Segfault with ifname filter and RTD_UNREACHABLE

[David Petera]

Hi Lars,

you are 100 % correct. This looks like a bug in v3.
I managed to reproduce it in our test setup consistently as well, so 
thank you for all the info you provided!

Hopefully we will fix it in the upcoming version v3.1.3 and backport it 
to stable-v3.1 as well.

Thanks again for helping us make BIRD better!
Cheers, David

David Petera (he/him) | BIRD Tech Support | CZ.NIC, z.s.p.o.

On 11/14/25 18:53, Lars Gierth via Bird-users wrote:
> I forgot to mention: the backtrace and binary+coredump are with the 
> "babel bird's nest" patch included. I did test vanilla bird 
> stable-v3.1 without the patch and it segfaults the same.
>
> On 11/14/25 18:33, Lars Gierth via Bird-users wrote:
>> Hi all,
>>
>> I'm migrating a bigger Babel network from Bird 2.17.x to 3.1.x. This 
>> is on OpenWrt snapshot x86_64 with latest Bird stable-v3.1 branch. 
>> Shortly after starting Bird, it segfaults.
>>
>> I tested all the individual filter statements in my config and 
>> confirmed it's those comparing against ifname, e.g.:
>>
>>      if ifname = "ts_wg0" then
>>
>> It doesn't segfault if I first check for unreachable:
>>
>>      if dest != RTD_UNREACHABLE && ifname = "ts_wg0" then
>>
>> The docs state that ifname returns an empty string for sink routes, 
>> and that's what worked for us in 2.17.x, but maybe that broke 
>> somehow? Anyway, with this workaround I can continue testing and 
>> rolling out.
>>
>> Here's the backtrace. The config is attached and binary+coredump can 
>> be downloaded here: 
>> https://github.com/user-attachments/files/23552707/ bird-coredump.zip 
>> Let me know if the coredump is broken, gdb did say "memory read failed".
>>
>>      #0  0x00007ffff7fabd80 in ?? ()
>>      #1  0x000000000041f881 in val_same (v1=v1 at entry=0x7fffffffdb90, 
>> v2=0x7fffffffdba8) at filter/data.c:281
>>      #2  0x0000000000415bd7 in interpret (line=<optimized out>, 
>> argc=argc at entry=0, argv=argv at entry=0x0, resc=resc at entry=0, 
>> resv=resv at entry=0x0, fs=<optimized out>) at filter/f-inst.c:453
>>      #3  0x000000000041efb6 in f_run_args (filter=0x7ffff7f31300, 
>> rte=rte at entry=0x7fffffffe8c0, argc=argc at entry=0, argv=argv at entry=0x0, 
>> flags=flags at entry=0) at filter/filter.c:232
>>      #4  0x000000000041f01b in f_run (filter=<optimized out>, 
>> rte=rte at entry=0x7fffffffe8c0, flags=flags at entry=0) at 
>> filter/filter.c:215
>>      #5  0x000000000045c328 in channel_rte_import 
>> (c=c at entry=0x7ffff7e61830, n=n at entry=0x7ffff7df6ea8, 
>> new=new at entry=0x7fffffffe8c0, src=0x7ffff7e6e1c0) at 
>> nest/rt-table.c:2348
>>      #6  0x000000000046468f in babel_rte_update_unreachable 
>> (p=p at entry=0x7ffff7e61440, e=e at entry=0x7ffff7df6e30, 
>> announce=announce at entry=1 '\001') at proto/babel/babel.c:698
>>      #7  0x0000000000466c7c in babel_rt_notify (c=<optimized out>, 
>> old=<optimized out>, P=0x7ffff7e61440, net=<optimized out>, new=0x0) 
>> at proto/babel/babel.c:2516
>>      #8  babel_rt_notify (P=0x7ffff7e61440, c=<optimized out>, 
>> net=<optimized out>, new=0x0, old=<optimized out>) at proto/babel/ 
>> babel.c:2408
>>      #9  0x00000000004581b7 in rt_notify_basic 
>> (c=c at entry=0x7ffff7e61830, new=new at entry=0x0, 
>> old=old at entry=0x7ffff7d983b8) at nest/rt-table.c:1250
>>      #10 0x00000000004593ab in channel_notify_basic 
>> (_channel=0x7ffff7e61830) at nest/rt-table.c:1661
>>      #11 0x000000000043459b in ev_run_list_limited (l=0x53d860 
>> <global_work_list>, limit=9, limit at entry=10) at lib/event.c:338
>>      #12 0x00000000004a7f5d in io_loop () at sysdep/unix/io.c:2640
>>      #13 0x00000000004037d7 in main (argc=<optimized out>, 
>> argv=<optimized out>) at sysdep/unix/main.c:1106
>>
>> Cheers, and thanks for your work!
>> Lars
>> Freifunk Berlin
>