Hello!
I found bug in bgpd daemon. Segfault after "show bgp ipv4 vpnv4
statistics" command.
================================================================
Program received signal SIGSEGV, Segmentation fault.
0x00007ffa3b65e694 in bgp_table_top (table=0x16800000078) at
../bgpd/bgp_table.h:197
197 return bgp_node_from_rnode (route_top (table->route_table));
(gdb) backtrace
#0 0x00007ffa3b65e694 in bgp_table_top (table=0x16800000078) at
../bgpd/bgp_table.h:197
#1 0x00007ffa3b672389 in bgp_table_stats_walker (t=0x7ffcc04b5730) at
bgp_route.c:9317
#2 0x00007ffa3b1a0201 in thread_call (thread=0x7ffcc04b5730) at
thread.c:1252
#3 0x00007ffa3b1a0460 in funcname_thread_execute (m=0x7ffa3d3ed900,
func=0x7ffa3b67235b <bgp_table_stats_walker>, arg=0x7ffcc04b5800, val=0,
funcname=0x7ffa3b6ce1f3 "bgp_table_stats_walker",
schedfrom=0x7ffa3b6bd600 "bgp_route.c", fromln=9427) at thread.c:1309
#4 0x00007ffa3b6727b1 in bgp_table_stats (vty=0x7ffa3d50ff10,
bgp=0x7ffa3d511010, afi=1, safi=128 '\200') at bgp_route.c:9427
#5 0x00007ffa3b67302f in bgp_table_stats_vty (vty=0x7ffa3d50ff10,
name=0x0, afi_str=0x7ffa3d4baec0 "ipv4", safi_str=0x7ffa3d4bb100
"vpnv4") at bgp_route.c:9547
#6 0x00007ffa3b67306b in show_bgp_statistics (self=0x7ffa3b90ea40
<show_bgp_statistics_vpnv4_cmd>, vty=0x7ffa3d50ff10, argc=2,
argv=0x7ffcc04b5980) at bgp_route.c:9561
#7 0x00007ffa3b197fc6 in cmd_execute_command_real
(vline=0x7ffa3d524e20, filter=FILTER_RELAXED, vty=0x7ffa3d50ff10,
cmd=0x0) at command.c:2703
#8 0x00007ffa3b1980fd in cmd_execute_command (vline=0x7ffa3d524e20,
vty=0x7ffa3d50ff10, cmd=0x0, vtysh=0) at command.c:2757
#9 0x00007ffa3b18deb1 in vty_command (vty=0x7ffa3d50ff10,
buf=0x7ffa3d5100a0 "show bgp ipv4 vpnv4 statistics") at vty.c:419
#10 0x00007ffa3b18fc5a in vty_execute (vty=0x7ffa3d50ff10) at vty.c:1287
#11 0x00007ffa3b191679 in vtysh_read (thread=0x7ffcc04b6080) at vty.c:2103
#12 0x00007ffa3b1a0201 in thread_call (thread=0x7ffcc04b6080) at
thread.c:1252
#13 0x00007ffa3b640a01 in main (argc=3, argv=0x7ffcc04b61e8) at
bgp_main.c:463
================================================================
We call "bgp_table_stats" function with argument safi == 128.
Then we get pointer to bgp_table structurte (rib) (frame 0:
...table=0x16800000078...)
================================================================
(gdb) print bgp->rib[1][128]
$7 = (struct bgp_table *) 0x16800000078
(gdb) print *bgp->rib[1][128]
Cannot access memory at address 0x16800000078
(gdb) print bgp->rib[1][1]
$8 = (struct bgp_table *) 0x7ffa3d519f40
(gdb) print *bgp->rib[1][1]
$9 = {type = BGP_TABLE_MAIN, afi = 1, safi = 1 '\001', lock = 1, owner =
0x0, route_table = 0x7ffa3d519f70}
================================================================
This happens because bgp->rib array have insufficient size.
>From bgp.h:
================================
struct bgp
{
.........
/* BGP routing information base. */
struct bgp_table *rib[AFI_MAX][SAFI_MAX];
.........
}
================================
SAFI_MAX and AFI_MAX defined in lib/zebra.h :
================================
#define AFI_MAX 3
#define SAFI_MAX 5
================================
Best Regards,
Pavel Ivashchenko
_______________________________________________
Quagga-dev mailing list
[email protected]
https://lists.quagga.net/mailman/listinfo/quagga-dev
