Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

zebra: fix heap-use-after free on ns shutdown #17020

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
+22 −4
Open

zebra: fix heap-use-after free on ns shutdown #17020

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion zebra/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,7 +238,7 @@ void zebra_finalize(struct event *dummy)
zebra_ns_notify_close();

/* Final shutdown of ns resources */
ns_walk_func(zebra_ns_final_shutdown, NULL, NULL);
ns_walk_func(zebra_ns_kernel_shutdown, NULL, NULL);

zebra_rib_terminate();
zebra_router_terminate();
Expand All @@ -251,6 +251,8 @@ void zebra_finalize(struct event *dummy)

label_manager_terminate();

ns_walk_func(zebra_ns_final_shutdown, NULL, NULL);

ns_terminate();
frr_fini();
exit(0);
Expand Down
20 changes: 17 additions & 3 deletions zebra/zebra_ns.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,22 @@ int zebra_ns_early_shutdown(struct ns *ns,
return NS_WALK_CONTINUE;
}

/* During zebra shutdown, do kernel cleanup
* netlink sockets, ..
*/
int zebra_ns_kernel_shutdown(struct ns *ns, void *param_in __attribute__((unused)),
void **param_out __attribute__((unused)))
{
struct zebra_ns *zns = ns->info;

if (zns == NULL)
return NS_WALK_CONTINUE;

kernel_terminate(zns, true);

return NS_WALK_CONTINUE;
}

/* During zebra shutdown, do final cleanup
* after all dataplane work is complete.
*/
Expand All @@ -185,9 +201,7 @@ int zebra_ns_final_shutdown(struct ns *ns,
struct zebra_ns *zns = ns->info;

if (zns == NULL)
return 0;

kernel_terminate(zns, true);
return NS_WALK_CONTINUE;

zebra_ns_delete(ns);

Expand Down
2 changes: 2 additions & 0 deletions zebra/zebra_ns.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,8 @@ int zebra_ns_early_shutdown(struct ns *ns,
int zebra_ns_final_shutdown(struct ns *ns,
void *param_in __attribute__((unused)),
void **param_out __attribute__((unused)));
int zebra_ns_kernel_shutdown(struct ns *ns, void *param_in __attribute__((unused)),
void **param_out __attribute__((unused)));

void zebra_ns_startup_continue(struct zebra_dplane_ctx *ctx);

Expand Down
Loading