]> git.puffer.fish Git - matthieu/frr.git/commit
bgpd: fix use-after-free crash for evpn
authoranlan_cs <vic.lan@pica8.com>
Mon, 6 Feb 2023 01:27:05 +0000 (09:27 +0800)
committerMergify <37929162+mergify[bot]@users.noreply.github.com>
Wed, 8 Feb 2023 08:09:37 +0000 (08:09 +0000)
commit850fe41c793f6b8c5487a01108aeaf67255899f5
tree4c1bff2934ec85f12ab859a5e7a159a6b1075ec8
parent9c8119a01157327eac334d7370b8f56aa0e3ff42
bgpd: fix use-after-free crash for evpn

```
anlan(config-router-af)# vni 33
anlan(config-router-af-vni)# route-target both 44:55
anlan(config-router-af-vni)# no route-target both 44:55
vtysh: error reading from bgpd: Resource temporarily unavailable (11)Warning: closing connection to bgpd because of an I/O error!
```

When `bgp_evpn_vni_rt_cmd` deals with "both" type, it wrongly created
only one node ( should be two nodes ) for lists of both `vpn->import_rtl` and
`vpn->export_rtl`.  At this time, the two lists are already wrong.

In `no route-target both RT`, it will free the single node from lists of both
`vpn->import_rtl` and `vpn->export_rtl`.  After freed from `vpn->import_rtl`,
it is "use-after-free" at the time of freeing it from `vpn->export_rtl`.
It causes crash sometimes, or other unexpected behaviours.

This issue is introduced by commit `3b7e8d`, which have adjusted both
`bgp_evpn_vni_rt_cmd` and `bgp_evpn_vrf_rt_cmd`.

Since `bgp_evpn_vrf_rt_cmd/no_bgp_evpn_vrf_rt_cmd` works well again
unintentionally with commit `7022da`, only `bgp_evpn_vni_rt_cmd` needs to
modify - add two nodes for "both" type and some explicit comments for this
special case of "both" type.

Signed-off-by: anlan_cs <vic.lan@pica8.com>
(cherry picked from commit 432ff4b036860fb626f3027a7798038d594b8042)
bgpd/bgp_evpn_vty.c