5598c26f0ab9 in _start (/usr/lib/frr/pimd+0x103ab9)
0x6160000801f0 is located 112 bytes inside of 600-byte region [0x616000080180,0x6160000803d8)
freed by thread T0 here:
#0 0x7fb78ebf17a8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7a8)
#1 0x7fb78e5eff7c in qfree lib/memory.c:130
#2 0x5598c2750412 in pim_channel_oil_free pimd/pim_oil.c:84
#3 0x5598c2750c26 in pim_channel_oil_del pimd/pim_oil.c:199
#4 0x5598c27681d3 in tib_sg_gm_prune pimd/pim_tib.c:167
FRRouting#5 0x5598c27b0e7f in igmp_source_forward_stop pimd/pim_igmp.c:225
FRRouting#6 0x5598c27c25ac in igmp_source_timer pimd/pim_igmpv3.c:155
FRRouting#7 0x7fb78e68e1a7 in event_call lib/event.c:1995
FRRouting#8 0x7fb78e5d28a5 in frr_run lib/libfrr.c:1213
FRRouting#9 0x5598c27c781d in main pimd/pim_main.c:162
FRRouting#10 0x7fb78dbeac86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
Root Cause:
-----------
This issue arises because the "source->source_channel_oil" pointer is deleted
within the "igmp_source_forward_stop()" API.
However when the igmp_source_delete function in pimd/pim_igmpv3.c at line 340
is called, it attempts to reference the "source->source_channel_oil" pointer,
which now containes garbage value.
Fix:
----
After deletion of "source_channel_oil" in igmp_source_forward_stop() API,
it is necessary to set the "source->source_channel_oil" pointer to NULL
value.
This will prevent any issue that could arise from referencing in future.
Issue: FRRouting#14195
Signed-off-by: Sarita Patra <[email protected]>
|
This pull request has conflicts, please resolve those before we can evaluate the pull request. |
ERROR: AddressSanitizer: heap-use-after-free on address 0x6160000801f0 at pc 0x5598c27c213f bp 0x7ffc04462060 sp 0x7ffc04462050 READ of size 4 at 0x6160000801f0 thread T0
#0 0x5598c27c213e in igmp_source_delete pimd/pim_igmpv3.c:340
#1 0x5598c27c277f in igmp_source_delete_expired pimd/pim_igmpv3.c:405
#2 0x5598c27b34c7 in igmp_group_timer pimd/pim_igmp.c:1324
#3 0x7fb78e68e1a7 in event_call lib/event.c:1995
#4 0x7fb78e5d28a5 in frr_run lib/libfrr.c:1213
#5 0x5598c27c781d in main pimd/pim_main.c:162
#6 0x7fb78dbeac86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
#7 0x5598c26f0ab9 in _start (/usr/lib/frr/pimd+0x103ab9)
0x6160000801f0 is located 112 bytes inside of 600-byte region [0x616000080180,0x6160000803d8) freed by thread T0 here:
#0 0x7fb78ebf17a8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7a8)
#1 0x7fb78e5eff7c in qfree lib/memory.c:130
#2 0x5598c2750412 in pim_channel_oil_free pimd/pim_oil.c:84
#3 0x5598c2750c26 in pim_channel_oil_del pimd/pim_oil.c:199
#4 0x5598c27681d3 in tib_sg_gm_prune pimd/pim_tib.c:167
#5 0x5598c27b0e7f in igmp_source_forward_stop pimd/pim_igmp.c:225
#6 0x5598c27c25ac in igmp_source_timer pimd/pim_igmpv3.c:155
#7 0x7fb78e68e1a7 in event_call lib/event.c:1995
#8 0x7fb78e5d28a5 in frr_run lib/libfrr.c:1213
#9 0x5598c27c781d in main pimd/pim_main.c:162
#10 0x7fb78dbeac86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
Root Cause:
This issue arises because the "source->source_channel_oil" pointer is deleted within the "igmp_source_forward_stop()" API.
However when the igmp_source_delete function in pimd/pim_igmpv3.c at line 340 is called, it attempts to reference the "source->source_channel_oil" pointer, which now containes garbage value.
Fix:
After deletion of "source_channel_oil" in igmp_source_forward_stop() API, it is necessary to set the "source->source_channel_oil" pointer to NULL value.
This will prevent any issue that could arise from referencing in future.
Closes #14195
Signed-off-by: Sarita Patra [email protected]