We sent a fix for this a while back together with a slew of other
VPN-related fixes. (We also have significantly more VPN and tunnel, aka
NVO3, related additions that we plan to make available soon.)
I know that David had looked at them at one point, not sure where they
stand in the list of things that need to be looked at...
Lou
On 9/1/2015 9:42 AM, Pavel Ivashchenko wrote:
> Hello!
>
> I found bug in bgpd daemon. Segfault after "show bgp ipv4 vpnv4
> statistics" command.
>
> ================================================================
> Program received signal SIGSEGV, Segmentation fault.
> 0x00007ffa3b65e694 in bgp_table_top (table=0x16800000078) at
> ../bgpd/bgp_table.h:197
> 197 return bgp_node_from_rnode (route_top (table->route_table));
> (gdb) backtrace
> #0 0x00007ffa3b65e694 in bgp_table_top (table=0x16800000078) at
> ../bgpd/bgp_table.h:197
> #1 0x00007ffa3b672389 in bgp_table_stats_walker (t=0x7ffcc04b5730) at
> bgp_route.c:9317
> #2 0x00007ffa3b1a0201 in thread_call (thread=0x7ffcc04b5730) at
> thread.c:1252
> #3 0x00007ffa3b1a0460 in funcname_thread_execute (m=0x7ffa3d3ed900,
> func=0x7ffa3b67235b <bgp_table_stats_walker>, arg=0x7ffcc04b5800, val=0,
> funcname=0x7ffa3b6ce1f3 "bgp_table_stats_walker",
> schedfrom=0x7ffa3b6bd600 "bgp_route.c", fromln=9427) at thread.c:1309
> #4 0x00007ffa3b6727b1 in bgp_table_stats (vty=0x7ffa3d50ff10,
> bgp=0x7ffa3d511010, afi=1, safi=128 '\200') at bgp_route.c:9427
> #5 0x00007ffa3b67302f in bgp_table_stats_vty (vty=0x7ffa3d50ff10,
> name=0x0, afi_str=0x7ffa3d4baec0 "ipv4", safi_str=0x7ffa3d4bb100
> "vpnv4") at bgp_route.c:9547
> #6 0x00007ffa3b67306b in show_bgp_statistics (self=0x7ffa3b90ea40
> <show_bgp_statistics_vpnv4_cmd>, vty=0x7ffa3d50ff10, argc=2,
> argv=0x7ffcc04b5980) at bgp_route.c:9561
> #7 0x00007ffa3b197fc6 in cmd_execute_command_real
> (vline=0x7ffa3d524e20, filter=FILTER_RELAXED, vty=0x7ffa3d50ff10,
> cmd=0x0) at command.c:2703
> #8 0x00007ffa3b1980fd in cmd_execute_command (vline=0x7ffa3d524e20,
> vty=0x7ffa3d50ff10, cmd=0x0, vtysh=0) at command.c:2757
> #9 0x00007ffa3b18deb1 in vty_command (vty=0x7ffa3d50ff10,
> buf=0x7ffa3d5100a0 "show bgp ipv4 vpnv4 statistics") at vty.c:419
> #10 0x00007ffa3b18fc5a in vty_execute (vty=0x7ffa3d50ff10) at vty.c:1287
> #11 0x00007ffa3b191679 in vtysh_read (thread=0x7ffcc04b6080) at vty.c:2103
> #12 0x00007ffa3b1a0201 in thread_call (thread=0x7ffcc04b6080) at
> thread.c:1252
> #13 0x00007ffa3b640a01 in main (argc=3, argv=0x7ffcc04b61e8) at
> bgp_main.c:463
> ================================================================
>
> We call "bgp_table_stats" function with argument safi == 128.
> Then we get pointer to bgp_table structurte (rib) (frame 0:
> ...table=0x16800000078...)
>
> ================================================================
> (gdb) print bgp->rib[1][128]
> $7 = (struct bgp_table *) 0x16800000078
> (gdb) print *bgp->rib[1][128]
> Cannot access memory at address 0x16800000078
> (gdb) print bgp->rib[1][1]
> $8 = (struct bgp_table *) 0x7ffa3d519f40
> (gdb) print *bgp->rib[1][1]
> $9 = {type = BGP_TABLE_MAIN, afi = 1, safi = 1 '\001', lock = 1, owner
> = 0x0, route_table = 0x7ffa3d519f70}
> ================================================================
>
> This happens because bgp->rib array have insufficient size.
>
> From bgp.h:
>
> ================================
> struct bgp
> {
> .........
> /* BGP routing information base. */
> struct bgp_table *rib[AFI_MAX][SAFI_MAX];
> .........
> }
> ================================
>
> SAFI_MAX and AFI_MAX defined in lib/zebra.h :
>
> ================================
> #define AFI_MAX 3
> #define SAFI_MAX 5
> ================================
>
> Best Regards,
> Pavel Ivashchenko
>
>
> _______________________________________________
> Quagga-dev mailing list
> [email protected]
> https://lists.quagga.net/mailman/listinfo/quagga-dev
_______________________________________________
Quagga-dev mailing list
[email protected]
https://lists.quagga.net/mailman/listinfo/quagga-dev
