diff options
| author | Chirag Shah <chirag@nvidia.com> | 2025-01-30 17:26:46 -0800 |
|---|---|---|
| committer | Chirag Shah <chirag@nvidia.com> | 2025-02-03 16:09:20 -0800 |
| commit | 1d4f5b9b19588d77d3eaf06440c26a8c974831a3 (patch) | |
| tree | e80ee830e608783446aec0ec68ab7f9968cb82de /zebra | |
| parent | f54241a34624b55fef3cb717c1fddebf62bef11d (diff) | |
zebra: evpn svd hash avoid double free
Upon zebra shutdown hash_clean_and_free is called
where user free function is passed,
The free function should not call hash_release
which lead to double free of hash bucket.
Fix:
The fix is to avoid calling hash_release from
free function if its called from hash_clean_and_free
path.
10 0x00007f0422b7df1f in free () from /lib/x86_64-linux-gnu/libc.so.6
11 0x00007f0422edd779 in qfree (mt=0x7f0423047ca0 <MTYPE_HASH_BUCKET>,
ptr=0x55fc8bc81980) at ../lib/memory.c:130
12 0x00007f0422eb97e2 in hash_clean (hash=0x55fc8b979a60,
free_func=0x55fc8a529478 <svd_nh_del_terminate>) at
../lib/hash.c:290
13 0x00007f0422eb98a1 in hash_clean_and_free (hash=0x55fc8a675920
<svd_nh_table>, free_func=0x55fc8a529478 <svd_nh_del_terminate>) at
../lib/hash.c:305
14 0x000055fc8a5323a5 in zebra_vxlan_terminate () at
../zebra/zebra_vxlan.c:6099
15 0x000055fc8a4c9227 in zebra_router_terminate () at
../zebra/zebra_router.c:276
16 0x000055fc8a4413b3 in zebra_finalize (dummy=0x7fffb881c1d0) at
../zebra/main.c:269
17 0x00007f0422f44387 in event_call (thread=0x7fffb881c1d0) at
../lib/event.c:2011
18 0x00007f0422ecb6fa in frr_run (master=0x55fc8b733cb0) at
../lib/libfrr.c:1243
19 0x000055fc8a441987 in main (argc=14, argv=0x7fffb881c4a8) at
../zebra/main.c:584
Signed-off-by: Chirag Shah <chirag@nvidia.com>
Diffstat (limited to 'zebra')
| -rw-r--r-- | zebra/zebra_vxlan.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/zebra/zebra_vxlan.c b/zebra/zebra_vxlan.c index c60eeab946..04585f6312 100644 --- a/zebra/zebra_vxlan.c +++ b/zebra/zebra_vxlan.c @@ -1584,7 +1584,7 @@ static void svd_nh_del_terminate(void *ptr) struct zebra_neigh *n = ptr; n->refcnt = 0; - svd_nh_del(n); + XFREE(MTYPE_L3NEIGH, n); } |