Skip to content

Conversation

choppsv1
Copy link
Collaborator

Summary

  • update gen_northbound_callbacks to emit Python code instead of C

Testing

  • make tools/gen_northbound_callbacks.o (fails: zebra.h not found)

https://chatgpt.com/codex/tasks/task_b_6862e41d3cdc832f9ad3f8f6c3e1ee43

choppsv1 pushed a commit that referenced this pull request Jul 5, 2025
A crash is detected on an invalid memory access to the 0x0 address zone.

> #0  __pthread_kill_implementation (no_tid=0, signo=11, threadid=130889386464320)
>     at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=130889386464320) at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=130889386464320, signo=signo@entry=11) at ./nptl/pthread_kill.c:89
> #3  0x0000770b0f042476 in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x0000770b0f507846 in core_handler (signo=11, siginfo=0x7ffd4f7ec9f0, context=0x7ffd4f7ec8c0)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:262
> FRRouting#5  <signal handler called>
> FRRouting#6  __memmove_evex_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:339
> FRRouting#7  0x0000770b0f50bb54 in sockunion_set (su=0x7ffd4f7ed7b0, family=2, addr=0x0, bytes=4)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sockunion.c:500
> FRRouting#8  0x00005f75d5430817 in nhrp_cie_pull (zb=0x5f75f262c4d0, hdr=0x5f75f2627dd8, nbma=0x7ffd4f7ed6d0,
>     proto=0x7ffd4f7ed7b0) at /build/make-pkg/output/_packages/cp-routing/src/nhrpd/nhrp_packet.c:180
> FRRouting#9  0x00005f75d5434652 in nhrp_peer_forward (p=0x5f75f2605f30, pp=0x7ffd4f7ed8c0)
>     at /build/make-pkg/output/_packages/cp-routing/src/nhrpd/nhrp_peer.c:1050
> FRRouting#10 0x00005f75d54356cb in nhrp_peer_recv (p=0x5f75f2605f30, zb=0x5f75f2627da0)
>     at /build/make-pkg/output/_packages/cp-routing/src/nhrpd/nhrp_peer.c:1341
> FRRouting#11 0x00005f75d5430d8e in nhrp_packet_recvraw (t=0x7ffd4f7ede80)
>     at /build/make-pkg/output/_packages/cp-routing/src/nhrpd/nhrp_packet.c:332
> FRRouting#12 0x0000770b0f521188 in thread_call (thread=0x7ffd4f7ede80)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/thread.c:1825
> FRRouting#13 0x0000770b0f4b7737 in frr_run (master=0x5f75f2440570)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1155
> FRRouting#14 0x00005f75d542d2b4 in main (argc=3, argv=0x7ffd4f7ee0b8)
>     at /build/make-pkg/output/_packages/cp-routing/src/nhrpd/nhrp_main.c:317

The incoming nhrp packet is too short, and the call to sockunion_set()
uses a 0x0 memory zone, because the whole nhrp packet has been parsed,
and the zbuf length used was 0. Fix this by detecting the zbuf remaining
length before calling sockunion_set.

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
(cherry picked from commit 30e479e)
choppsv1 pushed a commit that referenced this pull request Aug 24, 2025
issue detected by Address Sanitizer Error :

Address Sanitizer Error detected in /tmp_topotests/bgp_listen_l3vrf.test_bgp_listen_l3vrf/r1.asan.bgpd.6703

=================================================================
==6703==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 56 byte(s) in 1 object(s) allocated from:
    #0 0x7f34c28b83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
    #1 0x7f34c241b45a in qcalloc lib/memory.c:111
    #2 0x7f34c247b1da in prefix_new lib/prefix.c:1192
    #3 0x55e0992e2041 in peer_group_listen_range_add bgpd/bgpd.c:3258
    #4 0x55e099282694 in bgp_listen_range bgpd/bgp_vty.c:4848
    FRRouting#5 0x7f34c2397bc0 in cmd_execute_command_real lib/command.c:1011
    FRRouting#6 0x7f34c2397edf in cmd_execute_command lib/command.c:1070
    FRRouting#7 0x7f34c239840b in cmd_execute lib/command.c:1236
    FRRouting#8 0x7f34c24e204e in vty_command lib/vty.c:626
    FRRouting#9 0x7f34c24e259b in vty_execute lib/vty.c:1389
    FRRouting#10 0x7f34c24e5f97 in vtysh_read lib/vty.c:2408
    FRRouting#11 0x7f34c24d2958 in event_call lib/event.c:2005
    FRRouting#12 0x7f34c23fc4e0 in frr_run lib/libfrr.c:1247
    FRRouting#13 0x55e0990949ff in main bgpd/bgp_main.c:565
    FRRouting#14 0x7f34c1e2c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: 56 byte(s) leaked in 1 allocation(s).
***********************************************************************************

Signed-off-by: Francois Dumontet <francois.dumontet@6wind.com>
choppsv1 pushed a commit that referenced this pull request Aug 24, 2025
Memory leak happens when modifying srv6 configuration. Some sid
notifications events will flush a valid srv6 context.

