Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

zebra: fix dplane_ctx_iptable use-after-free #14862

Merged
merged 1 commit into from
Nov 22, 2023

Conversation

louis-6wind
Copy link
Contributor

Fix a crash because a use-after-free.

=================================================================
==1249835==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000074210 at pc 0x7fa1b42a652c bp 0x7ffc477a2aa0 sp 0x7ffc477a2a98
READ of size 8 at 0x604000074210 thread T0
#0 0x7fa1b42a652b in list_delete_all_node git/frr/lib/linklist.c:299:20
#1 0x7fa1b42a683f in list_delete git/frr/lib/linklist.c:312:2
#2 0x5ee515 in dplane_ctx_free_internal git/frr/zebra/zebra_dplane.c:858:4
#3 0x5ee59c in dplane_ctx_free git/frr/zebra/zebra_dplane.c:884:2
#4 0x5ee544 in dplane_ctx_fini git/frr/zebra/zebra_dplane.c:905:2
#5 0x7045c0 in rib_process_dplane_results git/frr/zebra/zebra_rib.c:4928:4
#6 0x7fa1b4434fb2 in event_call git/frr/lib/event.c:1970:2
#7 0x7fa1b42a0ccf in frr_run git/frr/lib/libfrr.c:1213:3
#8 0x556808 in main git/frr/zebra/main.c:488:2
#9 0x7fa1b3d0bd09 in __libc_start_main csu/../csu/libc-start.c:308:16
#10 0x4453e9 in _start (/usr/lib/frr/zebra+0x4453e9)

0x604000074210 is located 0 bytes inside of 40-byte region [0x604000074210,0x604000074238)
freed by thread T0 here:
#0 0x4bf1dd in free (/usr/lib/frr/zebra+0x4bf1dd)
#1 0x7fa1b42df0c0 in qfree git/frr/lib/memory.c:130:2
#2 0x7fa1b42a68ce in list_free_internal git/frr/lib/linklist.c:24:2
#3 0x7fa1b42a6870 in list_delete git/frr/lib/linklist.c:313:2
#4 0x5ee515 in dplane_ctx_free_internal git/frr/zebra/zebra_dplane.c:858:4
#5 0x5ee59c in dplane_ctx_free git/frr/zebra/zebra_dplane.c:884:2
#6 0x5ee544 in dplane_ctx_fini git/frr/zebra/zebra_dplane.c:905:2
#7 0x7045c0 in rib_process_dplane_results git/frr/zebra/zebra_rib.c:4928:4
#8 0x7fa1b4434fb2 in event_call git/frr/lib/event.c:1970:2
#9 0x7fa1b42a0ccf in frr_run git/frr/lib/libfrr.c:1213:3
#10 0x556808 in main git/frr/zebra/main.c:488:2
#11 0x7fa1b3d0bd09 in __libc_start_main csu/../csu/libc-start.c:308:16

previously allocated by thread T0 here:
#0 0x4bf5d2 in calloc (/usr/lib/frr/zebra+0x4bf5d2)
#1 0x7fa1b42dee18 in qcalloc git/frr/lib/memory.c:105:27
#2 0x7fa1b42a3784 in list_new git/frr/lib/linklist.c:18:9
#3 0x6d165f in pbr_iptable_alloc_intern git/frr/zebra/zebra_pbr.c:1015:29
#4 0x7fa1b426ad1f in hash_get git/frr/lib/hash.c:147:13
#5 0x6d15f2 in zebra_pbr_add_iptable git/frr/zebra/zebra_pbr.c:1030:13
#6 0x5db2a3 in zread_iptable git/frr/zebra/zapi_msg.c:3759:3
#7 0x5e365d in zserv_handle_commands git/frr/zebra/zapi_msg.c:4039:3
#8 0x7e09fc in zserv_process_messages git/frr/zebra/zserv.c:520:3
#9 0x7fa1b4434fb2 in event_call git/frr/lib/event.c:1970:2
#10 0x7fa1b42a0ccf in frr_run git/frr/lib/libfrr.c:1213:3
#11 0x556808 in main git/frr/zebra/main.c:488:2
#12 0x7fa1b3d0bd09 in __libc_start_main csu/../csu/libc-start.c:308:16

Fixes: 1cc3806 ("zebra: Actually free all memory associated ctx->u.iptable.interface_name_list")

Fix a crash because a use-after-free.

