Bird 2.0.9 Crash when 16K routes sent from our App to Bird module

[Maria Matejka]

Hello!

Could you please provide a description how to replicate this bug without 
any external app? It's quite uncommon to receive 16k routes by OSPF so 
we don't test such scenarios and by your report, I can imagine lots of 
variants to check.

Thanks
Maria

On 9/23/22 16:38, mukund via Bird-users wrote:
> 
> Hi,
> 
> We are using bird version 2.0.9.  We have IXIA traffic which is sending 
> 16K OSPF  routes to our App which
> we send to Bird. Issue is seen when we restart our App. As part of our 
> restart app handling, we restart Bird as well.
> We see a crash  with following BT
> 
> VT33-VT33_PRI:~/backup/cores/coredump_2022-09-20.20.31.33# gdb bird 
> core.bird.30975
> GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-120.0.1.el7
> Copyright (C) 2013 Free Software Foundation, Inc.
> License GPLv3+: GNU GPL version 3 or later 
> <http://gnu.org/licenses/gpl.html>
> This is free software: you are free to change and redistribute it.
> There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
> and "show warranty" for details.
> This GDB was configured as "x86_64-redhat-linux-gnu".
> For bug reporting instructions, please see:
> <http://www.gnu.org/software/gdb/bugs/>...
> Reading symbols from 
> /home/talariuser/backup/cores/coredump_2022-09-20.20.31.33/bird...done.
> [New LWP 30975]
> [Thread debugging using libthread_db enabled]
> Using host libthread_db library "/lib64/libthread_db.so.1".
> Core was generated by `/home/talariuser/bird/sbin/bird -f'.
> Program terminated with signal 8, Arithmetic exception.
> *#0  0x000000000047262e in sl_free (s=0x783170, oo=0x7ffff6e1fc60) at 
> /tn-build/src/third_party/bird/lib/slab.c:315*
> 315     /tn-build/src/third_party/bird/lib/slab.c: No such file or 
> directory.
> Missing separate debuginfos, use: debuginfo-install 
> glibc-2.17-325.0.1.el7_9.x86_64 openssl-libs-1.0.2k-22.el7_9.x86_64 
> zlib-1.2.7-19.el7_9.x86_64
> (gdb) bt
> #0  0x000000000047262e in sl_free (s=0x783170, oo=0x7ffff6e1fc60) at 
> /tn-build/src/third_party/bird/lib/slab.c:315
> #1  0x0000000000462e33 in fib_delete (f=0x75f508, E=0x7ffff6e1fc60) at 
> /tn-build/src/third_party/bird/nest/rt-fib.c:479
> #2  0x0000000000420915 in rt_sync (p=0x75f350) at 
> /tn-build/src/third_party/bird/proto/ospf/rt.c:2104
> #3  0x00000000004218da in ospf_rt_spf.part.31 (p=0x75f350) at 
> /tn-build/src/third_party/bird/proto/ospf/rt.c:1721
> #4  0x000000000041f403 in ospf_rt_spf (p=0x75f350) at 
> /tn-build/src/third_party/bird/proto/ospf/rt.c:1692
> #5  0x000000000042fb8f in ospf_disp (timer=0x782f10) at 
> /tn-build/src/third_party/bird/proto/ospf/ospf.c:482
> #6  0x00000000004736cf in timers_fire (loop=0x74e0e0 <main_timeloop>) at 
> /tn-build/src/third_party/bird/lib/timer.c:235
> #7  0x0000000000408d0a in io_loop () at 
> /tn-build/src/third_party/bird/sysdep/unix/io.c:2260
> #8  0x0000000000405af6 in main (argc=2, argv=0x7fffffffeb68) at 
> /tn-build/src/third_party/bird/sysdep/unix/main.c:952
> 
> Since all routes are newly passed and OSPF SPF calculation is done from 
> scratch, not sure why delete / free has an issue.
> 
> Also issue is not seen when there are less routes say ~200. Seems to be 
> specific to huge number.
> If any pointers to this will be helpful
> 
> Thanks in advance .
> 
> Regards
> Mukund
> 
> 
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2839 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://trubka.network.cz/pipermail/bird-users/attachments/20220923/e6fd0257/attachment.p7s>