> Direct leak of 736 byte(s) in 2 object(s) allocated from:
>     #0 0x7c112c0fd340 in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
>     #1 0x7c112bc3595e in qcalloc lib/memory.c:111
>     #2 0x7c112bc4d37e in srv6_locator_alloc lib/srv6.c:227
>     #3 0x5f9fa87e7acf in bgp_zebra_srv6_sid_notify bgpd/bgp_zebra.c:3662
>     #4 0x7c112bd32d12 in zclient_read lib/zclient.c:4804
>     FRRouting#5 0x7c112bcfaa90 in event_call lib/event.c:2005
>     FRRouting#6 0x7c112bc118a7 in frr_run lib/libfrr.c:1252
>     FRRouting#7 0x5f9fa85674b4 in main bgpd/bgp_main.c:565
>     FRRouting#8 0x7c112b42a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
>     FRRouting#9 0x7c112b42a28a in __libc_start_main_impl ../csu/libc-start.c:360
>     FRRouting#10 0x5f9fa856cbd4 in _start (/usr/lib/frr/bgpd+0x2d5bd4) (BuildId: 16288c5292cf235ab5251a93b7dbae5874c3f4bc)
>
> Indirect leak of 80 byte(s) in 2 object(s) allocated from:
>     #0 0x7c112c0fd340 in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
>     #1 0x7c112bc3595e in qcalloc lib/memory.c:111
>     #2 0x7c112bc4d396 in srv6_locator_alloc lib/srv6.c:229
>     #3 0x5f9fa87e7acf in bgp_zebra_srv6_sid_notify bgpd/bgp_zebra.c:3662
>     #4 0x7c112bd32d12 in zclient_read lib/zclient.c:4804
>     FRRouting#5 0x7c112bcfaa90 in event_call lib/event.c:2005
>     FRRouting#6 0x7c112bc118a7 in frr_run lib/libfrr.c:1252
>     FRRouting#7 0x5f9fa85674b4 in main bgpd/bgp_main.c:565
>     FRRouting#8 0x7c112b42a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
>     FRRouting#9 0x7c112b42a28a in __libc_start_main_impl ../csu/libc-start.c:360
>     FRRouting#10 0x5f9fa856cbd4 in _start (/usr/lib/frr/bgpd+0x2d5bd4) (BuildId: 16288c5292cf235ab5251a93b7dbae5874c3f4bc)

Fixes: 7a2e64e ("bgpd: Receive SRv6 SIDs notification from zebra")
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
choppsv1 pushed a commit that referenced this pull request Aug 24, 2025
When SRv6 locator is modified for configuration, a memory leak is
observed.

> ==26714==ERROR: LeakSanitizer: detected memory leaks
>
> Direct leak of 1104 byte(s) in 3 object(s) allocated from:
>     #0 0x7fb232cb83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
>     #1 0x7fb232822b79 in qcalloc lib/memory.c:111
>     #2 0x7fb23283a8b6 in srv6_locator_alloc lib/srv6.c:227
>     #3 0x56347cdd4b57 in bgp_zebra_srv6_sid_notify bgpd/bgp_zebra.c:3661
>     #4 0x7fb23290d03e in zclient_read lib/zclient.c:4804
>     FRRouting#5 0x7fb2328da6a0 in event_call lib/event.c:2005
>     FRRouting#6 0x7fb232800791 in frr_run lib/libfrr.c:1252
>     FRRouting#7 0x56347cb929ff in main bgpd/bgp_main.c:565
>     FRRouting#8 0x7fb23222c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
choppsv1 pushed a commit that referenced this pull request Aug 24, 2025
The `match->rule_str` may is NULL, like:
```
ip prefix-list plist1 deny any
route-map rm1 deny 10
 match evpn default-route
```

The stack:
```
 #0  __strcmp_sse42 () at ../sysdeps/x86_64/multiarch/strcmp-sse4_2.S:173
 #1  0x00007ffff7e5a7ea in route_map_pentry_process_dependency (
     bucket=0x5555561fb270, data=0x7fffffff96e0) at ../lib/routemap.c:2466
 #2  0x00007ffff7de983d in hash_iterate (hash=0x555556208e50,
     func=0x7ffff7e5a6f3 <route_map_pentry_process_dependency>, arg=0x7fffffff96e0)
     at ../lib/hash.c:252
 #3  0x00007ffff7e5a99d in route_map_notify_pentry_dependencies (
     affected_name=0x5555561fb720 "plist1", pentry=0x555556201040,
     event=RMAP_EVENT_PLIST_ADDED) at ../lib/routemap.c:2513
 #4  0x00007ffff7e4a275 in prefix_list_entry_update_finish (ple=0x555556201040)
     at ../lib/plist.c:697
 FRRouting#5  0x00007ffff7de38c9 in lib_prefix_list_entry_apply_finish (args=0x7fffffff97b0)
     at ../lib/filter_nb.c:1233
 FRRouting#6  0x00007ffff7e3228a in nb_callback_apply_finish (context=0x555556204970,
     nb_node=0x555555b51860, dnode=0x5555561e47b0, errmsg=0x7fffffff9d00 "",
    errmsg_len=8192) at ../lib/northbound.c:1772
```

Signed-off-by: anlan_cs <anlan_cs@126.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant