Crash in BGP

[donaldsharp]

Description

Recent commit: bfedb38 causes a crash in bgp on my machine.

(gdb) bt
#0  __pthread_kill_implementation (no_tid=0, signo=11, threadid=124583315603008) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=11, threadid=124583315603008) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=124583315603008, signo=signo@entry=11) at ./nptl/pthread_kill.c:89
#3  0x0000714ed0242476 in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
#4  0x0000714ed074cfb7 in core_handler (signo=11, siginfo=0x7ffe6d9792b0, context=0x7ffe6d979180) at lib/sigevent.c:258
#5  <signal handler called>
#6  0x000060f55e33ffdd in route_table_get_info (table=0x0) at ./lib/table.h:177
#7  0x000060f55e340053 in bgp_dest_table (dest=0x60f56dabb840) at ./bgpd/bgp_table.h:156
#8  0x000060f55e340c9f in is_route_injectable_into_vpn (pi=0x60f56dbc4a60) at ./bgpd/bgp_mplsvpn.h:331
#9  0x000060f55e34507c in vpn_leak_from_vrf_update (to_bgp=0x60f56da52070, from_bgp=0x60f56da75af0, path_vrf=0x60f56dbc4a60) at bgpd/bgp_mplsvpn.c:1575
#10 0x000060f55e346657 in vpn_leak_from_vrf_update_all (to_bgp=0x60f56da52070, from_bgp=0x60f56da75af0, afi=AFI_IP) at bgpd/bgp_mplsvpn.c:2028
#11 0x000060f55e340c10 in vpn_leak_postchange (direction=BGP_VPN_POLICY_DIR_TOVPN, afi=AFI_IP, bgp_vpn=0x60f56da52070, bgp_vrf=0x60f56da75af0) at ./bgpd/bgp_mplsvpn.h:310
#12 0x000060f55e34a692 in vpn_leak_postchange_all () at bgpd/bgp_mplsvpn.c:3737
#13 0x000060f55e3d91fc in router_bgp (self=0x60f55e5cbc20 <router_bgp_cmd>, vty=0x60f56e2d7660, argc=3, argv=0x60f56da19830) at bgpd/bgp_vty.c:1601
#14 0x0000714ed069ddf5 in cmd_execute_command_real (vline=0x60f56da32a80, vty=0x60f56e2d7660, cmd=0x0, up_level=0) at lib/command.c:1002
#15 0x0000714ed069df6e in cmd_execute_command (vline=0x60f56da32a80, vty=0x60f56e2d7660, cmd=0x0, vtysh=0) at lib/command.c:1061
#16 0x0000714ed069e51e in cmd_execute (vty=0x60f56e2d7660, cmd=0x60f56dbf07d0 "router bgp 100\n", matched=0x0, vtysh=0) at lib/command.c:1227
#17 0x0000714ed076faa0 in vty_command (vty=0x60f56e2d7660, buf=0x60f56dbf07d0 "router bgp 100\n") at lib/vty.c:616
#18 0x0000714ed07719c4 in vty_execute (vty=0x60f56e2d7660) at lib/vty.c:1379
#19 0x0000714ed07740f0 in vtysh_read (thread=0x7ffe6d97c700) at lib/vty.c:2374
#20 0x0000714ed07685c4 in event_call (thread=0x7ffe6d97c700) at lib/event.c:1995
#21 0x0000714ed06e3351 in frr_run (master=0x60f56d1d2e40) at lib/libfrr.c:1232
#22 0x000060f55e2c4b44 in main (argc=7, argv=0x7ffe6d97c978) at bgpd/bgp_main.c:555
(gdb) 

(gdb) bt
#0  __pthread_kill_implementation (no_tid=0, signo=11, threadid=129307699863104) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=11, threadid=129307699863104) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=129307699863104, signo=signo@entry=11) at ./nptl/pthread_kill.c:89
#3  0x0000759acb642476 in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
#4  0x0000759acbb4cfb7 in core_handler (signo=11, siginfo=0x7ffc709af9f0, context=0x7ffc709af8c0) at lib/sigevent.c:258
#5  <signal handler called>
#6  bgp_dest_table (dest=0x62f5e0d5fb80) at ./bgpd/bgp_table.h:156
#7  0x000062f5df953c9f in is_route_injectable_into_vpn (pi=0x62f5e1191bf0) at ./bgpd/bgp_mplsvpn.h:331
#8  0x000062f5df95807c in vpn_leak_from_vrf_update (to_bgp=0x62f5e0d56cc0, from_bgp=0x62f5e0d1fde0, path_vrf=0x62f5e1191bf0) at bgpd/bgp_mplsvpn.c:1575
#9  0x000062f5df959657 in vpn_leak_from_vrf_update_all (to_bgp=0x62f5e0d56cc0, from_bgp=0x62f5e0d1fde0, afi=AFI_IP) at bgpd/bgp_mplsvpn.c:2028
#10 0x000062f5df953c10 in vpn_leak_postchange (direction=BGP_VPN_POLICY_DIR_TOVPN, afi=AFI_IP, bgp_vpn=0x62f5e0d56cc0, bgp_vrf=0x62f5e0d1fde0) at ./bgpd/bgp_mplsvpn.h:310
#11 0x000062f5df95d692 in vpn_leak_postchange_all () at bgpd/bgp_mplsvpn.c:3737
#12 0x000062f5dfa325ec in bgp_ifp_create (ifp=0x62f5e0ccc3b0) at bgpd/bgp_zebra.c:3357
#13 0x0000759acbacec52 in hook_call_if_real (ifp=0x62f5e0ccc3b0) at lib/if.c:54
#14 0x0000759acbacf20d in if_new_via_zapi (ifp=0x62f5e0ccc3b0) at lib/if.c:187
#15 0x0000759acbb8d52a in zclient_interface_add (cmd=0, zclient=0x62f5e076d0f0, length=74, vrf_id=11) at lib/zclient.c:2610
#16 0x0000759acbb9243a in zclient_read (thread=0x7ffc709b0a80) at lib/zclient.c:4624
#17 0x0000759acbb685c4 in event_call (thread=0x7ffc709b0a80) at lib/event.c:1995
#18 0x0000759acbae3351 in frr_run (master=0x62f5e047ce40) at lib/libfrr.c:1232
#19 0x000062f5df8d7b44 in main (argc=7, argv=0x7ffc709b0cf8) at bgpd/bgp_main.c:555
(gdb) 

are two examples of the crash.

This crash happens for me in the evpn_type5_test_topo1/test_evpn_type5_topo1.py topotest. I have also seen it on some other tests as well but I focused on this test for git bisect and reproduction.

I reproduced this by running the entirety of all topotests while also making a bunch of copies of the evpn_type5_test_topo1/test_evpn_type5_topo1.py test by
cp test_evpn_type5_topo1.py test_a.py ....

Version

latest master

How to reproduce

listed above

Expected behavior

no crash

Actual behavior

crash

Additional context

No response

Checklist

• I have searched the open issues for this bug.
• I have not included sensitive information in this report.