On Wed, 19 Aug 2015, Martin Winter wrote:
Latest series of commits cause a crash in ospfd. This is based on
testing based on commit 6064613
The offending commit is 94266fa “ospfd: Self nbrs needs to be rebuilt
when router ID changes.”
Well, that's interesting.
#3 0x00007f576c9930ee in malloc_printerr (ptr=<optimized out>,
str=0x7f576ca956f8 "free(): corrupted unsorted chunks", action=1)
at malloc.c:4996
#4 _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at
malloc.c:3840
#5 0x00007f576cd08074 in zfree (type=145, ptr=0x1a90a70) at
memory.c:132
#6 0x00007f576cf7d249 in ospf_nbr_free (nbr=0x1a90a70) at
ospf_neighbor.c:144
#7 0x00007f576cf7d356 in ospf_nbr_delete (nbr=0x1a90a70) at
ospf_neighbor.c:185
#8 0x00007f576cf71a43 in ospf_router_id_update (ospf=0x1a6b670) at
ospfd.c:121
#9 0x00007f576cfaec8e in ospf_router_id (self=0x7f576d1f7320
<router_ospf_id_cmd>, vty=0x1a91c10, argc=1,
argv=0x7fff00826080) at ospf_vty.c:199
#6 0x00007f576cf7d249 in ospf_nbr_free (nbr=0x1a90a70) at
ospf_neighbor.c:144
144 XFREE (MTYPE_OSPF_NEIGHBOR, nbr);
(gdb) list
139 OSPF_NSM_TIMER_OFF (nbr->t_ls_upd);
140
141 /* Cancel all events. *//* Thread lookup cost would be negligible.
*/
142 thread_cancel_event (master, nbr);
143
144 XFREE (MTYPE_OSPF_NEIGHBOR, nbr);
145 }
146
147 /* Delete specified OSPF neighbor from interface. */
148 void
this is from the new lines inserted:
#8 0x00007f576cf71a43 in ospf_router_id_update (ospf=0x1a6b670) at
ospfd.c:121
121 ospf_nbr_delete(oi->nbr_self);
(gdb) list
116 /* Some nbrs are identified by router_id, these needs
117 * to be rebuilt. Possible optimization would be to do
118 * oi->nbr_self->router_id = router_id for
119 * !(virtual | ptop) links
120 */
121 ospf_nbr_delete(oi->nbr_self);
122 ospf_nbr_add_self(oi);
123 }
124
125 /* If AS-external-LSA is queued, then flush those LSAs. */
The crash happens (reliable in my testbed) whenever I change the OSPF
router-id
That's interesting. It's likely the bug is not in this patch, but in other
code. Either oi->nbr_self is invalid already before ospf_nbr_delete is
called and something wrote into it - in which case the old code is wrong
too (it writes into it) - or something under ospf_nbr_delete is clobbering
something, or something stranger.
Can you run this under valgrind?
regards,
--
Paul Jakma [email protected] @pjakma Key ID: 64A2FF6A
Fortune:
If you have nothing to do, don't do it here.
_______________________________________________
Quagga-dev mailing list
[email protected]
https://lists.quagga.net/mailman/listinfo/quagga-dev
