-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
isis: fix crash in isis_spf_process_lsp #10970
base: master
Are you sure you want to change the base?
Conversation
@@ -1109,7 +1109,8 @@ static int isis_spf_process_lsp(struct isis_spftree *spftree, | |||
|
|||
if (fragnode) { | |||
lsp = listgetdata(fragnode); | |||
goto lspfragloop; | |||
if (lsp->tlvs) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
so it looks as if this new test may terminate the iteration through the list of "fragnodes". is that ... correct?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It was not. I have corrected that
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
As I understand this while loop will find the next non-empty fragment (i.e. with > 0 number of TLVs). And as soon as it finds it, breaks the loop and then goes back to the label 'lspfragloop' to process the fragment.
Like said before, I don't see a reason as to why will there be a fragment with zero TLVs in it in the first place. If this LSP/fragment is being originated by another instance of FRR code on a remote router, we need to fix the FRR ISIS LSP origination code.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Otherwise these changes look good.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
As I understand this while loop will find the next non-empty fragment (i.e. with > 0 number of TLVs). And as soon as it finds it, breaks the loop and then goes back to the label 'lspfragloop' to process the fragment.
Like said before, I don't see a reason as to why will there be a fragment with zero TLVs in it in the first place. If this LSP/fragment is being originated by another instance of FRR code on a remote router, we need to fix the FRR ISIS LSP origination code.
not originating from another FRR instance
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
While the fix looks very simple, please find some comments seeking clarification that will help me understand this fix better.
isisd/isis_spf.c
Outdated
@@ -1109,7 +1109,8 @@ static int isis_spf_process_lsp(struct isis_spftree *spftree, | |||
|
|||
if (fragnode) { | |||
lsp = listgetdata(fragnode); | |||
goto lspfragloop; | |||
if (lsp->tlvs) | |||
goto lspfragloop; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
While the fix for the crash looks good. But this will also mean that the processing will stop at the first fragment that does not have any fragment. What are the possibilities that a fragment has no TLVs in it. And then what are the possibilities that such a blank fragment is followed by a non-empty fragment in the fragment list.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Also its not clear under which exact scenario did this crash ocurr?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The crash happens with "redistribute bgp" and exabgp is stopped while injecting routes to frr.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Does this crash happens on the same router where BGP routes are being redistributed into ISIS? Anyways stopping exabgp while injecting routes to for should not cause any LSP fragments to have zero TLVs. In my opinion along with this fix we need to fix the case where LSPs do not have any TLVs in it.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Does this crash happens on the same router where BGP routes are being redistributed into ISIS?
yes
Anyways stopping exabgp while injecting routes to for should not cause any LSP fragments to have zero TLVs.
It is a exabgp issue. It means that this condition causes a denial of service
In my opinion along with this fix we need to fix the case where LSPs do not have any TLVs in it.
My fix deals with this case
There is that at the beginning of the function. If no tlv, return. The previous patch was not so bad
if (!lsp->tlvs)
return ISIS_OK;
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What do you mean by exabgp issue? Is exabgp generating these empty ISIS LSP fragments? Not to my understanding. If these routes are learnt by FRR bgpd over a peering session with exabgp and then getting redistributed into ISIS, then this is still a ISISd LSP generation issue. If my assumptions are correct here, your fix is more like a hack and not the right fix.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You are right. The issue is the generation of LSP.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@louis-6wind Can you fix the issue in geeneration of LSP as well. Your current fix can remain as well.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It appears with the introduction of classic LFA and when it is on. I have no time to investigate at the moment. I will try later
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@pushpasis I did not find the root cause of this issue. However, this fix is necessary anyway.
Please review it
Continuous Integration Result: SUCCESSFULContinuous Integration Result: SUCCESSFULCongratulations, this patch passed basic tests Tested-by: NetDEF / OpenSourceRouting.org CI System CI System Testrun URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-4667/ This is a comment from an automated CI system. |
c6b5a07
to
2421b25
Compare
2421b25
to
b0e0954
Compare
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDSee below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: FailedRedhat 8 amd64 build: Failed (click for details)Redhat 8 amd64 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/REDHAT8/config.log/config.log.gzMake failed for Redhat 8 amd64 build:
Redhat 8 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/REDHAT8/config.status/config.status Fedora 29 amd64 build: Failed (click for details)Make failed for Fedora 29 amd64 build:
Fedora 29 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/F29BUILD/config.status/config.status Debian 10 amd64 build: Failed (click for details)Debian 10 amd64 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/DEB10BUILD/config.log/config.log.gzMake failed for Debian 10 amd64 build:
Debian 10 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/DEB10BUILD/config.status/config.status FreeBSD 11 amd64 build: Failed (click for details)Make failed for FreeBSD 11 amd64 build:
FreeBSD 11 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/CI009BUILD/config.status/config.status Ubuntu 22.04 amd64 build: Failed (click for details)Ubuntu 22.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/U22AMD64BUILD/config.status/config.statusMake failed for Ubuntu 22.04 amd64 build:
Ubuntu 22.04 amd64 build: Unknown Log <config.log.gz> Ubuntu 20.04 amd64 build: Failed (click for details)Ubuntu 20.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/U2004AMD64BUILD/config.status/config.statusMake failed for Ubuntu 20.04 amd64 build:
Ubuntu 20.04 amd64 build: Unknown Log <config.log.gz> Debian 9 amd64 build: Failed (click for details)Make failed for Debian 9 amd64 build:
Debian 9 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/CI021BUILD/config.status/config.status Ubuntu 16.04 arm7 build: Failed (click for details)Ubuntu 16.04 arm7 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/CI101BUILD/config.status/config.status Ubuntu 16.04 arm7 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/CI101BUILD/config.log/config.log.gzMake failed for Ubuntu 16.04 arm7 build:
Ubuntu 18.04 ppc64le build: Failed (click for details)Make failed for Ubuntu 18.04 ppc64le build:
Ubuntu 18.04 ppc64le build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/U1804PPC64LEBUILD/config.status/config.status Ubuntu 18.04 amd64 build: Failed (click for details)Make failed for Ubuntu 18.04 amd64 build:
Ubuntu 18.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/U1804AMD64/config.status/config.status Ubuntu 16.04 amd64 build: Failed (click for details)Make failed for Ubuntu 16.04 amd64 build:
Ubuntu 16.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/CI014BUILD/config.status/config.status NetBSD 9 amd64 build: Failed (click for details)NetBSD 9 amd64 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/CI012BUILD/config.log/config.log.gzMake failed for NetBSD 9 amd64 build:
NetBSD 9 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/CI012BUILD/config.status/config.status FreeBSD 12 amd64 build: Failed (click for details)Make failed for FreeBSD 12 amd64 build:
FreeBSD 12 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/FBSD12AMD64/config.status/config.status Ubuntu 16.04 arm8 build: Failed (click for details)Make failed for Ubuntu 16.04 arm8 build:
Ubuntu 16.04 arm8 build: Unknown Log <config.log.gz> Ubuntu 18.04 i386 build: Failed (click for details)Ubuntu 18.04 i386 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/U18I386BUILD/config.log/config.log.gz Ubuntu 18.04 i386 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/U18I386BUILD/config.status/config.statusMake failed for Ubuntu 18.04 i386 build:
Ubuntu 18.04 arm7 build: Failed (click for details)Make failed for Ubuntu 18.04 arm7 build:
Ubuntu 18.04 arm7 build: Unknown Log <config.log.gz> Ubuntu 18.04 arm8 build: Failed (click for details)Ubuntu 18.04 arm8 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/U18ARM8BUILD/config.status/config.status Ubuntu 18.04 arm8 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/U18ARM8BUILD/config.log/config.log.gzMake failed for Ubuntu 18.04 arm8 build:
Debian 11 amd64 build: Failed (click for details)Debian 11 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/DEB11AMD64/config.status/config.statusMake failed for Debian 11 amd64 build:
Debian 11 amd64 build: Unknown Log <config.log.gz> Ubuntu 16.04 i386 build: Failed (click for details)Make failed for Ubuntu 16.04 i386 build:
Ubuntu 16.04 i386 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5573/artifact/U1604I386/config.status/config.status Successful on other platforms/tests
|
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDSee below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: FailedRedhat 8 amd64 build: Failed (click for details)Redhat 8 amd64 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/REDHAT8/config.log/config.log.gzMake failed for Redhat 8 amd64 build:
Redhat 8 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/REDHAT8/config.status/config.status Debian 10 amd64 build: Failed (click for details)Debian 10 amd64 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/DEB10BUILD/config.log/config.log.gzMake failed for Debian 10 amd64 build:
Debian 10 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/DEB10BUILD/config.status/config.status Fedora 29 amd64 build: Failed (click for details)Make failed for Fedora 29 amd64 build:
Fedora 29 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/F29BUILD/config.status/config.status Debian 9 amd64 build: Failed (click for details)Make failed for Debian 9 amd64 build:
Debian 9 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/CI021BUILD/config.status/config.status Ubuntu 20.04 amd64 build: Failed (click for details)Ubuntu 20.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/U2004AMD64BUILD/config.status/config.statusMake failed for Ubuntu 20.04 amd64 build:
Ubuntu 20.04 amd64 build: Unknown Log <config.log.gz> Ubuntu 16.04 arm7 build: Failed (click for details)Ubuntu 16.04 arm7 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/CI101BUILD/config.status/config.status Ubuntu 16.04 arm7 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/CI101BUILD/config.log/config.log.gzMake failed for Ubuntu 16.04 arm7 build:
Ubuntu 18.04 ppc64le build: Failed (click for details)Make failed for Ubuntu 18.04 ppc64le build:
Ubuntu 18.04 ppc64le build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/U1804PPC64LEBUILD/config.status/config.status Ubuntu 18.04 amd64 build: Failed (click for details)Make failed for Ubuntu 18.04 amd64 build:
Ubuntu 18.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/U1804AMD64/config.status/config.status Ubuntu 22.04 amd64 build: Failed (click for details)Ubuntu 22.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/U22AMD64BUILD/config.status/config.statusMake failed for Ubuntu 22.04 amd64 build:
Ubuntu 22.04 amd64 build: Unknown Log <config.log.gz> FreeBSD 11 amd64 build: Failed (click for details)Make failed for FreeBSD 11 amd64 build:
FreeBSD 11 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/CI009BUILD/config.status/config.status FreeBSD 12 amd64 build: Failed (click for details)Make failed for FreeBSD 12 amd64 build:
FreeBSD 12 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/FBSD12AMD64/config.status/config.status Ubuntu 16.04 arm8 build: Failed (click for details)Make failed for Ubuntu 16.04 arm8 build:
Ubuntu 16.04 arm8 build: Unknown Log <config.log.gz> Ubuntu 16.04 amd64 build: Failed (click for details)Make failed for Ubuntu 16.04 amd64 build:
Ubuntu 16.04 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/CI014BUILD/config.status/config.status Ubuntu 18.04 i386 build: Failed (click for details)Ubuntu 18.04 i386 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/U18I386BUILD/config.log/config.log.gz Ubuntu 18.04 i386 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/U18I386BUILD/config.status/config.statusMake failed for Ubuntu 18.04 i386 build:
NetBSD 9 amd64 build: Failed (click for details)NetBSD 9 amd64 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/CI012BUILD/config.log/config.log.gzMake failed for NetBSD 9 amd64 build:
NetBSD 9 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/CI012BUILD/config.status/config.status Ubuntu 18.04 arm7 build: Failed (click for details)Make failed for Ubuntu 18.04 arm7 build:
Ubuntu 18.04 arm7 build: Unknown Log <config.log.gz> Ubuntu 18.04 arm8 build: Failed (click for details)Ubuntu 18.04 arm8 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/U18ARM8BUILD/config.status/config.status Ubuntu 18.04 arm8 build: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/U18ARM8BUILD/config.log/config.log.gzMake failed for Ubuntu 18.04 arm8 build:
Ubuntu 16.04 i386 build: Failed (click for details)Make failed for Ubuntu 16.04 i386 build:
Ubuntu 16.04 i386 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/U1604I386/config.status/config.status Debian 11 amd64 build: Failed (click for details)Debian 11 amd64 build: config.status output from configure script can be found at https://ci1.netdef.org/browse/FRR-PULLREQ2-5572/artifact/DEB11AMD64/config.status/config.statusMake failed for Debian 11 amd64 build:
Debian 11 amd64 build: Unknown Log <config.log.gz> Successful on other platforms/tests
|
b0e0954
to
bd08a24
Compare
Continuous Integration Result: SUCCESSFULContinuous Integration Result: SUCCESSFULCongratulations, this patch passed basic tests Tested-by: NetDEF / OpenSourceRouting.org CI System CI System Testrun URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-5579/ This is a comment from an automated CI system. |
5ce2cc8
to
0180ad1
Compare
Continuous Integration Result: SUCCESSFULContinuous Integration Result: SUCCESSFULCongratulations, this patch passed basic tests Tested-by: NetDEF / OpenSourceRouting.org CI System CI System Testrun URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-6203/ This is a comment from an automated CI system. |
Continuous Integration Result: SUCCESSFULContinuous Integration Result: SUCCESSFULCongratulations, this patch passed basic tests Tested-by: NetDEF / OpenSourceRouting.org CI System CI System Testrun URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-6207/ This is a comment from an automated CI system. |
Continuous Integration Result: SUCCESSFULContinuous Integration Result: SUCCESSFULCongratulations, this patch passed basic tests Tested-by: NetDEF / OpenSourceRouting.org CI System CI System Testrun URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-6208/ This is a comment from an automated CI system. |
Continuous Integration Result: SUCCESSFULContinuous Integration Result: SUCCESSFULCongratulations, this patch passed basic tests Tested-by: NetDEF / OpenSourceRouting.org CI System CI System Testrun URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-6209/ This is a comment from an automated CI system. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
This PR is stale because it has been open 180 days with no activity. Comment or remove the |
0180ad1
to
3758341
Compare
Continuous Integration Result: FAILEDContinuous Integration Result: FAILEDSee below for issues. This is a comment from an automated CI system. Get source / Pull Request: SuccessfulBuilding Stage: SuccessfulBasic Tests: FailedTopotests Ubuntu 18.04 arm8 part 9: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 9: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-14327/artifact/TOPO9U18ARM8/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 9: No useful log foundTopotests Ubuntu 18.04 arm8 part 7: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 7: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-14327/artifact/TOPO7U18ARM8/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 7: No useful log foundTopotests Ubuntu 18.04 arm8 part 6: Failed (click for details)Topotests Ubuntu 18.04 arm8 part 6: Unknown Log URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-14327/artifact/TOPO6U18ARM8/TopotestDetails/ Topotests Ubuntu 18.04 arm8 part 6: No useful log foundSuccessful on other platforms/tests
|
Continuous Integration Result: SUCCESSFULCongratulations, this patch passed basic tests Tested-by: NetDEF / OpenSourceRouting.org CI System CI System Testrun URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-14327/ This is a comment from an automated CI system. |
@Mergifyio rebase |
The following crash has been seen: > #0 raise (sig=<optimized out>) at ../sysdeps/unix/sysv/linux/raise.c:51 > #1 0x00007f48a576db78 in core_handler (signo=11, siginfo=0x7ffeee4f2b30, context=0x7ffeee4f2a00) at lib/sigevent.c:262 > #2 <signal handler called> > #3 0x000055aded0d793a in isis_spf_process_lsp (spftree=0x55adee945120, lsp=0x55adee971800, cost=3, depth=1, root_sysid=0x55adee9451ac "", parent=0x55adee9474c0) at isisd/isis_spf.c:887 > FRRouting#4 0x000055aded0d9bd1 in isis_spf_loop (spftree=0x55adee945120, root_sysid=0x55adee9451ac "") at isisd/isis_spf.c:1679 > FRRouting#5 0x000055aded0d9fd1 in isis_run_spf (spftree=0x55adee945120) at isisd/isis_spf.c:1798 > FRRouting#6 0x000055aded0bad65 in isis_spf_run_neighbors (spftree=0x55adee962220) at isisd/isis_lfa.c:1259 > FRRouting#7 0x000055aded0bd896 in isis_spf_run_lfa (area=0x55adee95e200, spftree=0x55adee962220) at isisd/isis_lfa.c:2291 > FRRouting#8 0x000055aded0da0f2 in isis_run_spf_with_protection (area=0x55adee95e200, spftree=0x55adee962220) at isisd/isis_spf.c:1817 > FRRouting#9 0x000055aded0da350 in isis_run_spf_cb (thread=0x7ffeee4f3330) at isisd/isis_spf.c:1870 > FRRouting#10 0x00007f48a5786dcc in thread_call (thread=0x7ffeee4f3330) at lib/thread.c:2002 > FRRouting#11 0x00007f48a57213ee in frr_run (master=0x55adee6cdb40) at lib/libfrr.c:1196 > FRRouting#12 0x000055aded0acda2 in main (argc=2, argv=0x7ffeee4f3548, envp=0x7ffeee4f3560) at isisd/isis_main.c:273 It is caused by an attempt to access lsp->tlvs in isis_spf_process_lsp() label lspfragloop when lsp is NULL. isis_spf_process_lsp() checks that the lsp pointer is not NULL at the function beginning but af8ac8f ("isisd: send/receive LSPs with new parser") has introduced some lsp->tlvs accesses after the lspfragloop label without checking that lsp is not NULL. The crash has been seen in the following situation: - ISIS is configured to import routes from BGP - ISIS classic LFA is enabled on all ISIS interfaces - BGP receives routes from an exabgp peers - exabgp is stopped in the middle while sending new prefixes The same situation without LFA does not trigger the bug. However, it seems that the crash can potentially happen without LFA. Fixes: af8ac8f ("isisd: send/receive LSPs with new parser") Signed-off-by: Louis Scalbert <[email protected]>
✅ Branch has been successfully rebased |
3758341
to
8a0eb60
Compare
Signed-off-by: Louis Scalbert [email protected]