Resolves: #2226803 - BFD crash in FRR running in MetalLB

0014-bfd-profile-crash.patch

@@ -0,0 +1,117 @@
+From 4b793d1eb35ab5794db12725a28fcdb4fef23af7 Mon Sep 17 00:00:00 2001
+From: Igor Ryzhov <iryzhov@nfware.com>
+Date: Thu, 1 Apr 2021 15:29:18 +0300
+Subject: [PATCH] bfdd: remove profiles when removing bfd node
+
+Fixes #8379.
+
+Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
+---
+ bfdd/bfd.c            | 8 ++++++++
+ bfdd/bfd.h            | 1 +
+ bfdd/bfdd_nb_config.c | 1 +
+ 3 files changed, 10 insertions(+)
+
+diff --git a/bfdd/bfd.c b/bfdd/bfd.c
+index c966efd8ea71..cf292a836354 100644
+--- a/bfdd/bfd.c
++++ b/bfdd/bfd.c
+@@ -1889,6 +1889,14 @@ void bfd_sessions_remove_manual(void)
+ 	hash_iterate(bfd_key_hash, _bfd_session_remove_manual, NULL);
+ }
+ 
++void bfd_profiles_remove(void)
++{
++	struct bfd_profile *bp;
++
++	while ((bp = TAILQ_FIRST(&bplist)) != NULL)
++		bfd_profile_free(bp);
++}
++
+ /*
+  * Profile related hash functions.
+  */
+diff --git a/bfdd/bfd.h b/bfdd/bfd.h
+index af3f92d6a8f8..9ee1da728717 100644
+--- a/bfdd/bfd.h
++++ b/bfdd/bfd.h
+@@ -596,6 +596,7 @@ void bfd_session_free(struct bfd_session *bs);
+ const struct bfd_session *bfd_session_next(const struct bfd_session *bs,
+ 					   bool mhop);
+ void bfd_sessions_remove_manual(void);
++void bfd_profiles_remove(void);
+ 
+ /**
+  * Set the BFD session echo state.
+diff --git a/bfdd/bfdd_nb_config.c b/bfdd/bfdd_nb_config.c
+index 0046bc625b45..77f8cbd09c07 100644
+--- a/bfdd/bfdd_nb_config.c
++++ b/bfdd/bfdd_nb_config.c
+@@ -203,6 +203,7 @@ int bfdd_bfd_destroy(struct nb_cb_destroy_args *args)
+ 
+ 	case NB_EV_APPLY:
+ 		bfd_sessions_remove_manual();
++		bfd_profiles_remove();
+ 		break;
+ 
+ 	case NB_EV_ABORT:
+diff --git a/bfdd/bfdd_nb_config.c b/bfdd/bfdd_nb_config.c
+index 77f8cbd09c07..4030e2eefa50 100644
+--- a/bfdd/bfdd_nb_config.c
++++ b/bfdd/bfdd_nb_config.c
+@@ -186,7 +186,15 @@ static int bfd_session_destroy(enum nb_event event,
+  */
+ int bfdd_bfd_create(struct nb_cb_create_args *args)
+ {
+-	/* NOTHING */
++	if (args->event != NB_EV_APPLY)
++		return NB_OK;
++
++	/*
++	 * Set any non-NULL value to be able to call
++	 * nb_running_unset_entry in bfdd_bfd_destroy.
++	 */
++	nb_running_set_entry(args->dnode, (void *)0x1);
++
+ 	return NB_OK;
+ }
+ 
+@@ -202,6 +210,12 @@ int bfdd_bfd_destroy(struct nb_cb_destroy_args *args)
+ 		return NB_OK;
+ 
+ 	case NB_EV_APPLY:
++		/*
++		 * We need to call this to unset pointers from
++		 * the child nodes - sessions and profiles.
++		 */
++		nb_running_unset_entry(args->dnode);
++
+ 		bfd_sessions_remove_manual();
+ 		bfd_profiles_remove();
+ 		break;
+diff --git a/bfdd/bfdd_cli.c b/bfdd/bfdd_cli.c
+index b64e36b36a44..5a844e56e121 100644
+--- a/bfdd/bfdd_cli.c
++++ b/bfdd/bfdd_cli.c
+@@ -486,7 +486,7 @@ void bfd_cli_show_echo_interval(struct vty *vty, struct lyd_node *dnode,
+  * Profile commands.
+  */
+ DEFPY_YANG_NOSH(bfd_profile, bfd_profile_cmd,
+-	   "profile WORD$name",
++	   "profile BFDPROF$name",
+ 	   BFD_PROFILE_STR
+ 	   BFD_PROFILE_NAME_STR)
+ {
+diff --git a/vtysh/vtysh.c b/vtysh/vtysh.c
+index 74f13e1a44e8..cf1811bb1f2f 100644
+--- a/vtysh/vtysh.c
++++ b/vtysh/vtysh.c
+@@ -1959,7 +1959,7 @@ DEFUNSH(VTYSH_BFDD, bfd_peer_enter, bfd_peer_enter_cmd,
+ }
+ 
+ DEFUNSH(VTYSH_BFDD, bfd_profile_enter, bfd_profile_enter_cmd,
+-	"profile WORD",
++	"profile BFDPROF",
+ 	BFD_PROFILE_STR
+ 	BFD_PROFILE_NAME_STR)
+ {

frr.spec

@@ -7,7 +7,7 @@
 
 Name: frr
 Version: 7.5.1
-Release: 8%{?checkout}%{?dist}
+Release: 9%{?checkout}%{?dist}
 Summary: Routing daemon
 License: GPLv2+
 URL: http://www.frrouting.org
@@ -273,6 +273,9 @@ make check PYTHON=%{__python3}
 %endif
 
 %changelog
+* Wed Aug 16 2023 Michal Ruprich <mruprich@redhat.com> - 7.5.1-9
+- Resolves: #2226803 - BFD crash in FRR running in MetalLB
+
 * Fri Aug 11 2023 Michal Ruprich <mruprich@redhat.com> - 7.5.1-8
 - Resolves: #2216911 - SELinux is preventing FRR-Zebra to access to network namespaces
 

rpminspect.yaml

@@ -0,0 +1,7 @@
+---
+runpath:
+    allowed_paths:
+        - /usr/lib64/frr
+        - /usr/lib/frr
+inspections:
+    badfuncs: off