BIRD crashes on OSPF reconfiguration

[Nicolas Devos]

Hello,

I am here to report a crash encountered upon reconfiguration of bird.

The crash is reproducible using the `birdc reconfigure soft` command. In this example I changed the OSPF
link type (from pointopoint to broadcast). However, I have seen the crash with other reconfigurations as well.

Below I entering the configurations, log and stack trace. This hopefully helps in debugging the issue.
If more information is needed, let me know.  I am happy to help where I can.
The tested version is v3.1.4.

```
# bird -u bird -g bird -c /opt//bird/bird.conf -d
bird: 2025-10-28 12:37:48.107 [0001]  Chosen router ID 10.89.112.123 according to interface enp6s0
bird: 2025-10-28 12:37:48.107 [0001]  Started
bird: 2025-10-28 12:37:50.621 [0001]  Reconfiguring
bird: 2025-10-28 12:37:50.621 [0001]  Adding protocol ospf1
bird: 2025-10-28 12:37:50.621 [0001]  Reconfigured
bird: 2025-10-28 12:37:53.885 [0001]  Reconfiguring
bird: 2025-10-28 12:37:53.886 [0001]  ospf1: Restarting interface enp11s0.3676 (172.21.8.0/28) in area 0.0.0.1
bird: 2025-10-28 12:37:53.886 [0001]  Trying to lock in a bad order: 00007ffed0528670 00007f9a66c1a3b8
Aborted (core dumped)
```

```
# birdc 'configure soft "/tmp/ospf/ospf-2.conf"'
BIRD 3.1.4 ready.
Reading configuration from /tmp/ospf/ospf-2.conf
Reconfigured
# birdc 'configure soft "/tmp/ospf/ospf-1.conf"'
BIRD 3.1.4 ready.
Connection closed by server
```

```
# cat /tmp/ospf/ospf-1.conf
router id 10.89.112.123;

protocol device {}
protocol kernel {
  learn;
  scan time 20;
  ipv4 {};
}

protocol ospf v2 {
        area 1 {
                interface "enp11s0.3676" {
                        dead 40;
                        type broadcast;
                };
        };
}
```

```
# cat /tmp/ospf/ospf-2.conf
router id 10.89.112.123;

protocol device {}
protocol kernel {
  learn;
  scan time 20;
  ipv4 {};
}

protocol ospf v2 {
        area 1 {
                interface "enp11s0.3676" {
                        dead 40;
                        type pointopoint;
                };
        };
}
```

```
Thread 1 "bird" received signal SIGABRT, Aborted.
0x00007ffff7c8bedc in __pthread_kill_implementation () from /lib64/libc.so.6
(gdb) bt
#0  0x00007ffff7c8bedc in __pthread_kill_implementation () from /lib64/libc.so.6
#1  0x00007ffff7c3eb46 in raise () from /lib64/libc.so.6
#2  0x00007ffff7c28833 in abort () from /lib64/libc.so.6
#3  0x0000555555636e1f in bug ()
#4  0x0000555555638b83 in do_lock ()
#5  0x00005555555969f9 in olock_free.lto_priv ()
#6  0x000055555558b85a in pool_free ()
#7  0x000055555559712f in rfree.part ()
#8  0x0000555555600265 in ospf_reconfigure.lto_priv ()
#9  0x00005555555a7581 in protos_do_commit.lto_priv ()
#10 0x00005555555786e4 in config_do_commit ()
#11 0x0000555555579bf3 in config_commit ()
#12 0x000055555563dc12 in cmd_reconfig ()
#13 0x0000555555654f6a in cf_parse.isra ()
#14 0x0000555555571e12 in cli_parse ()
#15 0x000055555559e6d9 in cli_command ()
#16 0x000055555559e93b in cli_event.lto_priv ()
#17 0x000055555558d953 in ev_run_list_limited ()
#18 0x000055555556bf4e in main ()
```

Kind regards,
Nicolas



This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, please notify the sender immediately and delete this message and any attachment from your system. Do not copy them or disclose the contents to any other person.