From c3343a755fb01e3be9efadad75be719a5b7a3676 Mon Sep 17 00:00:00 2001 From: Donald Sharp Date: Mon, 29 Nov 2021 15:51:45 -0500 Subject: [PATCH] zebra: Prevent thread usage of data after it being freed On startup we create a thread timer event to do a rib sweep of the system. On shutdown we never stopped this timer and as such we have a situation where a thread event could be run on shutdown after the data for it has been freed. Here is the crash I am seeing: (gdb) bt (gdb) Save the thread data in zebra_router and stop the thread so we don't accidently do work on shutdown we don't mean to. In this case it happened in our topotests with some severe system load. Essentially we happened to kill the zebra daemon just as the graceful_restart timer popped here. Signed-off-by: Donald Sharp --- zebra/main.c | 4 ++-- zebra/zebra_router.c | 2 ++ zebra/zebra_router.h | 1 + 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/zebra/main.c b/zebra/main.c index 275d9af5d2..2a8dc39771 100644 --- a/zebra/main.c +++ b/zebra/main.c @@ -443,8 +443,8 @@ int main(int argc, char **argv) * we have to have route_read() called before. */ zrouter.startup_time = monotime(NULL); - thread_add_timer(zrouter.master, rib_sweep_route, - NULL, graceful_restart, NULL); + thread_add_timer(zrouter.master, rib_sweep_route, NULL, + graceful_restart, &zrouter.sweeper); /* Needed for BSD routing socket. */ pid = getpid(); diff --git a/zebra/zebra_router.c b/zebra/zebra_router.c index a80c573855..92a3b9424b 100644 --- a/zebra/zebra_router.c +++ b/zebra/zebra_router.c @@ -232,6 +232,8 @@ void zebra_router_terminate(void) { struct zebra_router_table *zrt, *tmp; + THREAD_OFF(zrouter.sweeper); + RB_FOREACH_SAFE (zrt, zebra_router_table_head, &zrouter.tables, tmp) zebra_router_free_table(zrt); diff --git a/zebra/zebra_router.h b/zebra/zebra_router.h index 408f9cbee5..dd788216c7 100644 --- a/zebra/zebra_router.h +++ b/zebra/zebra_router.h @@ -196,6 +196,7 @@ struct zebra_router { * Time for when we sweep the rib from old routes */ time_t startup_time; + struct thread *sweeper; /* * The hash of nexthop groups associated with this router -- 2.39.5