> =================================================================
> ==1249835==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000074210 at pc 0x7fa1b42a652c bp 0x7ffc477a2aa0 sp 0x7ffc477a2a98
> READ of size 8 at 0x604000074210 thread T0
>     #0 0x7fa1b42a652b in list_delete_all_node git/frr/lib/linklist.c:299:20
>     #1 0x7fa1b42a683f in list_delete git/frr/lib/linklist.c:312:2
>     #2 0x5ee515 in dplane_ctx_free_internal git/frr/zebra/zebra_dplane.c:858:4
>     #3 0x5ee59c in dplane_ctx_free git/frr/zebra/zebra_dplane.c:884:2
>     FRRouting#4 0x5ee544 in dplane_ctx_fini git/frr/zebra/zebra_dplane.c:905:2
>     FRRouting#5 0x7045c0 in rib_process_dplane_results git/frr/zebra/zebra_rib.c:4928:4
>     FRRouting#6 0x7fa1b4434fb2 in event_call git/frr/lib/event.c:1970:2
>     FRRouting#7 0x7fa1b42a0ccf in frr_run git/frr/lib/libfrr.c:1213:3
>     FRRouting#8 0x556808 in main git/frr/zebra/main.c:488:2
>     FRRouting#9 0x7fa1b3d0bd09 in __libc_start_main csu/../csu/libc-start.c:308:16
>     FRRouting#10 0x4453e9 in _start (/usr/lib/frr/zebra+0x4453e9)
>
> 0x604000074210 is located 0 bytes inside of 40-byte region [0x604000074210,0x604000074238)
> freed by thread T0 here:
>     #0 0x4bf1dd in free (/usr/lib/frr/zebra+0x4bf1dd)
>     #1 0x7fa1b42df0c0 in qfree git/frr/lib/memory.c:130:2
>     #2 0x7fa1b42a68ce in list_free_internal git/frr/lib/linklist.c:24:2
>     #3 0x7fa1b42a6870 in list_delete git/frr/lib/linklist.c:313:2
>     FRRouting#4 0x5ee515 in dplane_ctx_free_internal git/frr/zebra/zebra_dplane.c:858:4
>     FRRouting#5 0x5ee59c in dplane_ctx_free git/frr/zebra/zebra_dplane.c:884:2
>     FRRouting#6 0x5ee544 in dplane_ctx_fini git/frr/zebra/zebra_dplane.c:905:2
>     FRRouting#7 0x7045c0 in rib_process_dplane_results git/frr/zebra/zebra_rib.c:4928:4
>     FRRouting#8 0x7fa1b4434fb2 in event_call git/frr/lib/event.c:1970:2
>     FRRouting#9 0x7fa1b42a0ccf in frr_run git/frr/lib/libfrr.c:1213:3
>     FRRouting#10 0x556808 in main git/frr/zebra/main.c:488:2
>     FRRouting#11 0x7fa1b3d0bd09 in __libc_start_main csu/../csu/libc-start.c:308:16
>
> previously allocated by thread T0 here:
>     #0 0x4bf5d2 in calloc (/usr/lib/frr/zebra+0x4bf5d2)
>     #1 0x7fa1b42dee18 in qcalloc git/frr/lib/memory.c:105:27
>     #2 0x7fa1b42a3784 in list_new git/frr/lib/linklist.c:18:9
>     #3 0x6d165f in pbr_iptable_alloc_intern git/frr/zebra/zebra_pbr.c:1015:29
>     FRRouting#4 0x7fa1b426ad1f in hash_get git/frr/lib/hash.c:147:13
>     FRRouting#5 0x6d15f2 in zebra_pbr_add_iptable git/frr/zebra/zebra_pbr.c:1030:13
>     FRRouting#6 0x5db2a3 in zread_iptable git/frr/zebra/zapi_msg.c:3759:3
>     FRRouting#7 0x5e365d in zserv_handle_commands git/frr/zebra/zapi_msg.c:4039:3
>     FRRouting#8 0x7e09fc in zserv_process_messages git/frr/zebra/zserv.c:520:3
>     FRRouting#9 0x7fa1b4434fb2 in event_call git/frr/lib/event.c:1970:2
>     FRRouting#10 0x7fa1b42a0ccf in frr_run git/frr/lib/libfrr.c:1213:3
>     FRRouting#11 0x556808 in main git/frr/zebra/main.c:488:2
>     FRRouting#12 0x7fa1b3d0bd09 in __libc_start_main csu/../csu/libc-start.c:308:16

Fixes: 1cc3806 ("zebra: Actually free all memory associated ctx->u.iptable.interface_name_list")
Signed-off-by: Louis Scalbert <[email protected]>
Copy link
Contributor

@mjstapp mjstapp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, thanks

@mjstapp mjstapp merged commit d1e11d4 into FRRouting:master Nov 22, 2023
79 checks passed
@louis-6wind
Copy link
Contributor Author

https://github.com/Mergifyio backport stable/9.1

Copy link

mergify bot commented Nov 23, 2023

backport stable/9.1

❌ Command disallowed due to command restrictions in the Mergify configuration.

  • sender-permission>=write

@louis-6wind
Copy link
Contributor Author

https://github.com/Mergifyio backport dev/9.1

@louis-6wind
Copy link
Contributor Author

https://github.com/Mergifyio backport stable/9.0

Copy link

mergify bot commented Nov 23, 2023

backport dev/9.1

❌ Command disallowed due to command restrictions in the Mergify configuration.

  • sender-permission>=write

Copy link

mergify bot commented Nov 23, 2023

backport stable/9.0

❌ Command disallowed due to command restrictions in the Mergify configuration.

  • sender-permission>=write

@louis-6wind
Copy link
Contributor Author

https://github.com/Mergifyio backport stable/8.5

Copy link

mergify bot commented Nov 23, 2023

backport stable/8.5

❌ Command disallowed due to command restrictions in the Mergify configuration.

  • sender-permission>=write

@pguibert6WIND
Copy link
Member

pguibert6WIND commented Nov 23, 2023

https://github.com/Mergifyio backport stable/9.1

@pguibert6WIND
Copy link
Member

pguibert6WIND commented Nov 23, 2023

https://github.com/Mergifyio backport stable/9.0

@pguibert6WIND
Copy link
Member

pguibert6WIND commented Nov 23, 2023

https://github.com/Mergifyio backport stable/8.5

Copy link

mergify bot commented Nov 24, 2023

backport stable/9.1

✅ Backports have been created

Copy link

mergify bot commented Nov 24, 2023

backport stable/9.0

✅ Backports have been created

Copy link

mergify bot commented Nov 24, 2023

backport stable/8.5

✅ Backports have been created

donaldsharp added a commit that referenced this pull request Nov 24, 2023
zebra: fix dplane_ctx_iptable use-after-free (backport #14862)
donaldsharp added a commit that referenced this pull request Nov 24, 2023
zebra: fix dplane_ctx_iptable use-after-free (backport #14862)
donaldsharp added a commit that referenced this pull request Nov 24, 2023
zebra: fix dplane_ctx_iptable use-after-free (backport #14862)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants