Skip to content

Conversation

mergify[bot]
Copy link

@mergify mergify bot commented Jun 20, 2025

RB tree for router table is not initializes and can have garbage values leading to crashes when zebra boots.

==52257== Invalid read of size 4
==52257==    at 0x24A683: zebra_router_table_entry_compare (zebra_router.c:46)
==52257==    by 0x24A683: zebra_router_table_head_RB_COMPARE (zebra_router.c:38)
==52257==    by 0x494859F: _rb_find (openbsd-tree.c:415)
==52257==    by 0x24AA44: zebra_router_table_head_RB_FIND (zebra_router.h:39)
==52257==    by 0x24AA44: zebra_router_get_table (zebra_router.c:131)
==52257==    by 0x268AB8: zebra_vrf_table_create (zebra_vrf.c:432)
==52257==    by 0x268AB8: zebra_vrf_enable (zebra_vrf.c:140)
==52257==    by 0x4977036: vrf_enable (vrf.c:286)
==52257==    by 0x4977036: vrf_enable (vrf.c:275)
==52257==    by 0x497797D: vrf_init (vrf.c:554)
==52257==    by 0x269854: zebra_vrf_init (zebra_vrf.c:645)
==52257==    by 0x237315: zebra_ns_init (zebra_ns.c:252)
==52257==    by 0x1BF284: main (main.c:469)
==52257==  Address 0x56415741e5894875 is not stack'd, malloc'd or (recently) free'd
==52257==
==52257==
==52257== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==52257==    at 0x4D07EEC: __pthread_kill_implementation (pthread_kill.c:44)
==52257==    by 0x4CB8FB1: raise (raise.c:26)
==52257==    by 0x4961BFB: core_handler (sigevent.c:261)
==52257==    by 0x4CB904F: ??? (in /usr/lib/x86_64-linux-gnu/libc.so.6)
==52257==    by 0x24A682: zebra_router_table_entry_compare (zebra_router.c:46)
==52257==    by 0x24A682: zebra_router_table_head_RB_COMPARE (zebra_router.c:38)
==52257==    by 0x494859F: _rb_find (openbsd-tree.c:415)
==52257==    by 0x24AA44: zebra_router_table_head_RB_FIND (zebra_router.h:39)
==52257==    by 0x24AA44: zebra_router_get_table (zebra_router.c:131)
==52257==    by 0x268AB8: zebra_vrf_table_create (zebra_vrf.c:432)
==52257==    by 0x268AB8: zebra_vrf_enable (zebra_vrf.c:140)
==52257==    by 0x4977036: vrf_enable (vrf.c:286)
==52257==    by 0x4977036: vrf_enable (vrf.c:275)
==52257==    by 0x497797D: vrf_init (vrf.c:554)
==52257==    by 0x269854: zebra_vrf_init (zebra_vrf.c:645)
==52257==    by 0x237315: zebra_ns_init (zebra_ns.c:252)
==52257==

Ticket :#4502759


This is an automatic backport of pull request #19049 done by Mergify.

RB tree for router table is not initializes and can have garbage values
leading to crashes when zebra boots.

==52257== Invalid read of size 4
==52257==    at 0x24A683: zebra_router_table_entry_compare (zebra_router.c:46)
==52257==    by 0x24A683: zebra_router_table_head_RB_COMPARE (zebra_router.c:38)
==52257==    by 0x494859F: _rb_find (openbsd-tree.c:415)
==52257==    by 0x24AA44: zebra_router_table_head_RB_FIND (zebra_router.h:39)
==52257==    by 0x24AA44: zebra_router_get_table (zebra_router.c:131)
==52257==    by 0x268AB8: zebra_vrf_table_create (zebra_vrf.c:432)
==52257==    by 0x268AB8: zebra_vrf_enable (zebra_vrf.c:140)
==52257==    by 0x4977036: vrf_enable (vrf.c:286)
==52257==    by 0x4977036: vrf_enable (vrf.c:275)
==52257==    by 0x497797D: vrf_init (vrf.c:554)
==52257==    by 0x269854: zebra_vrf_init (zebra_vrf.c:645)
==52257==    by 0x237315: zebra_ns_init (zebra_ns.c:252)
==52257==    by 0x1BF284: main (main.c:469)
==52257==  Address 0x56415741e5894875 is not stack'd, malloc'd or (recently) free'd
==52257==
==52257==
==52257== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==52257==    at 0x4D07EEC: __pthread_kill_implementation (pthread_kill.c:44)
==52257==    by 0x4CB8FB1: raise (raise.c:26)
==52257==    by 0x4961BFB: core_handler (sigevent.c:261)
==52257==    by 0x4CB904F: ??? (in /usr/lib/x86_64-linux-gnu/libc.so.6)
==52257==    by 0x24A682: zebra_router_table_entry_compare (zebra_router.c:46)
==52257==    by 0x24A682: zebra_router_table_head_RB_COMPARE (zebra_router.c:38)
==52257==    by 0x494859F: _rb_find (openbsd-tree.c:415)
==52257==    by 0x24AA44: zebra_router_table_head_RB_FIND (zebra_router.h:39)
==52257==    by 0x24AA44: zebra_router_get_table (zebra_router.c:131)
==52257==    by 0x268AB8: zebra_vrf_table_create (zebra_vrf.c:432)
==52257==    by 0x268AB8: zebra_vrf_enable (zebra_vrf.c:140)
==52257==    by 0x4977036: vrf_enable (vrf.c:286)
==52257==    by 0x4977036: vrf_enable (vrf.c:275)
==52257==    by 0x497797D: vrf_init (vrf.c:554)
==52257==    by 0x269854: zebra_vrf_init (zebra_vrf.c:645)
==52257==    by 0x237315: zebra_ns_init (zebra_ns.c:252)
==52257==

Ticket :#4502759

Signed-off-by: Rajasekar Raja <rajasekarr@nvidia.com>
(cherry picked from commit 183783a)
@frrbot frrbot bot added the zebra label Jun 20, 2025
@ton31337 ton31337 merged commit 0fce549 into dev/10.4 Jun 20, 2025
16 checks passed
@ton31337 ton31337 deleted the mergify/bp/dev/10.4/pr-19049 branch June 20, 2025 13:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants