Skip to content

ospf6d: clear local ifp per ECMP path rebuild - #21037

Merged
donaldsharp merged 1 commit into
FRRouting:masterfrom
florath:satlab/finding-06-intra-prefix-reset-ifp
Mar 7, 2026
Merged

ospf6d: clear local ifp per ECMP path rebuild#21037
donaldsharp merged 1 commit into
FRRouting:masterfrom
florath:satlab/finding-06-intra-prefix-reset-ifp

Conversation

@florath

@florath florath commented Mar 6, 2026

Copy link
Copy Markdown
Contributor

ospf6_intra_prefix_route_ecmp_path() can reuse a stale ifp value while rebuilding the effective nexthop set for an existing intra-prefix route.

What changes

  • reset ifp to NULL at the start of each old_route->paths iteration

Why
The current loop only assigns ifp for self-originated Intra-Prefix-LSAs. Without an explicit reset, a previous successful interface lookup can leak into a later unrelated path and cause FRR to install a wrong on-link nexthop.

Impact

  • fixes incorrect direct-connect nexthop reuse

Fixes #21036

During intra-prefix ECMP recomputation, ifp was reused across\nold_route->paths iterations. That can carry a previously matched\ndirect-connected interface into an unrelated path and install an\non-link nexthop incorrectly.\n\nReset ifp at each path iteration before evaluating the current\norigin/path context.

Signed-off-by: Andreas Florath <Andreas.Florath@telekom.de>
@greptile-apps

greptile-apps Bot commented Mar 6, 2026

Copy link
Copy Markdown

Greptile Summary

This PR fixes a stale ifp pointer bug in ospf6_intra_prefix_route_ecmp_path() (ospf6d/ospf6_intra.c). When rebuilding the effective nexthop set for an existing intra-prefix route, the loop over old_route->paths only assigns ifp for self-originated Intra-Prefix-LSAs (where intra_prefix_lsa->ref_adv_router == oa->ospf6->router_id). Without an explicit reset, a non-NULL ifp from one iteration would silently carry into the next, causing the direct-connect nexthop path (ospf6_route_add_nexthop) to be taken instead of the correct ospf6_route_merge_nexthops path for unrelated paths.

Key changes:

  • A single ifp = NULL; statement is inserted at the top of the for (ALL_LIST_ELEMENTS_RO(old_route->paths, anode, o_path)) loop body (line 1535), ensuring the pointer is fresh for every path entry.
  • The fix is minimal, targeted, and has no side-effects on the surrounding logic.
  • The ifp variable is declared as struct interface *ifp = NULL; at function scope (line 1362), so the declaration already sets it correctly for the first iteration β€” but only an explicit per-iteration reset prevents leakage on subsequent iterations.

Confidence Score: 5/5

  • This PR is safe to merge β€” it is a single-line, clearly correct bug fix with no risk of regression.
  • The change is minimal (one line added), the root cause is well understood and described, the fix directly addresses the issue (stale ifp pointer in a per-path loop), and the surrounding logic is unchanged. No new branches, no new data structures, no API changes.
  • No files require special attention.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["ospf6_intra_prefix_route_ecmp_path()"] --> B["Iterate old_route->paths"]
    B --> C["ifp = NULL  (NEW FIX)"]
    C --> D["Lookup ls_entry in spf_table"]
    D --> E{ls_entry found?}
    E -- No --> F["continue to next path"]
    E -- Yes --> G["Lookup lsa in lsdb"]
    G --> H{lsa found?}
    H -- No --> F
    H -- Yes --> I["intra_prefix_lsa = lsa_after_header"]
    I --> J{Self-originated LSA?}
    J -- Yes --> K["ifp = if_lookup_prefix()"]
    J -- No --> L["ifp stays NULL"]
    K --> M{ifp != NULL?}
    L --> M
    M -- Yes --> N["ospf6_route_add_nexthop<br/>direct-connect via ifp"]
    M -- No --> O["ospf6_route_merge_nexthops<br/>copy from ls_entry"]
    N --> B
    O --> B
    B --> P["Update RIB/FIB"]
Loading

Last reviewed commit: 8d4b765

@donaldsharp

Copy link
Copy Markdown
Member

@Mergifyio backport stable/10.6

@donaldsharp
donaldsharp merged commit f15e79d into FRRouting:master Mar 7, 2026
23 checks passed
@mergify

mergify Bot commented Mar 7, 2026

Copy link
Copy Markdown

backport stable/10.6

βœ… Backports have been created

Details

Jafaral added a commit that referenced this pull request Mar 8, 2026
ospf6d: clear local ifp per ECMP path rebuild (backport #21037)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ospf6d can reuse a stale interface pointer during intra-prefix ECMP route rebuild

2 participants