Skip to content

Conversation

@eqvinox
Copy link
Contributor

@eqvinox eqvinox commented Dec 16, 2016

CI is finally green on this (except clang static-analysis box which has no flex&bison installed).

This makes grammar_sandbox a workable tool again, updating it for the
recent changes.

Signed-off-by: David Lamparter <[email protected]>
This re-adds "{foo WORD|bar WORD}" keyword-argument support to the CLI
parser.  Note that token graphs may now contain loops for this purpose;
therefore the matching functions retain a history of already-matched
tokens.  Each token can thus only be consumed once.

And then LINE... gets its special treatment with allowrepeat.

Signed-off-by: David Lamparter <[email protected]>
If <Tab> processing finds that there is only 1 candidate, but that
candidate is not a WORD_TKN that we can tab-complete on, the status
would remain at CMD_COMPLETE_FULL_MATCH, but the resulting list of
possible completions is empty.

This then SEGVs in lib/vty.c where it tries to access the first element
of the list, assuming FULL_MATCH always has 1 element there...

Signed-off-by: David Lamparter <[email protected]>
Cc: Quentin Young <[email protected]>
Now that we have keyword argument support in the matcher again, this
needs to be updated because argv[] will be 1:1 user input without
mangling or reordering.

Signed-off-by: David Lamparter <[email protected]>
This was SEGV'ing the test in bgp_master_init() since QOBJ_REG was used
without qobj_init() being called first.

Signed-off-by: David Lamparter <[email protected]>
exit 0 exits the entire testrunner... Oops.
Also, "unresolved" breaks too many things, so make this a pass.

Signed-off-by: David Lamparter <[email protected]>
PRIu64 is "u", we need "x", so PRIx64...

Signed-off-by: David Lamparter <[email protected]>
Cc: Donald Sharp <[email protected]>
bison-2.7.x really wants "foo" for api.prefix while bison-3.0.x really
wants {foo} ... great.

Signed-off-by: David Lamparter <[email protected]>
This shuffles the code blocks in command_parser.y to match file output
order, then adjusts things to make the include handling less messy.

(also dropped unused DECIMAL_STRLEN_MAX define.)

This should hopefully fix the build on NetBSD 6.

Signed-off-by: David Lamparter <[email protected]>
bgp_master_init is called first thing in main(), so we need to wedge a
qobj_init() call in there...  this needs some improvement...

Signed-off-by: David Lamparter <[email protected]>
struct graph_node isn't quite the right place to control matcher
behaviour.

Signed-off-by: David Lamparter <[email protected]>
bison conditionally writes its output to different files based on the
filenames specified in the source code.  This could be disabled,
however...  flex changes its output filenames when "prefix" is
specified.  And ylwrap from <1.11 doesn't understand how to handle the
header file...

...so this requires automake 1.12 which can deal with this properly.

Signed-off-by: David Lamparter <[email protected]>
@eqvinox eqvinox force-pushed the dev/osr/fixes_plus_vty_keywords branch from 564d443 to a6cf5da Compare December 16, 2016 20:03
@donaldsharp donaldsharp merged commit bcfb39a into master Dec 16, 2016
@donaldsharp
Copy link
Member

Thanks!

Pdoijode added a commit to Pdoijode/frr that referenced this pull request Nov 4, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Nov 4, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Nov 17, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Nov 17, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Nov 17, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Nov 19, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Nov 19, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Nov 25, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
pguibert6WIND added a commit to pguibert6WIND/frr that referenced this pull request Dec 2, 2025
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> FRRouting#1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> FRRouting#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> FRRouting#3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> FRRouting#4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> FRRouting#5  <signal handler called>
> FRRouting#6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> FRRouting#7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> FRRouting#8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> FRRouting#9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> FRRouting#10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> FRRouting#11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Dec 4, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Dec 16, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Dec 17, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Dec 22, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Dec 22, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Dec 23, 2025
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
pguibert6WIND added a commit to pguibert6WIND/frr that referenced this pull request Jan 2, 2026
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> FRRouting#1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> FRRouting#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> FRRouting#3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> FRRouting#4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> FRRouting#5  <signal handler called>
> FRRouting#6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> FRRouting#7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> FRRouting#8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> FRRouting#9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> FRRouting#10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> FRRouting#11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
mergify bot pushed a commit that referenced this pull request Jan 13, 2026
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> #3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> #5  <signal handler called>
> #6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> #7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> #8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> #9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> #10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> #11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
(cherry picked from commit 65269be)
mergify bot pushed a commit that referenced this pull request Jan 13, 2026
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> #3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> #5  <signal handler called>
> #6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> #7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> #8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> #9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> #10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> #11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
(cherry picked from commit 65269be)
mergify bot pushed a commit that referenced this pull request Jan 13, 2026
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> #3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> #5  <signal handler called>
> #6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> #7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> #8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> #9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> #10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> #11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
(cherry picked from commit 65269be)
mergify bot pushed a commit that referenced this pull request Jan 13, 2026
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> #3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> #5  <signal handler called>
> #6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> #7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> #8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> #9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> #10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> #11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
(cherry picked from commit 65269be)
mergify bot pushed a commit that referenced this pull request Jan 13, 2026
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> #3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> #5  <signal handler called>
> #6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> #7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> #8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> #9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> #10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> #11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
(cherry picked from commit 65269be)
mergify bot pushed a commit that referenced this pull request Jan 13, 2026
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> #3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> #5  <signal handler called>
> #6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> #7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> #8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> #9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> #10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> #11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
(cherry picked from commit 65269be)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants