Repository navigation
Frr backport 2 fixes - #1
Merged
Merged
Conversation
lsa->data->ls_age is in network byte order, not in host order. Ensure that endianness is taken properly into account in flag ops. Ensure that DO_NOT_AGE bit is not lost on LS Age increment or when maxaging. DO_NOT_AGE flag must also be masked out when time in seconds is needed. Signed-off-by: Ari Kauppi <kauppi@papupata.org>
Ensure local LSA's have the highest sequence number and neighbors are refreshed in the event a stale LSA is detected. Current behavior assuming we have two ospf routers: R1 <–> R2 - R1 and R2 are ospf neighbors - R1 has a summary route being advertised to R2 This summary route has some LSA sequence number that is higher than 1 At this point everything is working fine. But then: - R1 reboots - R1 and R2 re-establish ospf neighborship - R2 sends R1 the summary route with R1 as the advertising router - R1 installs this summary route with the higher sequence number. It will also set all the flags from R1, including the LSA_RECEIVED flag. This prevents subsequent LSA refresh events from firing - The summary route eventually times out (age 3600) and it uninstalled on R2 - R1 never refreshes the summary route. It reaches age 3600, but never gets deleted Expected behavior: - R1 should override R2's LSA with R1's router-id Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com>
mattiaswal
pushed a commit
that referenced
this pull request
Nov 12, 2026
Neighbor entries may not be removed from zebra neighbor tables due to a wrong ns_id when they were created. ns_id = 0 in netlink_neigh_table() but is changed to 48 in netlink_neigh_change(). > #0 dplane_ctx_set_ns_id (ctx=0x61900010a980, nsid=48) at zebra/zebra_dplane.c:1387 > #1 0x00005555557625f0 in netlink_ipneigh_change (h=0x62d000096400, len=48, ns_id=48) at zebra/rt_netlink.c:4556 > FRRouting#2 0x000055555576402a in netlink_neigh_change (h=0x62d000096400, ns_id=48) at zebra/rt_netlink.c:4786 > FRRouting#3 0x00005555557634ba in netlink_neigh_table (h=0x62d000096400, ns_id=0, startup=1) at zebra/rt_netlink.c:4653 > FRRouting#4 0x0000555555732037 in netlink_parse_info (filter=0x555555763397 <netlink_neigh_table>, nl=0x6160000b5378, zns=0x6190000fb8c8, count=0, startup=true) at zebra/kernel_netlink.c:1007 > FRRouting#5 0x0000555555763e09 in kernel_read_neigh (ctx=0x6190000fb480) at zebra/rt_netlink.c:4753 > FRRouting#6 0x00005555557c537e in kernel_dplane_process_neigh_read (prov=0x6110000ab440, ctx=0x6190000fb480) at zebra/zebra_dplane.c:7601 > FRRouting#7 0x00005555557c584f in kernel_dplane_process_func (prov=0x6110000ab440) at zebra/zebra_dplane.c:7673 > FRRouting#8 0x00005555557c6cdd in dplane_thread_loop (event=0x7ffff20a5b00) at zebra/zebra_dplane.c:8164 > FRRouting#9 0x00007ffff6f8c939 in event_call (event=0x7ffff20a5b00) at lib/event.c:2740 > FRRouting#10 0x00007ffff6e047d8 in fpt_run (arg=0x6110000c1ec0) at lib/frr_pthread.c:386 > FRRouting#11 0x00007ffff6e03240 in frr_pthread_inner (arg=0x6110000c1ec0) at lib/frr_pthread.c:179 > FRRouting#12 0x00007ffff7e27ea7 in start_thread (arg=<optimized out>) at pthread_create.c:477 > FRRouting#13 0x00007ffff6b27adf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com> (cherry picked from commit 94b53e2)
mattiaswal
pushed a commit
that referenced
this pull request
Nov 12, 2026
The following asan heap use after free message can happen: > ==105345==ERROR: AddressSanitizer: heap-use-after-free on address 0x51200008b280 at pc 0x77484347d96f bp 0x7ffe723b3910 sp 0x7ffe723b30b8 > READ of size 4 at 0x51200008b280 thread T0 > #0 0x77484347d96e in strlen ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:391 > #1 0x7748430379fa in vbprintfrr lib/printf/vfprintf.c:619 > FRRouting#2 0x77484303bcab in vasnprintfrr lib/printf/glue.c:92 > FRRouting#3 0x774842fafdb7 in vty_out lib/vty.c:273 > FRRouting#4 0x5cfd96949bac in if_dump_vty zebra/interface.c:2910 > FRRouting#5 0x5cfd9694f407 in show_interface_vrf_all_magic zebra/interface.c:3547 > FRRouting#6 0x5cfd9694e752 in show_interface_vrf_all zebra/interface_clippy.c:105 > FRRouting#7 0x774842dc36b0 in cmd_execute_command_real lib/command.c:1010 > FRRouting#8 0x774842dc3a3d in cmd_execute_command lib/command.c:1069 > FRRouting#9 0x774842dc470f in cmd_execute lib/command.c:1235 > FRRouting#10 0x774842fb1e1c in vty_command lib/vty.c:627 > FRRouting#11 0x774842fb6d03 in vty_execute lib/vty.c:1390 > FRRouting#12 0x774842fbd322 in vtysh_read lib/vty.c:2440 > FRRouting#13 0x774842fa19d6 in event_call lib/event.c:2011 > FRRouting#14 0x774842e6bfe4 in frr_run lib/libfrr.c:1219 > FRRouting#15 0x5cfd969660a9 in main zebra/main.c:550 > FRRouting#16 0x77484222a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 > FRRouting#17 0x77484222a28a in __libc_start_main_impl ../csu/libc-start.c:360 > FRRouting#18 0x5cfd96921314 in _start (/usr/lib/frr/zebra+0x1d9314) (BuildId: 1f53edc819a130a3c6818e60f267494aa5f1d5d5) > > 0x51200008b280 is located 64 bytes inside of 296-byte region [0x51200008b240,0x51200008b368) > freed by thread T0 here: > #0 0x7748434fc4d8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52 > #1 0x774842e9856a in qfree lib/memory.c:130 > FRRouting#2 0x774842e323c1 in if_delete lib/if.c:284 > FRRouting#3 0x5cfd9693d08a in if_delete_update zebra/interface.c:832 > FRRouting#4 0x5cfd969435d4 in zebra_if_dplane_ifp_handling zebra/interface.c:2005 > FRRouting#5 0x5cfd969462b1 in zebra_if_dplane_result zebra/interface.c:2355 > FRRouting#6 0x5cfd96ad45da in rib_process_dplane_results zebra/zebra_rib.c:4961 > FRRouting#7 0x774842fa19d6 in event_call lib/event.c:2011 > FRRouting#8 0x774842e6bfe4 in frr_run lib/libfrr.c:1219 > FRRouting#9 0x5cfd969660a9 in main zebra/main.c:550 > FRRouting#10 0x77484222a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 > FRRouting#11 0x77484222a28a in __libc_start_main_impl ../csu/libc-start.c:360 > FRRouting#12 0x5cfd96921314 in _start (/usr/lib/frr/zebra+0x1d9314) (BuildId: 1f53edc819a130a3c6818e60f267494aa5f1d5d5) Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.