search

FRRouting / frr

The FRRouting Protocol Suite
https://frrouting.org/
Other
3.13k stars 1.21k forks source link

tests/zebra/test_lm_plugin: use-after-free reported by TSAN #16257

Open eqvinox opened 3 weeks ago

eqvinox commented 3 weeks ago

TSAN complains:

$ tests/zebra/test_lm_plugin 
_install_element called before cmd_init, breakage likely
_install_element called before cmd_init, breakage likely
chunk: start 16 end 65 proto 10 instance 55 session 0 keep yes
==================
WARNING: ThreadSanitizer: heap-use-after-free (pid=412645)
  Read of size 4 at 0x720800000030 by main thread:
    #0 assign_specific_label_chunk zebra/label_manager.c:367 (test_lm_plugin+0x505a) (BuildId: 950fd52b24c1847e064872f26adaf41df42d39cc)
    #1 assign_label_chunk zebra/label_manager.c:460 (test_lm_plugin+0x505a)
    #2 test_lp_plugin tests/zebra/test_lm_plugin.c:99 (test_lm_plugin+0x359b) (BuildId: 950fd52b24c1847e064872f26adaf41df42d39cc)
    #3 main tests/zebra/test_lm_plugin.c:115 (test_lm_plugin+0x359b)

  Previous write of size 8 at 0x720800000030 by main thread:
    #0 free ../../../../src/libsanitizer/tsan/tsan_interceptors_posix.cpp:724 (libtsan.so.2+0x53c70) (BuildId: 4696c58f898e5d5cf4fe08e45868ac4fc5702473)
    #1 qfree lib/memory.c:130 (libfrr.so.0+0xf6b85) (BuildId: e9391a4e3b642a4e1e9cc377628094fed28a452c)
    #2 delete_label_chunk zebra/label_manager.c:97 (test_lm_plugin+0x3b33) (BuildId: 950fd52b24c1847e064872f26adaf41df42d39cc)
    #3 test_lp_plugin tests/zebra/test_lm_plugin.c:97 (test_lm_plugin+0x3579) (BuildId: 950fd52b24c1847e064872f26adaf41df42d39cc)
    #4 main tests/zebra/test_lm_plugin.c:115 (test_lm_plugin+0x3579)

SUMMARY: ThreadSanitizer: heap-use-after-free zebra/label_manager.c:367 in assign_specific_label_chunk
==================
chunk: start 100 end 149 proto 10 instance 55 session 0 keep yes
ThreadSanitizer: reported 1 warnings

note that this is not a topotest, it is a unit test, executed by make check. You can also directly run tests/zebra/test_lm_plugin after doing make tests/zebra/test_lm_plugin.

(Build with --enable-thread-sanitizer to enable TSAN.)