Skip to content

Commit b567a3a

Browse files
GaladrielZhaoGaladrielZhao
committed
Add 32 new patches from FRR stable/10.4 branch
Add 32 new patches related to zebra, lib and bgpd... They are: 0065-bgpd-fix-DEREF_OF_NULL.EX.COND-in-community_list_dup.patch 0066-zebra-fix-up-memory-leak-in-dplane-shutdown-sequences.patch 0067-bgpd-fix-overflow-when-decoding-zapi-nexthop-for-srv.patch 0068-bgpd-fix-memory-leak-in-evpn-mh.patch 0069-bgpd-Fix-default-vrf-check-while-configuring-md5-password-for-prefix-on-the-bgp-listen-socket.patch 0070-Gr-test-fixup.patch 0071-staticd-Fix-typo-in-SRv6-SIDs-debug-logs-for-interfa.patch 0072-zebra-Reset-encapsulation-source-address-when-no-srv6-is-executed.patch 0073-zebra-Explicitly-print-exit-at-the-end-of-srv6-encap.patch 0074-bgpd-Fix-crash-due-to-dangling-pointer-in-bnc-nht_in.patch 0075-zebra-Add-missing-debug-guard-in-rt-netlink-code.patch 0076-zebra-Add-missing-debug-guard-in-if-netlink-code.patch 0077-lib-remove-zlog-tmp-dirs-by-default-at-exit.patch 0078-staticd-Fix-SRv6-SID-installation-for-default-VRF.patch 0079-bgpd-don-t-use-stale-evpn-pointer-in-bgp_update.patch 0080-lib-Return-a-valid-JSON-if-prefix-list-is-not-found.patch 0081-Allow-notify-callback-on-non-presence-container.patch 0082-bgpd-fix-refcounts-at-termination.patch 0083-bgpd-add-NULL-check-in-evpn-mh-code.patch 0084-Revert-bgpd-Enable-Link-Local-Next-Hop-capability-for-unnumbered-peers-implicitly.patch 0086-doc-Fix-documentation-regarding-capability-link-loca.patch 0087-zebra-fix-neighbor-table-name-length.patch 0088-bgpd-Do-not-override-a-specified-rd.patch 0089-bgpd-EVPN-fix-auto-derive-rd-when-user-cfg-removed.patch 0090-zebra-EVPN-fix-alignment-of-access-vlan-cli-output.patch 0091-bgpd-EVPN-MH-fix-ES-EVI-memleak-during-shutdown.patch 0092-bgpd-Do-not-complain-in-the-logs-if-we-intentionally.patch 0093-bgpd-Put-local-BGP-ID-when-sending-NNHN-TLV-for-NH-c.patch 0094-zebra-fix-yang-data-for-mcast-group.patch 0095-bgpd-Crash-due-to-usage-of-freed-up-evpn_overlay-att.patch 0096-bgpd-Notify-all-incoming-outgoing-on-peer-group-noti.patch Signed-off-by: Yuqing Zhao <[email protected]>
1 parent dab3c74 commit b567a3a

File tree

33 files changed

+5335
-0
lines changed

33 files changed

+5335
-0
lines changed

‎src/sonic-frr/patch/0065-bgpd-fix-DEREF_OF_NULL.EX.COND-in-community_list_dup.patch‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
From c9cc9dce4990da85c6451a2f3e539e3a5fa2f8be Mon Sep 17 00:00:00 2001
2+
From: Petr Vaganov <[email protected]>
3+
Date: Mon, 4 Aug 2025 12:07:31 +0500
4+
Subject: bgpd: fix DEREF_OF_NULL.EX.COND in community_list_dup_check
5+
6+
Found by the static analyzer Svace (ISP RAS).
7+
8+
After having been assigned to a NULL value at bgp_clist.c:1241, pointer
9+
'entry->config' is passed in call to function 'community_list_dup_check'
10+
at bgp_clist.c:1244, where it is dereferenced at bgp_clist.c:899.
11+
12+
Signed-off-by: Petr Vaganov <[email protected]>
13+
---
14+
bgpd/bgp_clist.c | 2 +-
15+
1 file changed, 1 insertion(+), 1 deletion(-)
16+
17+
diff --git a/bgpd/bgp_clist.c b/bgpd/bgp_clist.c
18+
index 5019181921..429f5f2a5a 100644
19+
--- a/bgpd/bgp_clist.c
20+
+++ b/bgpd/bgp_clist.c
21+
@@ -896,7 +896,7 @@ static bool community_list_dup_check(struct community_list *list,
22+
case COMMUNITY_LIST_EXPANDED:
23+
case EXTCOMMUNITY_LIST_EXPANDED:
24+
case LARGE_COMMUNITY_LIST_EXPANDED:
25+
- if (strcmp(entry->config, new->config) == 0)
26+
+ if (new->config && (strcmp(entry->config, new->config) == 0))
27+
return true;
28+
break;
29+
default:
30+
--
31+
2.48.1
32+

‎src/sonic-frr/patch/0066-zebra-fix-up-memory-leak-in-dplane-shutdown-sequences.patch‎

Lines changed: 230 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,230 @@
1+
From b90c68ec0551fdecde71039c2665811a93e223cb Mon Sep 17 00:00:00 2001
2+
From: Chirag Shah <[email protected]>
3+
Date: Mon, 4 Aug 2025 11:05:22 -0700
4+
Subject: zebra: fix memory leak dplane pthread mutex destroy
5+
6+
valgrind report snippet:
7+
==214726== 240 bytes in 1 blocks are possibly lost in loss record 18,308 of 19,216
8+
==214726== at 0x48465EF: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
9+
==214726== by 0x492A42F: qcalloc (in /usr/lib/x86_64-linux-gnu/frr/libfrr.so.0.0.0)
10+
==214726== by 0x1FED89: dplane_provider_register (in /usr/lib/frr/zebra)
11+
==214726== by 0x2003AA: zebra_dplane_init (in /usr/lib/frr/zebra)
12+
==214726== by 0x1C0279: main (in /usr/lib/frr/zebra)
13+
14+
Ticket: #4559520
15+
16+
Cursor
17+
Signed-off-by: Chirag Shah <[email protected]>
18+
---
19+
zebra/zebra_dplane.c | 4 ++++
20+
1 file changed, 4 insertions(+)
21+
22+
diff --git a/zebra/zebra_dplane.c b/zebra/zebra_dplane.c
23+
index 827d55d686..409e3e4943 100644
24+
--- a/zebra/zebra_dplane.c
25+
+++ b/zebra/zebra_dplane.c
26+
@@ -7695,6 +7695,7 @@ void zebra_dplane_shutdown(void)
27+
dp = dplane_prov_list_first(&zdplane_info.dg_providers);
28+
while (dp) {
29+
dplane_prov_list_del(&zdplane_info.dg_providers, dp);
30+
+ pthread_mutex_destroy(&dp->dp_mutex);
31+
XFREE(MTYPE_DP_PROV, dp);
32+
33+
dp = dplane_prov_list_first(&zdplane_info.dg_providers);
34+
@@ -7711,6 +7712,9 @@ void zebra_dplane_shutdown(void)
35+
}
36+
}
37+
DPLANE_UNLOCK();
38+
+
39+
+ /* Destroy global mutex */
40+
+ pthread_mutex_destroy(&zdplane_info.dg_mutex);
41+
}
42+
43+
/*
44+
--
45+
2.48.1
46+
47+
48+
From 14f1a5519c60128d816abfc7236366a81c923dfd Mon Sep 17 00:00:00 2001
49+
From: Chirag Shah <[email protected]>
50+
Date: Mon, 4 Aug 2025 14:05:22 -0700
51+
Subject: zebra: fix memory leak in netlink link chg err case
52+
53+
valgrind report snippet:
54+
==214726== 45,600 bytes in 30 blocks are possibly lost in loss record
55+
19,202 of 19,216
56+
==214726== at 0x48465EF: calloc (in
57+
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
58+
==214726== by 0x492A42F: qcalloc (in
59+
/usr/lib/x86_64-linux-gnu/frr/libfrr.so.0.0.0)
60+
==214726== by 0x1C7EEB: netlink_link_change (in /usr/lib/frr/zebra)
61+
==214726== by 0x1D586E: netlink_parse_info (in /usr/lib/frr/zebra)
62+
==214726== by 0x1C9930: interface_lookup_netlink (in
63+
/usr/lib/frr/zebra)
64+
==214726== by 0x1C9E80: interface_list (in /usr/lib/frr/zebra)
65+
==214726== by 0x23883D: zebra_ns_init (in /usr/lib/frr/zebra)
66+
==214726== by 0x1C0294: main (in /usr/lib/frr/zebra)
67+
68+
Ticket: #4559520
69+
70+
Cursor
71+
Signed-off-by: Chirag Shah <[email protected]>
72+
---
73+
zebra/if_netlink.c | 13 ++++++++++++-
74+
1 file changed, 12 insertions(+), 1 deletion(-)
75+
76+
diff --git a/zebra/if_netlink.c b/zebra/if_netlink.c
77+
index 1cfcc84bd9..7d31684c56 100644
78+
--- a/zebra/if_netlink.c
79+
+++ b/zebra/if_netlink.c
80+
@@ -638,6 +638,9 @@ netlink_bridge_vxlan_vlan_vni_map_update(struct zebra_dplane_ctx *ctx,
81+
if (count) {
82+
vniarray->count = count;
83+
dplane_ctx_set_ifp_vxlan_vni_array(ctx, vniarray);
84+
+ } else if (vniarray) {
85+
+ /* Free allocated memory if count is 0 */
86+
+ XFREE(MTYPE_TMP, vniarray);
87+
}
88+
return 0;
89+
}
90+
@@ -705,6 +708,9 @@ static void netlink_bridge_vlan_update(struct zebra_dplane_ctx *ctx,
91+
if (count) {
92+
bvarray->count = count;
93+
dplane_ctx_set_ifp_bridge_vlan_info_array(ctx, bvarray);
94+
+ } else if (bvarray) {
95+
+ /* Free allocated memory if count is 0 */
96+
+ XFREE(MTYPE_TMP, bvarray);
97+
}
98+
}
99+
100+
@@ -1749,8 +1755,13 @@ int netlink_vlan_change(struct nlmsghdr *h, ns_id_t ns_id, int startup)
101+
bvm->ifindex, ns_id);
102+
103+
dplane_provider_enqueue_to_zebra(ctx);
104+
- } else
105+
+ } else {
106+
+ if (vlan_array) {
107+
+ /* Free allocated memory if count is 0 */
108+
+ XFREE(MTYPE_VLAN_CHANGE_ARR, vlan_array);
109+
+ }
110+
dplane_ctx_fini(&ctx);
111+
+ }
112+
113+
114+
return 0;
115+
--
116+
2.48.1
117+
118+
119+
From d34057d035a5e6410deaef9daa46ce0ed943c520 Mon Sep 17 00:00:00 2001
120+
From: Chirag Shah <[email protected]>
121+
Date: Mon, 4 Aug 2025 14:09:40 -0700
122+
Subject: zebra: fix memory leak in dplane zns info entries
123+
124+
valgrind report snippet:
125+
==214726== 48 bytes in 1 blocks are possibly lost in loss record 13,919
126+
of 19,216
127+
==214726== at 0x48465EF: calloc (in
128+
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
129+
==214726== by 0x492A42F: qcalloc (in
130+
/usr/lib/x86_64-linux-gnu/frr/libfrr.so.0.0.0)
131+
==214726== by 0x1FFA30: zebra_dplane_ns_enable (in
132+
/usr/lib/frr/zebra)
133+
==214726== by 0x238835: zebra_ns_init (in /usr/lib/frr/zebra)
134+
==214726== by 0x1C0294: main (in /usr/lib/frr/zebra)
135+
136+
Ticket: #4559520
137+
138+
Cursor
139+
Signed-off-by: Chirag Shah <[email protected]>
140+
---
141+
zebra/zebra_dplane.c | 9 +++++++++
142+
1 file changed, 9 insertions(+)
143+
144+
diff --git a/zebra/zebra_dplane.c b/zebra/zebra_dplane.c
145+
index 409e3e4943..9e26cf6803 100644
146+
--- a/zebra/zebra_dplane.c
147+
+++ b/zebra/zebra_dplane.c
148+
@@ -7665,6 +7665,7 @@ void zebra_dplane_shutdown(void)
149+
{
150+
struct zebra_dplane_provider *dp;
151+
struct zebra_dplane_ctx *ctx;
152+
+ struct dplane_zns_info *zi;
153+
154+
if (IS_ZEBRA_DEBUG_DPLANE)
155+
zlog_debug("Zebra dataplane shutdown called");
156+
@@ -7701,6 +7702,14 @@ void zebra_dplane_shutdown(void)
157+
dp = dplane_prov_list_first(&zdplane_info.dg_providers);
158+
}
159+
160+
+ /* Clean up namespace info entries */
161+
+ zi = zns_info_list_first(&zdplane_info.dg_zns_list);
162+
+ while (zi) {
163+
+ zns_info_list_del(&zdplane_info.dg_zns_list, zi);
164+
+ XFREE(MTYPE_DP_NS, zi);
165+
+ zi = zns_info_list_first(&zdplane_info.dg_zns_list);
166+
+ }
167+
+
168+
/* TODO -- Clean queue(s), free memory */
169+
DPLANE_LOCK();
170+
{
171+
--
172+
2.48.1
173+
174+
175+
From ea672814b716dbd9c6387e0533fa7a5efff8c8d9 Mon Sep 17 00:00:00 2001
176+
From: Chirag Shah <[email protected]>
177+
Date: Mon, 4 Aug 2025 15:11:40 -0700
178+
Subject: zebra: fix memory leak dplane providers queued contex
179+
180+
valgrind report snippet:
181+
==214726== 1,520 bytes in 1 blocks are possibly lost in loss record
182+
19,054 of 19,216
183+
==214726== at 0x48465EF: calloc (in
184+
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
185+
==214726== by 0x492A42F: qcalloc (in
186+
/usr/lib/x86_64-linux-gnu/frr/libfrr.so.0.0.0)
187+
==214726== by 0x20029D: zebra_dplane_startup_stage (in
188+
/usr/lib/frr/zebra)
189+
==214726== by 0x23883D: zebra_ns_init (in /usr/lib/frr/zebra)
190+
==214726== by 0x1C0294: main (in /usr/lib/frr/zebra)
191+
192+
Ticket: #4559520
193+
194+
Cursor
195+
Signed-off-by: Chirag Shah <[email protected]>
196+
---
197+
zebra/zebra_dplane.c | 17 +++++++++++++++++
198+
1 file changed, 17 insertions(+)
199+
200+
diff --git a/zebra/zebra_dplane.c b/zebra/zebra_dplane.c
201+
index 9e26cf6803..18599a02b5 100644
202+
--- a/zebra/zebra_dplane.c
203+
+++ b/zebra/zebra_dplane.c
204+
@@ -7722,6 +7722,23 @@ void zebra_dplane_shutdown(void)
205+
}
206+
DPLANE_UNLOCK();
207+
208+
+ /* Clean up any startup stage contexts in provider queues */
209+
+ frr_each (dplane_prov_list, &zdplane_info.dg_providers, dp) {
210+
+ /* Clean in-queue contexts */
211+
+ ctx = dplane_ctx_list_pop(&dp->dp_ctx_in_list);
212+
+ while (ctx) {
213+
+ dplane_ctx_free(&ctx);
214+
+ ctx = dplane_ctx_list_pop(&dp->dp_ctx_in_list);
215+
+ }
216+
+
217+
+ /* Clean out-queue contexts */
218+
+ ctx = dplane_ctx_list_pop(&dp->dp_ctx_out_list);
219+
+ while (ctx) {
220+
+ dplane_ctx_free(&ctx);
221+
+ ctx = dplane_ctx_list_pop(&dp->dp_ctx_out_list);
222+
+ }
223+
+ }
224+
+
225+
/* Destroy global mutex */
226+
pthread_mutex_destroy(&zdplane_info.dg_mutex);
227+
}
228+
--
229+
2.48.1
230+

