Bird segfault during configure command

[Dmitry Sinina]

Hi.
We use bird as routing daemon on our linux routers.
At now we have one ospf and 7 bgp protocols in configuration.
During last bgp reconfiguration ( we play with med attribute) segfault 
occurred.
I see this in gdb:

Program terminated with signal 11, Segmentation fault.
#0  rem_node (n=0x7f58e2fccd80) at ../lib/lists.c:99
99      ../lib/lists.c: No such file or directory.
(gdb) bt
#0  rem_node (n=0x7f58e2fccd80) at ../lib/lists.c:99
#1  olock_free (r=0x7f58d9bc6140) at ../../nest/locks.c:70
#2  olock_free (r=0x7f58d9bc6140) at ../../nest/locks.c:52
#3  0x00007f58d5eed2e2 in pool_free (P=<optimized out>) at resource.c:81
#4  0x00007f58d5eed356 in rfree (res=0x7f58e210e880) at resource.c:164
#5  0x00007f58d5eb716a in proto_notify_state (p=0x7f58e3481240, 
ps=<optimized out>) at ../../nest/proto.c:1060
#6  0x00007f58d5ee4631 in ev_run (e=<optimized out>) at event.c:85
#7  ev_run_list (l=l at entry=0x7f58d610db30) at event.c:135
#8  0x00007f58d5ee64a8 in io_loop () at io.c:1559
#9  0x00007f58d5eb0044 in main (argc=<optimized out>, argv=<optimized 
out>) at main.c:744
(gdb) bt full
#0  rem_node (n=0x7f58e2fccd80) at ../lib/lists.c:99
         z = 0x0
         x = 0x7f58e2fccd88
#1  olock_free (r=0x7f58d9bc6140) at ../../nest/locks.c:70
         q = 0x7f58e2fccd40
         n = 0x7f58e2fccd80
         l = 0x7f58d9bc6140
#2  olock_free (r=0x7f58d9bc6140) at ../../nest/locks.c:52
         l = 0x7f58d9bc6140
#3  0x00007f58d5eed2e2 in pool_free (P=<optimized out>) at resource.c:81
         p = <optimized out>
         r = 0x7f58d9bc6140
         rr = 0x7f58d8bfbe00
#4  0x00007f58d5eed356 in rfree (res=0x7f58e210e880) at resource.c:164
         r = 0x7f58e210e880
#5  0x00007f58d5eb716a in proto_notify_state (p=0x7f58e3481240, 
ps=<optimized out>) at ../../nest/proto.c:1060
         ops = <optimized out>
         cs = 3
#6  0x00007f58d5ee4631 in ev_run (e=<optimized out>) at event.c:85
No locals.
#7  ev_run_list (l=l at entry=0x7f58d610db30) at event.c:135
         e = <optimized out>
         n = <optimized out>
         tmp_list = {head = 0x7fff3673ebc8, null = 0x0, tail = 
0x7fff3673ebc0}
#8  0x00007f58d5ee64a8 in io_loop () at io.c:1559
         rd = {fds_bits = {384, 0 <repeats 15 times>}}
         wr = {fds_bits = {0 <repeats 16 times>}}
         timo = {tv_sec = 0, tv_usec = 0}
         hi = <optimized out>
         events = <optimized out>
         s = <optimized out>
         n = <optimized out>
#9  0x00007f58d5eb0044 in main (argc=<optimized out>, argv=<optimized 
out>) at main.c:744
         use_uid = 913567152
         use_gid = 0

We cant reproduce this segfault but we have coredump. BIRD version 1.3.9 
from debian packages(bird_1.3.9-1_amd64.deb)


--
Regards,
Dmitry Sinina
ONAT network engineer