Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mgmtd: Prevent use after free #18264

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

donaldsharp
Copy link
Member

ci is picking up this use after free on occasion:

ERROR: AddressSanitizer: attempting to call malloc_usable_size() for pointer which is not owned: 0x6030001d94a0
    0 0x7fab994b7f04 in __interceptor_malloc_usable_size ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:119
    1 0x7fab994264f6 in __sanitizer::BufferedStackTrace::Unwind(unsigned long, unsigned long, void*, bool, unsigned int) ../../../../src/libsanitizer/sanitizer_common/sanitizer_stacktrace.h:131
    2 0x7fab994264f6 in __asan::asan_malloc_usable_size(void const*, unsigned long, unsigned long) ../../../../src/libsanitizer/asan/asan_allocator.cpp:1058
    3 0x7fab99039bcf in mt_count_free lib/memory.c:78
    4 0x7fab99039bcf in qfree lib/memory.c:130
    5 0x7fab98ff971a in hash_clean lib/hash.c:290
    6 0x56110cdb0e7f in mgmt_txn_hash_destroy mgmtd/mgmt_txn.c:1881
    7 0x56110cdb0e7f in mgmt_txn_destroy mgmtd/mgmt_txn.c:2013
    8 0x56110cd8e5de in mgmt_terminate mgmtd/mgmt.c:91
    9 0x56110cd8e003 in sigint mgmtd/mgmt_main.c:90
    10 0x7fab990bf4b0 in frr_sigevent_process lib/sigevent.c:117
    11 0x7fab990ea7a1 in event_fetch lib/event.c:1740
    12 0x7fab9901a24e in frr_run lib/libfrr.c:1245
    13 0x56110cd8e21f in main mgmtd/mgmt_main.c:290
    14 0x7fab98af9249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    15 0x7fab98af9304 in __libc_start_main_impl ../csu/libc-start.c:360
    16 0x56110cd8dd30 in _start (/usr/lib/frr/mgmtd+0x3ad30)

0x6030001d94a0 is located 0 bytes inside of 24-byte region [0x6030001d94a0,0x6030001d94b8)
freed by thread T0 here:
    0 0x7fab994b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
    1 0x7fab99039bf0 in qfree lib/memory.c:131
    2 0x7fab98ff93e1 in hash_release lib/hash.c:227
    3 0x56110cdaabdc in mgmt_txn_unlock mgmtd/mgmt_txn.c:1931
    4 0x56110cdab049 in mgmt_txn_delete mgmtd/mgmt_txn.c:1841
    5 0x56110cdab0ce in mgmt_txn_hash_free mgmtd/mgmt_txn.c:1864
    6 0x7fab98ff970b in hash_clean lib/hash.c:288
    7 0x56110cdb0e7f in mgmt_txn_hash_destroy mgmtd/mgmt_txn.c:1881
    8 0x56110cdb0e7f in mgmt_txn_destroy mgmtd/mgmt_txn.c:2013
    9 0x56110cd8e5de in mgmt_terminate mgmtd/mgmt.c:91
    10 0x56110cd8e003 in sigint mgmtd/mgmt_main.c:90
    11 0x7fab990bf4b0 in frr_sigevent_process lib/sigevent.c:117
    12 0x7fab990ea7a1 in event_fetch lib/event.c:1740
    13 0x7fab9901a24e in frr_run lib/libfrr.c:1245
    14 0x56110cd8e21f in main mgmtd/mgmt_main.c:290
    15 0x7fab98af9249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

previously allocated by thread T0 here:
    0 0x7fab994b83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
    1 0x7fab990392fd in qcalloc lib/memory.c:106
    2 0x7fab98ff8b4f in hash_get lib/hash.c:156
    3 0x56110cdb13ae in mgmt_txn_create_new mgmtd/mgmt_txn.c:1825
    4 0x56110cdb3b4d in mgmt_txn_notify_be_adapter_conn mgmtd/mgmt_txn.c:2212
    5 0x56110cd91178 in mgmt_be_adapter_conn_init mgmtd/mgmt_be_adapter.c:842
    6 0x7fab990ec6de in event_call lib/event.c:2019
    7 0x7fab9901a243 in frr_run lib/libfrr.c:1246
    8 0x56110cd8e21f in main mgmtd/mgmt_main.c:290
    9 0x7fab98af9249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

The only time that mgmt_txn_hash_free is called is in hash_clean. There are other places that mgmt_txn_unlock/delete are called and hash_release should be called. Let's just notice when mgmtd is being called from the hash_clean and not call hash_release (since we know it is being released already)

ci is picking up this use after free on occasion:

    ERROR: AddressSanitizer: attempting to call malloc_usable_size() for pointer which is not owned: 0x6030001d94a0
        0 0x7fab994b7f04 in __interceptor_malloc_usable_size ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:119
        1 0x7fab994264f6 in __sanitizer::BufferedStackTrace::Unwind(unsigned long, unsigned long, void*, bool, unsigned int) ../../../../src/libsanitizer/sanitizer_common/sanitizer_stacktrace.h:131
        2 0x7fab994264f6 in __asan::asan_malloc_usable_size(void const*, unsigned long, unsigned long) ../../../../src/libsanitizer/asan/asan_allocator.cpp:1058
        3 0x7fab99039bcf in mt_count_free lib/memory.c:78
        4 0x7fab99039bcf in qfree lib/memory.c:130
        5 0x7fab98ff971a in hash_clean lib/hash.c:290
        6 0x56110cdb0e7f in mgmt_txn_hash_destroy mgmtd/mgmt_txn.c:1881
        7 0x56110cdb0e7f in mgmt_txn_destroy mgmtd/mgmt_txn.c:2013
        8 0x56110cd8e5de in mgmt_terminate mgmtd/mgmt.c:91
        9 0x56110cd8e003 in sigint mgmtd/mgmt_main.c:90
        10 0x7fab990bf4b0 in frr_sigevent_process lib/sigevent.c:117
        11 0x7fab990ea7a1 in event_fetch lib/event.c:1740
        12 0x7fab9901a24e in frr_run lib/libfrr.c:1245
        13 0x56110cd8e21f in main mgmtd/mgmt_main.c:290
        14 0x7fab98af9249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        15 0x7fab98af9304 in __libc_start_main_impl ../csu/libc-start.c:360
        16 0x56110cd8dd30 in _start (/usr/lib/frr/mgmtd+0x3ad30)

    0x6030001d94a0 is located 0 bytes inside of 24-byte region [0x6030001d94a0,0x6030001d94b8)
    freed by thread T0 here:
        0 0x7fab994b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
        1 0x7fab99039bf0 in qfree lib/memory.c:131
        2 0x7fab98ff93e1 in hash_release lib/hash.c:227
        3 0x56110cdaabdc in mgmt_txn_unlock mgmtd/mgmt_txn.c:1931
        4 0x56110cdab049 in mgmt_txn_delete mgmtd/mgmt_txn.c:1841
        5 0x56110cdab0ce in mgmt_txn_hash_free mgmtd/mgmt_txn.c:1864
        6 0x7fab98ff970b in hash_clean lib/hash.c:288
        7 0x56110cdb0e7f in mgmt_txn_hash_destroy mgmtd/mgmt_txn.c:1881
        8 0x56110cdb0e7f in mgmt_txn_destroy mgmtd/mgmt_txn.c:2013
        9 0x56110cd8e5de in mgmt_terminate mgmtd/mgmt.c:91
        10 0x56110cd8e003 in sigint mgmtd/mgmt_main.c:90
        11 0x7fab990bf4b0 in frr_sigevent_process lib/sigevent.c:117
        12 0x7fab990ea7a1 in event_fetch lib/event.c:1740
        13 0x7fab9901a24e in frr_run lib/libfrr.c:1245
        14 0x56110cd8e21f in main mgmtd/mgmt_main.c:290
        15 0x7fab98af9249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    previously allocated by thread T0 here:
        0 0x7fab994b83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
        1 0x7fab990392fd in qcalloc lib/memory.c:106
        2 0x7fab98ff8b4f in hash_get lib/hash.c:156
        3 0x56110cdb13ae in mgmt_txn_create_new mgmtd/mgmt_txn.c:1825
        4 0x56110cdb3b4d in mgmt_txn_notify_be_adapter_conn mgmtd/mgmt_txn.c:2212
        5 0x56110cd91178 in mgmt_be_adapter_conn_init mgmtd/mgmt_be_adapter.c:842
        6 0x7fab990ec6de in event_call lib/event.c:2019
        7 0x7fab9901a243 in frr_run lib/libfrr.c:1246
        8 0x56110cd8e21f in main mgmtd/mgmt_main.c:290
        9 0x7fab98af9249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

The only time that mgmt_txn_hash_free is called is in hash_clean.
There are other places that mgmt_txn_unlock/delete are called and
hash_release should be called.  Let's just notice when mgmtd is
being called from the hash_clean and not call hash_release (since
we know it is being released already)

Signed-off-by: Donald Sharp <[email protected]>
@frrbot frrbot bot added the mgmt FRR Management Infra label Feb 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
master mgmt FRR Management Infra size/S
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant