[PATCH 0/2] bird 3.3.0: `show proto all` SIGSEGV and out_limit underflow SIGABRT

[Yifei Sun]

This is a follows up on my earlier report

Patch 1/2 is the workaround I already linked.
In short, SIGSEGV in bgp_show_proto_info() when prometheus-bird-exporter
runs `show protocols all` every 30s under BGP churn (trace in previous mail).
The patch drops the per bucket prefix count so the walk no longer derefs a
stale bucket prefix slot (this is a very minimal workaround)

Patch 2/2 is addressing SIGABRT from an out_limit counter underflow,
please see trace below:

```console
$ colmena exec --verbose --on butte,timah -- sudo coredumpctl list
timah |
butte |
timah | TIME                            PID UID GID SIG     COREFILE EXE                                                               SIZE
timah | Wed 2026-06-03 01:50:12 UTC    1177 999 999 SIGABRT present  /nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird 109.3M
timah | Wed 2026-06-03 09:31:36 UTC 1429113 999 999 SIGABRT present  /nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird   116M
timah | Succeeded
butte | TIME                            PID UID GID SIG     COREFILE EXE                                                               SIZE
butte | Wed 2026-06-03 07:49:46 UTC 1569499 993 991 SIGABRT present  /nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird 124.2M
butte | Wed 2026-06-03 08:09:28 UTC 1630583 993 991 SIGABRT present  /nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird 120.2M
butte | Wed 2026-06-03 08:14:44 UTC 1638833 993 991 SIGABRT present  /nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird 119.9M
butte | Wed 2026-06-03 08:40:10 UTC 1641543 993 991 SIGABRT present  /nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird 121.6M
butte | Wed 2026-06-03 08:49:22 UTC 1652085 993 991 SIGABRT present  /nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird 120.1M
butte | Wed 2026-06-03 10:37:51 UTC 1656139 993 991 SIGABRT present  /nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird   125M
butte | Succeeded
      | All done!
```

```console
$ sudo coredumpctl info
           PID: 1656139 (bird)
           UID: 993 (bird)
           GID: 991 (bird)
        Signal: 6 (ABRT)
     Timestamp: Wed 2026-06-03 10:37:05 UTC (2h 15min ago)
  Command Line: /nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird -c /etc/bird/bird.conf
    Executable: /nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird
 Control Group: /system.slice/bird.service
          Unit: bird.service
         Slice: system.slice
       Boot ID: dfa9f57ca76345e98c08abe21afcc0bd
    Machine ID: 7d543c30c6554cebbc9c4c6e94f78247
      Hostname: butte
       Storage: /var/lib/systemd/coredump/core.bird.993.dfa9f57ca76345e98c08abe21afcc0bd.1656139.1780483025000000.zst (present)
  Size on Disk: 125M
       Message: Process 1656139 (bird) of user 993 dumped core.

                Module /nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird without build-id.
                Module libz.so.1 without build-id.
                Module libssh.so.4 without build-id.
                Stack trace of thread 1656139:
                #0  0x000079eb7089fdcc __pthread_kill_implementation (libc.so.6 + 0x9fdcc)
                #1  0x000079eb7084265e raise (libc.so.6 + 0x4265e)
                #2  0x000079eb70829350 abort (libc.so.6 + 0x29350)
                #3  0x0000595bc856aeca bug (/nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird + 0x13beca)
                #4  0x0000595bc84d9f85 limit_pop.part.0.lto_priv.0 (/nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird + 0xaaf85)
                #5  0x0000595bc84cc5e4 do_rt_notify (/nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird + 0x9d5e4)
                #6  0x0000595bc84ccbed rt_notify_basic (/nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird + 0x9dbed)
                #7  0x0000595bc84cd07b channel_notify_optimal_req (/nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird + 0x9e07b)
                #8  0x0000595bc84cd3c0 channel_notify_optimal (/nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird + 0x9e3c0)
                #9  0x0000595bc8492f35 ev_run_list_limited (/nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird + 0x63f35)
                #10 0x0000595bc8447001 main (/nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird + 0x18001)
                #11 0x000079eb7082b285 __libc_start_call_main (libc.so.6 + 0x2b285)
                #12 0x000079eb7082b338 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x2b338)
                #13 0x0000595bc8447885 _start (/nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird + 0x18885)

                Stack trace of thread 1656141:
                #0  0x000079eb708a6922 __syscall_cancel_arch (libc.so.6 + 0xa6922)
                #1  0x000079eb7089a00c __internal_syscall_cancel (libc.so.6 + 0x9a00c)
                #2  0x000079eb7089a084 __syscall_cancel (libc.so.6 + 0x9a084)
                #3  0x000079eb7091778e __poll (libc.so.6 + 0x11778e)
                #4  0x0000595bc8566b3e bird_thread_main.lto_priv.0 (/nix/store/xyxkk8dfzz668lmksbb73rp5qzz88r2a-bird-3.3.0/bin/bird + 0x137b3e)
                #5  0x000079eb7089dd53 start_thread (libc.so.6 + 0x9dd53)
                #6  0x000079eb7092563c __clone3 (libc.so.6 + 0x12563c)
                ELF object binary architecture: AMD x86-64
```

Yifei Sun (2):
  BGP: skip bgp_bucket_pending() in show proto info
  Table export: don't pop out_limit for a never-exported old route

 nest/rt-table.c |  4 ++++
 proto/bgp/bgp.c | 10 ++++------
 2 files changed, 8 insertions(+), 6 deletions(-)

-- 
2.54.0