bird-1.5.0 ipv4 segfaults on configure - is it safe to change bgp protocol names runtime?

[Jan Matejka]

Hi!

On 03/18/2016 08:36 AM, Bartosz Radwan wrote:
> Hi bird users,
> 
> General question is: is it safe to change bgp protocol name runtime?

It generally should be; I just assume that Bird doesn't know about
rename. Therefore, after configure, it just kills the old BGP and starts
a new instance of the protocol.

> We're running two instances of bird 1.5.0 on PLD Linux boxes.
> 
> several days we've upgraded our two routers to 1.5.0 and made some
> changes in our configuration.
> 
> There were no problems for about a week.
> 
> We've decided to tidy up our bgp protocol names (few of them), and the
> problem occurred on both instances.
> 
> First instance just after configure:
> bird[30925]: segfault at 31 ip 000000000040e5d9 sp 00007fffac0862f8
> error 6 in bird[400000+64000]
> 
> Then, on the other instance, ~15 hours after configure:
> bird[27708]: segfault at 41 ip 000000000040e5c3 sp 00007fff39e55a38
> error 6 in bird[400000+64000]
> 
> I can reproduce error that occurs at configure time in local envoroment,
> hovever there's no any established sessions at all in ths env, not sure
> if errors are the same.

Can you please send in a reduced config set that still causes this bug?
I'd like to reproduce it locally and fix it thereafter.

Thanks a lot.

> Here's backtrace:
> 
> 
> bird: F_1_0901_NEW_NAME: Initializing
> bird: F_1_0901_NEW_NAME: Starting
> bird: F_1_0901_NEW_NAME: State changed to start
> bird: F_1_0901_OLD_NAME: State changed to down
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x0000000000455bfb in ?? ()
> (gdb) bt
> #0  0x0000000000455bfb in ?? ()
> #1  0x000000000040e4ee in olock_run_event (unused=<optimized out>) at
> ../../nest/locks.c:177
> #2  0x000000000043b76e in ev_run (e=0x66c010) at event.c:85
> #3  ev_run_list (l=0x66b2e0 <global_event_list>) at event.c:142
> #4  0x000000000043de3c in io_loop () at io.c:2061
> #5  0x00000000004031d3 in main (argc=<optimized out>, argv=<optimized
> out>) at main.c:833
> 
> 
> Then i've used much simplier config (just 1 bgp session) in my local
> enviroment, after 3rd protocol name change and reconfiguration another
> error occurred:
> 
> bird: Removing protocol one_SOME_LONGER
> bird: one_SOME_LONGER: Shutting down
> bird: one_SOME_LONGER: Shutdown requested
> bird: one_SOME_LONGER: State changed to stop
> bird: Adding protocol one_SOME_LONGER_NAME
> bird: one_SOME_LONGER_NAME: Initializing
> bird: one_SOME_LONGER_NAME: Starting
> bird: one_SOME_LONGER_NAME: State changed to start
> bird: one_SOME_LONGER: Down
> 
> Program received signal SIGSEGV, Segmentation fault.
> olock_free (r=0x6751b0) at ../../nest/locks.c:72
> 72                rem_node(n);
> (gdb) bt
> #0  olock_free (r=0x6751b0) at ../../nest/locks.c:72
> #1  0x0000000000445752 in pool_free (P=<optimized out>) at resource.c:81
> #2  0x00000000004457c3 in rfree (res=0x674830) at resource.c:165
> #3  0x000000000040ae8f in proto_notify_state (p=0x674da0, ps=<optimized
> out>) at ../../nest/proto.c:1387
> #4  0x000000000043b76e in ev_run (e=0x675120) at event.c:85
> #5  ev_run_list (l=0x66b2e0 <global_event_list>) at event.c:142
> #6  0x000000000043de3c in io_loop () at io.c:2061
> #7  0x00000000004031d3 in main (argc=<optimized out>, argv=<optimized
> out>) at main.c:833
> 
> Another protocol name change triggered another error:
> 
> bird: Removing protocol one_SOME_LONGER_NAME_2
> bird: one_SOME_LONGER_NAME_2: Shutting down
> bird: one_SOME_LONGER_NAME_2: Shutdown requested
> bird: one_SOME_LONGER_NAME_2: State changed to stop
> bird: Adding protocol one_SOME_LONGER_NAME_2_3
> bird: one_SOME_LONGER_NAME_2_3: Initializing
> bird: one_SOME_LONGER_NAME_2_3: Starting
> bird: one_SOME_LONGER_NAME_2_3: State changed to start
> bird: one_SOME_LONGER_NAME_2: Down
> bird: one_SOME_LONGER_NAME_2: State changed to down
> bird: Reconfigured
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x000000000044574f in pool_free (P=<optimized out>) at resource.c:81
> 81            r->class->free(r);
> (gdb) bt
> #0  0x000000000044574f in pool_free (P=<optimized out>) at resource.c:81
> #1  0x00000000004457c3 in rfree (res=0x6807c0) at resource.c:165
> #2  0x000000000043d94b in sk_read (s=s at entry=0x680660) at io.c:1786
> #3  0x000000000043e23c in io_loop () at io.c:2158
> #4  0x00000000004031d3 in main (argc=<optimized out>, argv=<optimized
> out>) at main.c:833
> 
> 
> Further details including core files from gdb may be provided if needed.
>