Crash in Zebra in nb_notify_delete_changes

[donaldsharp]

Description

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=134608067492288) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=134608067492288) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=134608067492288, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007a6ce1a42476 in __GI_raise (sig=6) at ../sysdeps/posix/raise.c:26
#4  0x00007a6ce1f56160 in core_handler (signo=6, siginfo=0x7fff60cd26b0, context=0x7fff60cd2580) at lib/sigevent.c:268
#5  <signal handler called>
#6  __pthread_kill_implementation (no_tid=0, signo=6, threadid=134608067492288) at ./nptl/pthread_kill.c:44
#7  __pthread_kill_internal (signo=6, threadid=134608067492288) at ./nptl/pthread_kill.c:78
#8  __GI___pthread_kill (threadid=134608067492288, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#9  0x00007a6ce1a42476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#10 0x00007a6ce1a287f3 in __GI_abort () at ./stdlib/abort.c:79
#11 0x00007a6ce1f9f28b in _zlog_assert_failed (xref=0x7a6ce2069280 <_xref.23>, extra=0x0) at lib/zlog.c:789
#12 0x00007a6ce1f269cf in nb_notify_delete_changes (args=0x5db5d0261080) at lib/northbound_notif.c:558
#13 0x00007a6ce1f26a42 in timer_walk_continue (event=0x7fff60cd3640) at lib/northbound_notif.c:577
#14 0x00007a6ce1f26d90 in timer_walk_start (event=0x7fff60cd3640) at lib/northbound_notif.c:621
#15 0x00007a6ce1f71577 in event_call (thread=0x7fff60cd3640) at lib/event.c:1984
#16 0x00007a6ce1ee75d2 in frr_run (master=0x5db5cfb9be10) at lib/libfrr.c:1246
#17 0x00005db5969b7d7f in main (argc=8, argv=0x7fff60cd3918) at zebra/main.c:543
(gdb) l
553             LY_ERR err;
554
555             group->cur_change = RB_MIN(op_changes, group->cur_changes);
556             while (group->cur_change) {
557                     err = mgmt_be_send_ds_delete_notification(group->cur_change->path);
558                     assert(err == LY_SUCCESS); /* XXX */
559
560                     group->cur_change = RB_NEXT(op_changes, group->cur_change);
561             }
562
(gdb) p err
$2 = LY_EMEM
(gdb) 

709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 550) static LY_ERR nb_notify_delete_changes(struct nb_notif_walk_args *args)
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 551) {
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 552)     struct op_changes_group *group = args->group;
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 553)     LY_ERR err;
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 554) 
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 555)     group->cur_change = RB_MIN(op_changes, group->cur_changes);
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 556)     while (group->cur_change) {
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 557)             err = mgmt_be_send_ds_delete_notification(group->cur_change->path);
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 558)             assert(err == LY_SUCCESS); /* XXX */
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 559) 
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 560)             group->cur_change = RB_NEXT(op_changes, group->cur_change);
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 561)     }
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 562) 
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 563)     return LY_SUCCESS;
709b2ae23f1 (Christian Hopps 2024-12-14 18:26:49 -0500 564) }

Version

latest MASTER

How to reproduce

Crashes in topotest bgp_evpn_rt5.test_bgp_evpn. Not sure how often though

Expected behavior

no crash

Actual behavior

crash

Additional context

I like llamas

Checklist

• I have searched the open issues for this bug.
• I have not included sensitive information in this report.