Skip to content

parser: accept non-words as first tokens & numbers as word tokens #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
donaldsharp merged 2 commits into from
Dec 16, 2016
Merged

parser: accept non-words as first tokens & numbers as word tokens #6

donaldsharp merged 2 commits into from
Dec 16, 2016

Conversation

@eqvinox
Copy link
Contributor

@eqvinox eqvinox commented Dec 16, 2016

No description provided.

@eqvinox
lib: parser: accept number-only word tokens
bca1a30 
There seems to be no reason why numbers don't work as plain word tokens;
this is useful to have "number choices" or constants, e.g. <128|192|256>
for bit encryption lengths.

Signed-off-by: David Lamparter <[email protected]>
@eqvinox
lib: parser: remove startnode & sentence_root
fd19e7a 
This removes an artificial restriction for the first token in a
command's graph to be a WORD_TKN.  The intention seems to be to prohibit
empty paths through a command, and to restrict "explosion" of choices in
the root node.

The better approach to the former is to check for an empty path after
the definition is parsed.  The latter will happen anyway, by duplication
of the command, which just makes it worse...

Signed-off-by: David Lamparter <[email protected]>
@donaldsharp
Copy link
Member

donaldsharp commented Dec 16, 2016

Thanks all!

@donaldsharp donaldsharp merged commit 6cc1ba0 into FRRouting:master Dec 16, 2016
@eqvinox eqvinox deleted the dev/osr/vty_pending branch January 19, 2017 13:04
eqvinox referenced this pull request in opensourcerouting/frr Mar 25, 2017
@reuteran
Merge pull request #6 from ColinBS/feature/rtrlib
ec156f4 
Build Quagga without SSH support of RTRlib
@anithanarasimhamurthy anithanarasimhamurthy mentioned this pull request May 17, 2017
Closed
@pguibert6WIND pguibert6WIND mentioned this pull request Jul 17, 2017
Closed
This was referenced Sep 5, 2017
Closed
Closed
@louberger louberger mentioned this pull request Dec 13, 2017
Merged
@louberger louberger mentioned this pull request Jan 24, 2018
Merged
This was referenced May 14, 2018
Closed
Closed
Closed
@mdtancsa mdtancsa mentioned this pull request May 31, 2018
Closed
@donaldsharp donaldsharp mentioned this pull request Jun 13, 2018
Closed
@nuqleo nuqleo mentioned this pull request Jun 16, 2018
Closed
@rwestphal rwestphal mentioned this pull request Jul 9, 2018
Merged
@louberger louberger mentioned this pull request Jul 11, 2018
Closed
@louberger louberger mentioned this pull request Aug 27, 2018
Merged
@srimohans srimohans mentioned this pull request Sep 11, 2018
Closed
@donaldsharp donaldsharp mentioned this pull request Sep 21, 2018
Closed
@mdash-vmware mdash-vmware mentioned this pull request Oct 8, 2018
Closed
@donaldsharp donaldsharp mentioned this pull request Oct 30, 2018
Closed
@karamalla0406 karamalla0406 mentioned this pull request Nov 14, 2018
Closed
@vijaykug vijaykug mentioned this pull request Nov 16, 2018
Closed
cfra referenced this pull request in opensourcerouting/frr Nov 29, 2018
@rwestphal
Merge pull request #6 from donaldsharp/mpls2
1930120 
Mpls2
@nitinsoniism nitinsoniism mentioned this pull request Jan 24, 2019
Merged
@jasonlittledragon jasonlittledragon mentioned this pull request Jan 28, 2019
Closed
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Nov 19, 2025
@Pdoijode
zebra: Fix for use after free in GR
6c6ff75 
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Nov 19, 2025
@Pdoijode
zebra: Fix for use after free in GR
1557dee 
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Nov 25, 2025
@Pdoijode
zebra: Fix for use after free in GR
3dae024 
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
pguibert6WIND added a commit to pguibert6WIND/frr that referenced this pull request Dec 2, 2025
@pguibert6WIND
isisd: fix crash when changing isis type
4ccdce7 
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> FRRouting#1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> FRRouting#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> FRRouting#3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> FRRouting#4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> FRRouting#5  <signal handler called>
> FRRouting#6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> FRRouting#7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> FRRouting#8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> FRRouting#9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> FRRouting#10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> FRRouting#11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
@pguibert6WIND pguibert6WIND mentioned this pull request Dec 2, 2025
Merged
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Dec 4, 2025
@Pdoijode
zebra: Fix for use after free in GR
bd9fbb1 
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Dec 16, 2025
@Pdoijode
zebra: Fix for use after free in GR
5ddebf4 
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Dec 17, 2025
@Pdoijode
zebra: Fix for use after free in GR
63faf31 
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Dec 22, 2025
@Pdoijode
zebra: Fix for use after free in GR
39c60a0 
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Dec 22, 2025
@Pdoijode
zebra: Fix for use after free in GR
ce826ab 
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
Pdoijode added a commit to Pdoijode/frr that referenced this pull request Dec 23, 2025
@Pdoijode
zebra: Fix for use after free in GR
f4c30f0 
Error:

    ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000ef8a0 at pc 0x555df66ba094 bp 0x7ffc13d67240 sp 0x7ffc13d67238
    READ of size 4 at 0x6070000ef8a0 thread T0
        #0 0x555df66ba093 in zebra_gr_delete_stale_route_table_afi zebra/zebra_gr.c:514
        FRRouting#1 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#2 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#3 0x555df66531ec in main zebra/main.c:552
        FRRouting#4 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        FRRouting#5 0x7fd33d10c304 in __libc_start_main_impl ../csu/libc-start.c:360
        FRRouting#6 0x555df6626b40 in _start (/usr/lib/frr/zebra+0x1a1b40)

    0x6070000ef8a0 is located 0 bytes inside of 72-byte region [0x6070000ef8a0,0x6070000ef8e8)
    freed by thread T0 here:
        #0 0x7fd33dab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        FRRouting#1 0x7fd33d622cd5 in qfree lib/memory.c:136
        FRRouting#2 0x555df66b9e5f in zebra_gr_client_info_delete zebra/zebra_gr.c:130
        FRRouting#3 0x555df66bc66f in zread_client_capabilities zebra/zebra_gr.c:355
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        #0 0x7fd33dab83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        FRRouting#1 0x7fd33d6223e2 in qcalloc lib/memory.c:111
        FRRouting#2 0x555df66bbace in zebra_gr_client_info_create zebra/zebra_gr.c:101
        FRRouting#3 0x555df66bbace in zread_client_capabilities zebra/zebra_gr.c:360
        FRRouting#4 0x555df66a025c in zserv_handle_commands zebra/zapi_msg.c:4228
        FRRouting#5 0x555df67cde33 in zserv_process_messages zebra/zserv.c:565
        FRRouting#6 0x7fd33d6db06e in event_call lib/event.c:2013
        FRRouting#7 0x7fd33d5fffa1 in frr_run lib/libfrr.c:1257
        FRRouting#8 0x555df66531ec in main zebra/main.c:552
        FRRouting#9 0x7fd33d10c249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Signed-off-by: Pooja Jagadeesh Doijode <[email protected]>
pguibert6WIND added a commit to pguibert6WIND/frr that referenced this pull request Dec 24, 2025
@pguibert6WIND
bgpd: fix crash when reconfiguring func-bits value in locator
371469d 
The following crash happens on a BGP setup with SRv6 used, when locator
is updated with the func-bits value moving from 32 bits to 16 bits.

> FRRouting#6  0x000061582b486b5c in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>)
>     at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
> FRRouting#7  vpn_leak_from_vrf_update (to_bgp=to_bgp@entry=0x6158364a0340, from_bgp=from_bgp@entry=0x6158364c1040,
>     path_vrf=path_vrf@entry=0x6158364ef110) at bgpd/bgp_mplsvpn.c:2010
> FRRouting#8  0x000061582b48758b in vpn_leak_from_vrf_update_all (to_bgp=to_bgp@entry=0x6158364a0340, from_bgp=from_bgp@entry=0x6158364c1040,
>     afi=<optimized out>) at bgpd/bgp_mplsvpn.c:2215
> FRRouting#9  0x000061582b48774d in vpn_leak_postchange (afi=afi@entry=AFI_IP, bgp_vpn=bgp_vpn@entry=0x6158364a0340,
>     bgp_vrf=bgp_vrf@entry=0x6158364c1040, direction=BGP_VPN_POLICY_DIR_TOVPN) at ./bgpd/bgp_mplsvpn.h:313
> FRRouting#10 0x000061582b489b4b in vpn_leak_postchange (bgp_vrf=0x6158364c1040, bgp_vpn=0x6158364a0340, afi=AFI_IP, direction=BGP_VPN_POLICY_DIR_TOVPN)
>     at ./bgpd/bgp_mplsvpn.h:273
> FRRouting#11 vpn_leak_postchange_all () at bgpd/bgp_mplsvpn.c:3978
> FRRouting#12 0x000061582b5219d5 in bgp_zebra_process_srv6_locator_delete (cmd=<optimized out>, zclient=<optimized out>, length=<optimized out>,
>     vrf_id=<optimized out>) at bgpd/bgp_zebra.c:3874
> FRRouting#13 0x0000766887b391ee in zclient_read (thread=<optimized out>) at lib/zclient.c:4804
> FRRouting#14 0x0000766887b2245e in event_call (thread=thread@entry=0x7ffc86531a30) at lib/event.c:2005
> FRRouting#15 0x0000766887ac2ed8 in frr_run (loop=0x615835c46fd0) at lib/libfrr.c:1252
> FRRouting#16 0x000061582b428163 in main (argc=<optimized out>, argv=0x7ffc86531cf8) at bgpd/bgp_main.c:565
> (gdb)
>

