Crash when filtering routes in BGP protocol

[Vincent Bernat]

Hey!

When filtering routes in BGP, I get the following crash with BIRD master:

#v+
Program received signal SIGSEGV, Segmentation fault.
0x000055555558ccdd in rta_free (r=0x55555558adc0 <rte_get_temp+16>) at ../nest/route.h:643
643     static inline void rta_free(rta *r) { if (r && !--r->uc) rta__free(r); }
gdb$  bt full
#0  0x000055555558ccdd in rta_free (r=0x55555558adc0 <rte_get_temp+16>) at ../nest/route.h:643
No locals.
#1  rte_update2 (c=0x5555555f3de0, n=0x7fffffffe2f0, n at entry=0x7fffffffe260, new=<optimized out>, src=0x5555555fec00) at ../nest/rt-table.c:1589
        old_attrs = 0x55555558adc0 <rte_get_temp+16>
        fr = <optimized out>
        p = <optimized out>
        stats = 0x5555555f3e78
        filter = 0x5555555ed980
        dummy = 0x0
        nn = 0x7fffffffe210
#2  0x000055555559ca0a in rte_update3 (src=<optimized out>, new=<optimized out>, n=<optimized out>, c=<optimized out>) at ../nest/protocol.h:628
No locals.
#3  bgp_rte_update (s=s at entry=0x7fffffffe350, n=n at entry=0x7fffffffe2f0, path_id=path_id at entry=4294959812, a0=a0 at entry=0x0) at ../proto/bgp/packets.c:1267
        a = <optimized out>
        e = <optimized out>
#4  0x000055555559d6dd in bgp_decode_nlri_ip6 (s=0x7fffffffe350, pos=<optimized out>, len=<optimized out>, a=0x0) at ../proto/bgp/packets.c:1500
        net = {type = 2 '\002', pxlen = 48 '0', length = 20, prefix = {addr = {536939960, 3722248192, 0, 0}}}
        path_id = 4294959812
        l = 48
        addr = {addr = {3087860000, 56797, 0, 0}}
        b = <optimized out>
#5  0x000055555559aced in bgp_decode_nlri (s=s at entry=0x7fffffffe460, afi=<optimized out>, nlri=0x5555556034d0 "0 \001\r\270\335\335\060 \001\r\270\314\314@\001\001", len=14, ea=ea at entry=0x5555556065f0, nh=<optimized out>, nh_len=32) at ../proto/bgp/packets.c:2351
        c = 0x5555555f3de0
        a = 0x7fffffffe350
#6  0x000055555559ed64 in bgp_rx_update (conn=conn at entry=0x5555555f3cd8, pkt=pkt at entry=0x555555603490 '\377' <repeats 16 times>, len=91) at ../proto/bgp/packets.c:2448
        p = <optimized out>
        ea = 0x5555556065f0
        s = {proto = 0x5555555f3ad0, channel = 0x5555555f3de0, pool = 0x5555556019c0, as4_session = 1, add_path = 0, mpls = 0, attrs_seen = {16390, 0, 0, 0, 0, 0, 0, 0}, mp_reach_af = 131073, mp_unreach_af = 0, attr_len = 68, ip_reach_len = 0, ip_unreach_len = 0, ip_next_hop_len = 0, mp_reach_len = 14, mp_unreach_len = 0, mp_next_hop_len = 32, attrs = 0x5555556034a7 "\220\016", ip_reach_nlri = 0x5555556034eb '\377' <repeats 16 times>, ip_unreach_nlri = 0x5555556034a5 "", ip_next_hop_data = 0x0, mp_reach_nlri = 0x5555556034d0 "0 \001\r\270\335\335\060 \001\r\270\314\314@\001\001", mp_unreach_nlri = 0x0, mp_next_hop_data = 0x5555556034af " \001\r\270\252\252", err_withdraw = 0, err_subcode = 0, err_jmpbuf = {{__jmpbuf = {93824992885456, -942560477419964727, 93824992949408, 93824992885976, 0, 93824992949392, 942560477161682633, 6359628643728717513}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}, hostentry = 0x0, mpls_labels = 0x0, last_id = 0, last_src = 0x5555555fec00, cached_rta = 0x5555556075c8}
        pos = <optimized out>
#7  0x000055555559fadb in bgp_rx_packet (len=<optimized out>, pkt=0x555555603490 '\377' <repeats 16 times>, conn=0x5555555f3cd8) at ../proto/bgp/packets.c:3024
        type = 2 '\002'
        type = <optimized out>
#8  bgp_rx (sk=0x555555601bb0, size=<optimized out>) at ../proto/bgp/packets.c:3069
        conn = 0x5555555f3cd8
        pkt_start = 0x555555603490 '\377' <repeats 16 times>
        end = 0x555555603508 ""
        i = <optimized out>
        len = <optimized out>
#9  0x00005555555a48da in call_rx_hook (s=0x555555601bb0, size=<optimized out>) at ../sysdep/unix/io.c:1794
No locals.
#10 0x00005555555a6db7 in sk_read (s=s at entry=0x555555601bb0, revents=1) at ../sysdep/unix/io.c:1882
        c = <optimized out>
#11 0x00005555555a781e in io_loop () at ../sysdep/unix/io.c:2344
        s = <optimized out>
        count = 1
        poll_tout = <optimized out>
        timeout = <optimized out>
        nfds = <optimized out>
        events = <optimized out>
        pout = <optimized out>
        t = <optimized out>
        s = <optimized out>
        n = <optimized out>
        fdmax = 256
        pfd = 0x555555601010
#12 0x0000555555560f53 in main (argc=<optimized out>, argv=<optimized out>) at ../sysdep/unix/main.c:906
        use_uid = <optimized out>
        use_gid = <optimized out>
        conf = 0x5555555eca10
#v-

Minimal configuration is:

#v+
log "/var/log/bird.log" all;
router id 2.2.2.2;

filter validated {
   reject;
}

protocol device {
}

protocol bgp {
   local as 65001;
   neighbor 2001:db8:aaaa::0 as 65000;
   ipv6 {
      import filter validated;
      export none;
   };
}
#v-

I have tried to fix that by initializing `old_attrs` to NULL, but this
leads to crash elsewhere. Since I don't know what a temporary attribute
is, I may miss the whole picture.
-- 
Don't diddle code to make it faster - find a better algorithm.
            - The Elements of Programming Style (Kernighan & Plauger)