Double free attempts resulted in coredump #744
Description
Bug description
lldpd version: 1.0.19
In this commit 0ffff89 fix scenario, further rapid removal of interfaces would result in double free hardware instances, causing coredump。
2025-08-09T23:15:23 [ DBG/interfaces] driver for ethx is `dummy`
2025-08-09T23:15:23 [ DBG/interfaces] eth0 is a physical interface
2025-08-09T23:15:23 [ DBG/interfaces] ethx is a physical interface
2025-08-09T23:15:23 [ DBG/interfaces] eth0 is an acceptable ethernet device
2025-08-09T23:15:23 [ DBG/interfaces] use MAC address for eth0
2025-08-09T23:15:23 [ DBG/interfaces] using ifname in description for eth0
2025-08-09T23:15:23 [ DBG/interfaces] ethx is an acceptable ethernet device
2025-08-09T23:15:23 [ DBG/interfaces] ethx changed index: from 35 to 36
2025-08-09T23:15:23 [ DBG/interfaces] interface ethx is converted from another type of interface
2025-08-09T23:15:23 [ DBG/interfaces] close ethernet device ethx
2025-08-09T23:15:23 [ DBG/privsep] received command 5
2025-08-09T23:15:23 [ DBG/privsep] received command 5
2025-08-09T23:15:23 [ DBG/privsep] received command 5
2025-08-09T23:15:23 [ DBG/event] release events for ethx
2025-08-09T23:15:23 [ DBG/event] initialize events for ethx
2025-08-09T23:15:23 [ DBG/interfaces] initialize ethernet device ethx
2025-08-09T23:15:23 [ DBG/privsep] received command 4
2025-08-09T23:15:23 [WARN/privsep] unable to bind to raw socket for interface ethx: No such device
2025-08-09T23:15:23 [WARN/interfaces] unable to initialize ethx
2025-08-09T23:15:23 [ DBG/alloc] cleanup hardware port ethx
2025-08-09T23:15:23 [ DBG/interfaces] close ethernet device ethx
2025-08-09T23:15:23 [ DBG/privsep] received command 5
2025-08-09T23:15:23 [ DBG/interfaces] unable to delete LLDP address to multicast filter for ethx (No such device)
2025-08-09T23:15:23 [ DBG/privsep] received command 5
2025-08-09T23:15:23 [ DBG/interfaces] unable to delete LLDP address to multicast filter for ethx (No such device)
2025-08-09T23:15:23 [ DBG/privsep] received command 5
2025-08-09T23:15:23 [ DBG/interfaces] unable to delete LLDP address to multicast filter for ethx (No such device)
2025-08-09T23:15:23 [ DBG/event] release events for ethx
2025-08-09T23:15:23 [ DBG/alloc] cleanup management addresses for chassis n232-162-145.byted.org
2025-08-09T23:15:23 [ DBG/alloc] allocate a new management address (family: 1)
2025-08-09T23:15:23 [ DBG/interfaces] add management address 10.232.162.145
2025-08-09T23:15:23 [ DBG/alloc] allocate a new management address (family: 2)
2025-08-09T23:15:23 [ DBG/interfaces] add management address fdbd:dc00:b008:7::145
2025-08-09T23:15:23 [ DBG/interfaces] ask ethtool for the appropriate MAC/PHY for eth0
2025-08-09T23:15:23 [ DBG/interfaces] got ethtool results for eth0 with GLINKSETTINGS
2025-08-09T23:15:23 [ DBG/localchassis] cleanup all ports
2025-08-09T23:15:23 [ DBG/alloc] cleanup remote port on eth0
2025-08-09T23:15:23 [ DBG/localchassis] delete non-permanent interface ethx
2025-08-09T23:15:23 [ DBG/alloc] cleanup remote port on ethx
2025-08-09T23:15:23 [ DBG/alloc] cleanup hardware port ethx
free(): double free detected in tcache 2
Aborted (core dumped)
Steps to reproduce the problem
use this script:
#!/bin/env python3
import subprocess
import time
# add dummy interface ethx
subprocess.run(['ip', 'link', 'add', 'ethx', 'type', 'dummy'], check=True)
subprocess.run(['ip', 'link', 'set', 'ethx', 'up'], check=True)
time.sleep(2)
# remove dummy interface ethx（in fact this won't remove nic)
subprocess.run(['ip', 'link', 'del', 'ethx'], check=True)
# immediately add dummy nic ethx
subprocess.run(['ip', 'link', 'add', 'ethx', 'type', 'dummy'], check=True)
subprocess.run(['ip', 'link', 'set', 'ethx', 'up'], check=True)
time.sleep(1)
# delay 1s，now lldpd will update and reinit ethx
# now remove ethx, as this will result in bind raw socket failure and trigger "lldpd_hardware_cleanup(cfg, hardware)"
subprocess.run(['ip', 'link', 'del', 'ethx'], check=True)
https://github.com/lldpd/lldpd/blob/master/src/daemon/interfaces.c
Perhaps we don't need to free hardware memory of ethx after reinit fails, as we will do so in the upcoming lldpd_cleanup.
When I commented out the cleanup here, everything seemed to be working properly
if (init(cfg, hardware) != 0) {
log_warnx("interfaces",
"unable to initialize %s",
hardware->h_ifname);
// lldpd_hardware_cleanup(cfg, hardware);
continue;
}