Actually, the SID allocated has been freed after the locator deleted
event. Protect this part of code by checking the availability of the
sid pointer.

Signed-off-by: Philippe Guibert <[email protected]>
pguibert6WIND added a commit to pguibert6WIND/frr that referenced this pull request Dec 24, 2025
@pguibert6WIND
bgpd: fix crash when reconfiguring func-bits value in locator
0375cd5 
The following crash happens on a BGP setup with SRv6 used, when locator
is updated with the func-bits value moving from 32 bits to 16 bits.

> FRRouting#6  0x000061582b486b5c in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>)
>     at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
> FRRouting#7  vpn_leak_from_vrf_update (to_bgp=to_bgp@entry=0x6158364a0340, from_bgp=from_bgp@entry=0x6158364c1040,
>     path_vrf=path_vrf@entry=0x6158364ef110) at bgpd/bgp_mplsvpn.c:2010
> FRRouting#8  0x000061582b48758b in vpn_leak_from_vrf_update_all (to_bgp=to_bgp@entry=0x6158364a0340, from_bgp=from_bgp@entry=0x6158364c1040,
>     afi=<optimized out>) at bgpd/bgp_mplsvpn.c:2215
> FRRouting#9  0x000061582b48774d in vpn_leak_postchange (afi=afi@entry=AFI_IP, bgp_vpn=bgp_vpn@entry=0x6158364a0340,
>     bgp_vrf=bgp_vrf@entry=0x6158364c1040, direction=BGP_VPN_POLICY_DIR_TOVPN) at ./bgpd/bgp_mplsvpn.h:313
> FRRouting#10 0x000061582b489b4b in vpn_leak_postchange (bgp_vrf=0x6158364c1040, bgp_vpn=0x6158364a0340, afi=AFI_IP, direction=BGP_VPN_POLICY_DIR_TOVPN)
>     at ./bgpd/bgp_mplsvpn.h:273
> FRRouting#11 vpn_leak_postchange_all () at bgpd/bgp_mplsvpn.c:3978
> FRRouting#12 0x000061582b5219d5 in bgp_zebra_process_srv6_locator_delete (cmd=<optimized out>, zclient=<optimized out>, length=<optimized out>,
>     vrf_id=<optimized out>) at bgpd/bgp_zebra.c:3874
> FRRouting#13 0x0000766887b391ee in zclient_read (thread=<optimized out>) at lib/zclient.c:4804
> FRRouting#14 0x0000766887b2245e in event_call (thread=thread@entry=0x7ffc86531a30) at lib/event.c:2005
> FRRouting#15 0x0000766887ac2ed8 in frr_run (loop=0x615835c46fd0) at lib/libfrr.c:1252
> FRRouting#16 0x000061582b428163 in main (argc=<optimized out>, argv=0x7ffc86531cf8) at bgpd/bgp_main.c:565
> (gdb)
>

Actually, the SID allocated has been freed after the locator deleted
event. Protect this part of code by checking the availability of the
sid pointer.

Signed-off-by: Philippe Guibert <[email protected]>
@Shbinging Shbinging mentioned this pull request Dec 25, 2025
Closed
2 tasks
pguibert6WIND added a commit to pguibert6WIND/frr that referenced this pull request Jan 2, 2026
@pguibert6WIND
isisd: fix crash when changing isis type
65269be 
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> FRRouting#1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> FRRouting#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> FRRouting#3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> FRRouting#4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> FRRouting#5  <signal handler called>
> FRRouting#6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> FRRouting#7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> FRRouting#8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> FRRouting#9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> FRRouting#10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> FRRouting#11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
pguibert6WIND added a commit to pguibert6WIND/frr that referenced this pull request Jan 7, 2026
@pguibert6WIND
bgpd: fix crash when reconfiguring func-bits value in locator
adb32bc 
The following crash happens on a BGP setup with SRv6 used, when locator
is updated with the func-bits value moving from 32 bits to 16 bits.

> FRRouting#6  0x000061582b486b5c in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>)
>     at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
> FRRouting#7  vpn_leak_from_vrf_update (to_bgp=to_bgp@entry=0x6158364a0340, from_bgp=from_bgp@entry=0x6158364c1040,
>     path_vrf=path_vrf@entry=0x6158364ef110) at bgpd/bgp_mplsvpn.c:2010
> FRRouting#8  0x000061582b48758b in vpn_leak_from_vrf_update_all (to_bgp=to_bgp@entry=0x6158364a0340, from_bgp=from_bgp@entry=0x6158364c1040,
>     afi=<optimized out>) at bgpd/bgp_mplsvpn.c:2215
> FRRouting#9  0x000061582b48774d in vpn_leak_postchange (afi=afi@entry=AFI_IP, bgp_vpn=bgp_vpn@entry=0x6158364a0340,
>     bgp_vrf=bgp_vrf@entry=0x6158364c1040, direction=BGP_VPN_POLICY_DIR_TOVPN) at ./bgpd/bgp_mplsvpn.h:313
> FRRouting#10 0x000061582b489b4b in vpn_leak_postchange (bgp_vrf=0x6158364c1040, bgp_vpn=0x6158364a0340, afi=AFI_IP, direction=BGP_VPN_POLICY_DIR_TOVPN)
>     at ./bgpd/bgp_mplsvpn.h:273
> FRRouting#11 vpn_leak_postchange_all () at bgpd/bgp_mplsvpn.c:3978
> FRRouting#12 0x000061582b5219d5 in bgp_zebra_process_srv6_locator_delete (cmd=<optimized out>, zclient=<optimized out>, length=<optimized out>,
>     vrf_id=<optimized out>) at bgpd/bgp_zebra.c:3874
> FRRouting#13 0x0000766887b391ee in zclient_read (thread=<optimized out>) at lib/zclient.c:4804
> FRRouting#14 0x0000766887b2245e in event_call (thread=thread@entry=0x7ffc86531a30) at lib/event.c:2005
> FRRouting#15 0x0000766887ac2ed8 in frr_run (loop=0x615835c46fd0) at lib/libfrr.c:1252
> FRRouting#16 0x000061582b428163 in main (argc=<optimized out>, argv=0x7ffc86531cf8) at bgpd/bgp_main.c:565
> (gdb)
>

Actually, the SID allocated has been freed after the locator deleted
event. Protect this part of code by checking the availability of the
sid pointer.

Signed-off-by: Philippe Guibert <[email protected]>
pguibert6WIND added a commit to pguibert6WIND/frr that referenced this pull request Jan 8, 2026
@pguibert6WIND
bgpd: fix crash when reconfiguring func-bits value in locator
c7c0eac 
The following crash happens on a BGP setup with SRv6 used, when locator
is updated with the func-bits value moving from 32 bits to 16 bits.

