From: Robert Sanford <[email protected]> Both FIB dataplanes can overwrite their entire lookup table when a prefix whose range ends at the top of the address space is added, deleted, or has its next hop changed, while more-specific routes cover its range up to that point. The call returns 0, so the corruption is silent.
One real-world trigger is a default route coexisting with explicit /1 routes: with 0.0.0.0/0, 0.0.0.0/1 and 128.0.0.0/1 installed, deleting 0.0.0.0/0 makes every lookup miss. IPv6 behaves the same with ::/0, ::/1 and 8000::/1. In modify_fib() (dir24_8.c) and modify_dp() (trie.c), the branch that skips a route starting exactly at the current left edge has no wraparound check, while the branch that installs a gap does. Patches 2 and 3 add the missing check. Patches 4 and 5 add unit tests that fail without the fixes and pass with them. Patch 1 fixes undefined behavior in rte_rib.c that the new IPv4 test reaches: its bit test computes 1 << 31 on a signed int for nodes at depth 0. No existing test adds a depth-0 route. v2: - Add patch 1. The CI UBSan build reported the undefined behavior in rte_rib.c when running the v1 test/fib wraparound test. - Patches 2-5 are unchanged from v1. Robert Sanford (5): rib: fix undefined behavior in bit test fib: fix full table overwrite on address wraparound fib6: fix full table overwrite on address wraparound test/fib: reproduce table overwrite on address wraparound test/fib6: reproduce table overwrite on address wraparound app/test/test_fib.c | 94 +++++++++++++++++++++++++++++++++++++++ app/test/test_fib6.c | 103 +++++++++++++++++++++++++++++++++++++++++++ lib/fib/dir24_8.c | 6 +++ lib/fib/trie.c | 6 +++ lib/rib/rte_rib.c | 8 ++-- 5 files changed, 213 insertions(+), 4 deletions(-) -- 2.34.1
