[portsorch] Invalid LAG learn_mode handling may corrupt m_toSync iterator in PortsOrch::doLagTask

[haojun291]

Is it platform specific

generic

Importance or Severity

Medium

Description of the bug

SONiC Version: latest master
Description:
In PortsOrch::doLagTask() in orchagent/portsorch.cpp, when parsing LAG attributes, the invalid learn_mode handling updates the outer m_toSync iterator inside the inner field parsing loop.
Current logic is similar to:

auto it = consumer.m_toSync.begin();
while (it != consumer.m_toSync.end())
{
    auto &t = it->second;
    for (auto i : kfvFieldsValues(t))
    {
        if (fvField(i) == "learn_mode")
        {
            const auto cit = learn_mode_map.find(learn_mode_str);
            if (cit == learn_mode_map.end())
            {
                SWSS_LOG_ERROR("Invalid MAC learn mode: %s", learn_mode_str.c_str());
                it++;
                continue;
            }
            learn_mode = cit->second;
        }
    }
    // Continue processing current LAG task...
}

There are two issues here:

• The continue statement is inside the inner for (auto i : kfvFieldsValues(t)) loop, so it only continues the field parsing loop. It does not skip the current LAG task in the outer while loop.
• The outer iterator it is incremented inside the inner loop while the code is still processing the current task through "it" and alias. This may cause the iterator to point to the next pending task while the current task is still being processed.

As a result, when an invalid learn_mode is configured:

1. The current invalid LAG task may still be processed with the default learning mode.
2. A later erase(it) or it++ may operate on the wrong pending task.
3. The outer m_toSync iterator may become inconsistent with the task currently being processed.