> FRRouting#6  0x000061582b486b5c in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>)
>     at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
> FRRouting#7  vpn_leak_from_vrf_update (to_bgp=to_bgp@entry=0x6158364a0340, from_bgp=from_bgp@entry=0x6158364c1040,
>     path_vrf=path_vrf@entry=0x6158364ef110) at bgpd/bgp_mplsvpn.c:2010
> FRRouting#8  0x000061582b48758b in vpn_leak_from_vrf_update_all (to_bgp=to_bgp@entry=0x6158364a0340, from_bgp=from_bgp@entry=0x6158364c1040,
>     afi=<optimized out>) at bgpd/bgp_mplsvpn.c:2215
> FRRouting#9  0x000061582b48774d in vpn_leak_postchange (afi=afi@entry=AFI_IP, bgp_vpn=bgp_vpn@entry=0x6158364a0340,
>     bgp_vrf=bgp_vrf@entry=0x6158364c1040, direction=BGP_VPN_POLICY_DIR_TOVPN) at ./bgpd/bgp_mplsvpn.h:313
> FRRouting#10 0x000061582b489b4b in vpn_leak_postchange (bgp_vrf=0x6158364c1040, bgp_vpn=0x6158364a0340, afi=AFI_IP, direction=BGP_VPN_POLICY_DIR_TOVPN)
>     at ./bgpd/bgp_mplsvpn.h:273
> FRRouting#11 vpn_leak_postchange_all () at bgpd/bgp_mplsvpn.c:3978
> FRRouting#12 0x000061582b5219d5 in bgp_zebra_process_srv6_locator_delete (cmd=<optimized out>, zclient=<optimized out>, length=<optimized out>,
>     vrf_id=<optimized out>) at bgpd/bgp_zebra.c:3874
> FRRouting#13 0x0000766887b391ee in zclient_read (thread=<optimized out>) at lib/zclient.c:4804
> FRRouting#14 0x0000766887b2245e in event_call (thread=thread@entry=0x7ffc86531a30) at lib/event.c:2005
> FRRouting#15 0x0000766887ac2ed8 in frr_run (loop=0x615835c46fd0) at lib/libfrr.c:1252
> FRRouting#16 0x000061582b428163 in main (argc=<optimized out>, argv=0x7ffc86531cf8) at bgpd/bgp_main.c:565
> (gdb)
>

Actually, the SID allocated has been freed after the locator deleted
event. Protect this part of code by checking the availability of the
sid pointer.

Signed-off-by: Philippe Guibert <[email protected]>
pguibert6WIND added a commit to pguibert6WIND/frr that referenced this pull request Jan 8, 2026
@pguibert6WIND
bgpd: fix crash when reconfiguring func-bits value in locator
4a796ea 
The following crash happens on a BGP setup with SRv6 used, when locator
is updated with the func-bits value moving from 32 bits to 16 bits.

> FRRouting#6  0x000061582b486b5c in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>)
>     at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
> FRRouting#7  vpn_leak_from_vrf_update (to_bgp=to_bgp@entry=0x6158364a0340, from_bgp=from_bgp@entry=0x6158364c1040,
>     path_vrf=path_vrf@entry=0x6158364ef110) at bgpd/bgp_mplsvpn.c:2010
> FRRouting#8  0x000061582b48758b in vpn_leak_from_vrf_update_all (to_bgp=to_bgp@entry=0x6158364a0340, from_bgp=from_bgp@entry=0x6158364c1040,
>     afi=<optimized out>) at bgpd/bgp_mplsvpn.c:2215
> FRRouting#9  0x000061582b48774d in vpn_leak_postchange (afi=afi@entry=AFI_IP, bgp_vpn=bgp_vpn@entry=0x6158364a0340,
>     bgp_vrf=bgp_vrf@entry=0x6158364c1040, direction=BGP_VPN_POLICY_DIR_TOVPN) at ./bgpd/bgp_mplsvpn.h:313
> FRRouting#10 0x000061582b489b4b in vpn_leak_postchange (bgp_vrf=0x6158364c1040, bgp_vpn=0x6158364a0340, afi=AFI_IP, direction=BGP_VPN_POLICY_DIR_TOVPN)
>     at ./bgpd/bgp_mplsvpn.h:273
> FRRouting#11 vpn_leak_postchange_all () at bgpd/bgp_mplsvpn.c:3978
> FRRouting#12 0x000061582b5219d5 in bgp_zebra_process_srv6_locator_delete (cmd=<optimized out>, zclient=<optimized out>, length=<optimized out>,
>     vrf_id=<optimized out>) at bgpd/bgp_zebra.c:3874
> FRRouting#13 0x0000766887b391ee in zclient_read (thread=<optimized out>) at lib/zclient.c:4804
> FRRouting#14 0x0000766887b2245e in event_call (thread=thread@entry=0x7ffc86531a30) at lib/event.c:2005
> FRRouting#15 0x0000766887ac2ed8 in frr_run (loop=0x615835c46fd0) at lib/libfrr.c:1252
> FRRouting#16 0x000061582b428163 in main (argc=<optimized out>, argv=0x7ffc86531cf8) at bgpd/bgp_main.c:565
> (gdb)
>

Actually, the SID allocated has been freed after the locator deleted
event. Protect this part of code by checking the availability of the
sid pointer.

Signed-off-by: Philippe Guibert <[email protected]>
mergify bot pushed a commit that referenced this pull request Jan 13, 2026
@pguibert6WIND @mergify
isisd: fix crash when changing isis type
383e286 
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> #3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> #5  <signal handler called>
> #6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> #7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> #8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> #9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> #10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> #11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
(cherry picked from commit 65269be)
@mergify mergify bot mentioned this pull request Jan 13, 2026
Merged
mergify bot pushed a commit that referenced this pull request Jan 13, 2026
@pguibert6WIND @mergify
isisd: fix crash when changing isis type
a2d92a0 
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> #3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> #5  <signal handler called>
> #6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> #7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> #8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> #9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> #10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> #11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
(cherry picked from commit 65269be)
@mergify mergify bot mentioned this pull request Jan 13, 2026
Merged
mergify bot pushed a commit that referenced this pull request Jan 13, 2026
@pguibert6WIND @mergify
isisd: fix crash when changing isis type
fb9c51a 
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> #3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> #5  <signal handler called>
> #6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> #7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> #8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> #9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> #10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> #11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
(cherry picked from commit 65269be)
@mergify mergify bot mentioned this pull request Jan 13, 2026
Merged
mergify bot pushed a commit that referenced this pull request Jan 13, 2026
@pguibert6WIND @mergify
isisd: fix crash when changing isis type
2ff4113 
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> #3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> #5  <signal handler called>
> #6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> #7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> #8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> #9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> #10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> #11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
(cherry picked from commit 65269be)
@mergify mergify bot mentioned this pull request Jan 13, 2026
Merged
mergify bot pushed a commit that referenced this pull request Jan 13, 2026
@pguibert6WIND @mergify
isisd: fix crash when changing isis type
d68dd51 
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> #3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> #5  <signal handler called>
> #6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> #7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> #8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> #9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> #10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> #11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
(cherry picked from commit 65269be)
@mergify mergify bot mentioned this pull request Jan 13, 2026
Merged
mergify bot pushed a commit that referenced this pull request Jan 13, 2026
@pguibert6WIND @mergify
isisd: fix crash when changing isis type
a0b3122 
The following crash happens, when moving from level-2 to level-1 an isis
flex-algorithm configuration

> warning: 44     ./nptl/pthread_kill.c: No such file or directory
> [Current thread is 1 (Thread 0x7108d4cb2980 (LWP 1023))]
> (gdb) bt
> #0  __pthread_kill_implementation (no_tid=0, signo=11,
>     threadid=<optimized out>) at ./nptl/pthread_kill.c:44
> #1  __pthread_kill_internal (signo=11, threadid=<optimized out>)
>     at ./nptl/pthread_kill.c:78
> #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
>     at ./nptl/pthread_kill.c:89
> #3  0x00007108d3e4527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
> #4  0x00007108d4b44926 in core_handler (signo=11, siginfo=0x7ffe7c10fb30,
>     context=0x7ffe7c10fa00)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/sigevent.c:248
> #5  <signal handler called>
> #6  0x00005b5d803bf07b in isis_spf_invalidate_routes (tree=0x0)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2118
> #7  0x00005b5d803fb23e in isis_area_invalidate_routes (area=0x5b5db8d5be40,
>     levels=1)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isisd.c:3152
> #8  0x00005b5d803bf280 in isis_run_spf_cb (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_spf.c:2165
> #9  0x00007108d4b5ff7f in event_call (thread=0x7ffe7c110180)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/event.c:2011
> #10 0x00007108d4adb761 in frr_run (master=0x5b5db7f7ca40)
>     at /build/make-pkg/output/_packages/cp-routing/src/lib/libfrr.c:1219
> #11 0x00005b5d8038333a in main (argc=5, argv=0x7ffe7c1103d8,
> --Type <RET> for more, q to quit, c to continue without paging--
>     envp=0x7ffe7c110408)
>     at /build/make-pkg/output/_packages/cp-routing/src/isisd/isis_main.c:360
> (gdb)

Fix this by adding protection before invalidating all routes.

Signed-off-by: Philippe Guibert <[email protected]>
(cherry picked from commit 65269be)
@mergify mergify bot mentioned this pull request Jan 13, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@eqvinox @donaldsharp @qlyoung