bgpd: fix bgp_pbr_match memory leak

> Direct leak of 1144 byte(s) in 13 object(s) allocated from:
>     #0 0x7f3eedeb4a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
>     #1 0x7f3eed86f8dd in qcalloc lib/memory.c:105
>     #2 0x55b32d236faf in bgp_pbr_match_alloc_intern bgpd/bgp_pbr.c:1074
>     #3 0x7f3eed817d79 in hash_get lib/hash.c:147
>     FRRouting#4 0x55b32d242d9a in bgp_pbr_policyroute_add_to_zebra_unit bgpd/bgp_pbr.c:2486
>     FRRouting#5 0x55b32d244436 in bgp_pbr_policyroute_add_to_zebra bgpd/bgp_pbr.c:2672
>     FRRouting#6 0x55b32d245a05 in bgp_pbr_handle_entry bgpd/bgp_pbr.c:2843
>     FRRouting#7 0x55b32d246912 in bgp_pbr_update_entry bgpd/bgp_pbr.c:2939
>     FRRouting#8 0x55b32d3c7472 in bgp_zebra_announce bgpd/bgp_zebra.c:1618
>     FRRouting#9 0x55b32d26e5e7 in bgp_process_main_one bgpd/bgp_route.c:3691
>     FRRouting#10 0x55b32d26f77d in process_subq_other_route bgpd/bgp_route.c:3856
>     FRRouting#11 0x55b32d2701ff in process_subq bgpd/bgp_route.c:3955
>     FRRouting#12 0x55b32d27029f in meta_queue_process bgpd/bgp_route.c:3980
>     FRRouting#13 0x7f3eed99fdd8 in work_queue_run lib/workqueue.c:282
>     FRRouting#14 0x7f3eed97798e in event_call lib/event.c:2011
>     FRRouting#15 0x7f3eed842ff1 in frr_run lib/libfrr.c:1216
>     FRRouting#16 0x55b32d0a1a15 in main bgpd/bgp_main.c:545
>     FRRouting#17 0x7f3eed229d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Fixes: d114b0d ("bgpd: inject policy route entry from bgp into zebra pbr entries.")
Signed-off-by: Louis Scalbert <[email protected]>

Author: louis-6wind

bgpd/bgp_pbr.c

@@ -984,7 +984,12 @@ static void bgp_pbr_match_entry_hash_free(void *arg)
 	bgp_pbr_match_entry_free(bpme);
 }
 
-static void bgp_pbr_match_free(void *arg)
+static void bgp_pbr_match_free(struct bgp_pbr_match *bpm)
+{
+	XFREE(MTYPE_PBR_MATCH, bpm);
+}
+
+static void bgp_pbr_match_hash_free(void *arg)
 {
 	struct bgp_pbr_match *bpm;
 
@@ -1009,7 +1014,7 @@ static void bgp_pbr_match_free(void *arg)
 	}
 	hash_clean_and_free(&bpm->entry_hash, NULL);
 
-	XFREE(MTYPE_PBR_MATCH, bpm);
+	bgp_pbr_match_free(bpm);
 }
 
 static void *bgp_pbr_match_alloc_intern(void *arg)
@@ -1377,7 +1382,7 @@ struct bgp_pbr_match *bgp_pbr_match_iptable_lookup(vrf_id_t vrf_id,
 
 void bgp_pbr_cleanup(struct bgp *bgp)
 {
-	hash_clean_and_free(&bgp->pbr_match_hash, bgp_pbr_match_free);
+	hash_clean_and_free(&bgp->pbr_match_hash, bgp_pbr_match_hash_free);
 	hash_clean_and_free(&bgp->pbr_rule_hash, bgp_pbr_rule_free);
 	hash_clean_and_free(&bgp->pbr_action_hash, bgp_pbr_action_free);
 
@@ -1706,6 +1711,7 @@ static void bgp_pbr_flush_entry(struct bgp *bgp, struct bgp_pbr_action *bpa,
 			bpm->action = NULL;
 		}
 		hash_release(bgp->pbr_match_hash, bpm);
+		bgp_pbr_match_free(bpm);
 		/* XXX release pbr_match_action if not used
 		 * note that drop does not need to call send_pbr_action
 		 */