‎src/sonic-frr/patch/0067-bgpd-fix-overflow-when-decoding-zapi-nexthop-for-srv.patch‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
From 21fb7c457208205af55cfa63d86c5f89315febda Mon Sep 17 00:00:00 2001
2+
From: Petr Vaganov <[email protected]>
3+
Date: Mon, 4 Aug 2025 11:33:10 +0500
4+
Subject: bgpd: fix overflow when decoding zapi nexthop for srv6 max segments
5+
6+
Found by the static analyzer Svace (ISP RAS).
7+
8+
Expression is used as an index for accessing an array's element
9+
in function 'stream_get2' at zclient.c:1577. This expression can
10+
have value 256, which is out of range, as indicated by a preceding
11+
conditional expression at zclient.c:1577.
12+
13+
Through memcpy, 256 bytes can be written to a 128 byte array of
14+
structures, it seems that SRV6_MAX_SIDS should be SRV6_MAX_SEGS instead.
15+
16+
Signed-off-by: Petr Vaganov <[email protected]>
17+
---
18+
lib/zclient.c | 2 +-
19+
1 file changed, 1 insertion(+), 1 deletion(-)
20+
21+
diff --git a/lib/zclient.c b/lib/zclient.c
22+
index 3ab7bc040e..fe5a931c10 100644
23+
--- a/lib/zclient.c
24+
+++ b/lib/zclient.c
25+
@@ -1574,7 +1574,7 @@ int zapi_nexthop_decode(struct stream *s, struct zapi_nexthop *api_nh,
26+
27+
if (CHECK_FLAG(api_nh->flags, ZAPI_NEXTHOP_FLAG_SEG6)) {
28+
STREAM_GETC(s, api_nh->seg_num);
29+
- if (api_nh->seg_num > SRV6_MAX_SIDS) {
30+
+ if (api_nh->seg_num > SRV6_MAX_SEGS) {
31+
flog_err(EC_LIB_ZAPI_ENCODE,
32+
"%s: invalid number of SRv6 Segs (%u)",
33+
__func__, api_nh->seg_num);
34+
--
35+
2.48.1
36+

0 commit comments

Comments
 (0)