Skip to content

Conversation

mergify[bot]
Copy link

@mergify mergify bot commented Jun 20, 2025

RB tree for router table is not initializes and can have garbage values leading to crashes when zebra boots.

==52257== Invalid read of size 4
==52257==    at 0x24A683: zebra_router_table_entry_compare (zebra_router.c:46)
==52257==    by 0x24A683: zebra_router_table_head_RB_COMPARE (zebra_router.c:38)
==52257==    by 0x494859F: _rb_find (openbsd-tree.c:415)
==52257==    by 0x24AA44: zebra_router_table_head_RB_FIND (zebra_router.h:39)
==52257==    by 0x24AA44: zebra_router_get_table (zebra_router.c:131)
==52257==    by 0x268AB8: zebra_vrf_table_create (zebra_vrf.c:432)
==52257==    by 0x268AB8: zebra_vrf_enable (zebra_vrf.c:140)
==52257==    by 0x4977036: vrf_enable (vrf.c:286)
==52257==    by 0x4977036: vrf_enable (vrf.c:275)
==52257==    by 0x497797D: vrf_init (vrf.c:554)
==52257==    by 0x269854: zebra_vrf_init (zebra_vrf.c:645)
==52257==    by 0x237315: zebra_ns_init (zebra_ns.c:252)
==52257==    by 0x1BF284: main (main.c:469)
==52257==  Address 0x56415741e5894875 is not stack'd, malloc'd or (recently) free'd
==52257==
==52257==
==52257== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==52257==    at 0x4D07EEC: __pthread_kill_implementation (pthread_kill.c:44)
==52257==    by 0x4CB8FB1: raise (raise.c:26)
==52257==    by 0x4961BFB: core_handler (sigevent.c:261)
==52257==    by 0x4CB904F: ??? (in /usr/lib/x86_64-linux-gnu/libc.so.6)
==52257==    by 0x24A682: zebra_router_table_entry_compare (zebra_router.c:46)
==52257==    by 0x24A682: zebra_router_table_head_RB_COMPARE (zebra_router.c:38)
==52257==    by 0x494859F: _rb_find (openbsd-tree.c:415)
==52257==    by 0x24AA44: zebra_router_table_head_RB_FIND (zebra_router.h:39)
==52257==    by 0x24AA44: zebra_router_get_table (zebra_router.c:131)
==52257==    by 0x268AB8: zebra_vrf_table_create (zebra_vrf.c:432)
==52257==    by 0x268AB8: zebra_vrf_enable (zebra_vrf.c:140)
==52257==    by 0x4977036: vrf_enable (vrf.c:286)
==52257==    by 0x4977036: vrf_enable (vrf.c:275)
==52257==    by 0x497797D: vrf_init (vrf.c:554)
==52257==    by 0x269854: zebra_vrf_init (zebra_vrf.c:645)
==52257==    by 0x237315: zebra_ns_init (zebra_ns.c:252)
==52257==

Ticket :#4502759


This is an automatic backport of pull request #19049 done by Mergify.

RB tree for router table is not initializes and can have garbage values
leading to crashes when zebra boots.

==52257== Invalid read of size 4
==52257==    at 0x24A683: zebra_router_table_entry_compare (zebra_router.c:46)
==52257==    by 0x24A683: zebra_router_table_head_RB_COMPARE (zebra_router.c:38)
==52257==    by 0x494859F: _rb_find (openbsd-tree.c:415)
==52257==    by 0x24AA44: zebra_router_table_head_RB_FIND (zebra_router.h:39)
==52257==    by 0x24AA44: zebra_router_get_table (zebra_router.c:131)
==52257==    by 0x268AB8: zebra_vrf_table_create (zebra_vrf.c:432)
==52257==    by 0x268AB8: zebra_vrf_enable (zebra_vrf.c:140)
==52257==    by 0x4977036: vrf_enable (vrf.c:286)
==52257==    by 0x4977036: vrf_enable (vrf.c:275)
==52257==    by 0x497797D: vrf_init (vrf.c:554)
==52257==    by 0x269854: zebra_vrf_init (zebra_vrf.c:645)
==52257==    by 0x237315: zebra_ns_init (zebra_ns.c:252)
==52257==    by 0x1BF284: main (main.c:469)
==52257==  Address 0x56415741e5894875 is not stack'd, malloc'd or (recently) free'd
==52257==
==52257==
==52257== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==52257==    at 0x4D07EEC: __pthread_kill_implementation (pthread_kill.c:44)
==52257==    by 0x4CB8FB1: raise (raise.c:26)
==52257==    by 0x4961BFB: core_handler (sigevent.c:261)
==52257==    by 0x4CB904F: ??? (in /usr/lib/x86_64-linux-gnu/libc.so.6)
==52257==    by 0x24A682: zebra_router_table_entry_compare (zebra_router.c:46)
==52257==    by 0x24A682: zebra_router_table_head_RB_COMPARE (zebra_router.c:38)
==52257==    by 0x494859F: _rb_find (openbsd-tree.c:415)
==52257==    by 0x24AA44: zebra_router_table_head_RB_FIND (zebra_router.h:39)
==52257==    by 0x24AA44: zebra_router_get_table (zebra_router.c:131)
==52257==    by 0x268AB8: zebra_vrf_table_create (zebra_vrf.c:432)
==52257==    by 0x268AB8: zebra_vrf_enable (zebra_vrf.c:140)
==52257==    by 0x4977036: vrf_enable (vrf.c:286)
==52257==    by 0x4977036: vrf_enable (vrf.c:275)
==52257==    by 0x497797D: vrf_init (vrf.c:554)
==52257==    by 0x269854: zebra_vrf_init (zebra_vrf.c:645)
==52257==    by 0x237315: zebra_ns_init (zebra_ns.c:252)
==52257==

Ticket :#4502759

Signed-off-by: Rajasekar Raja <rajasekarr@nvidia.com>
(cherry picked from commit 183783a)

# Conflicts:
#	zebra/zebra_router.c
Copy link
Author

mergify bot commented Jun 20, 2025

Cherry-pick of 183783a has failed:

On branch mergify/bp/stable/10.2/pr-19049
Your branch is up to date with 'origin/stable/10.2'.

You are currently cherry-picking commit 183783aa7.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   zebra/zebra_router.c

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

@mergify mergify bot added the conflicts label Jun 20, 2025
@frrbot frrbot bot added the zebra label Jun 20, 2025
@ton31337 ton31337 closed this Jun 20, 2025
@ton31337 ton31337 deleted the mergify/bp/stable/10.2/pr-19049 branch June 20, 2025 06:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants