segmentation fault in radv protocol

[Julian Schuh]

Hi everyone,

while poking around with bird I stumbled upon a reproducible segmentation fault in the radv protocol (I think).

I’m using bird 2.0.2 with the following config (simplified for debugging purposes):
log syslog all;
debug protocols all;
protocol device { }
protocol radv {
    interface "br_client";
}

When flushing the addresses on interface br_client
ip addr flush dev br_client
the segmentation fault occurs, but only if the daemon has been running for a little bit longer than 60 seconds.

Before running the command, the interface is up and has a couple of IP addresses configured. The configuration is performed before bird is started:
ip addr add 192.168.27.1/24 dev br_client
ip addr add xxxx:xxxx:xxxx:xxxx::1/64 dev br_client
ip addr add fe80::27/64 dev br_client

Relevant log output starting from the moment when the flush command is executed:
Jul 19 08:24:15 bird: device1: Scanning interfaces
Jul 19 08:24:15 bird: radv1 < interface br_client goes up
Jul 19 08:24:15 bird: radv1: Adding interface br_client
Jul 19 08:24:15 bird: radv1 < address 192.168.27.0/24 on interface br_client added
Jul 19 08:24:15 bird: radv1 < address xxxx:xxxx:xxxx:xxxx::/64 on interface br_client added
Jul 19 08:24:15 bird: radv1 < address fe80::/64 on interface br_client added
Jul 19 08:24:18 bird: radv1 < address 192.168.27.0/24 on interface br_client removed
Jul 19 08:24:18 bird: radv1: Event Init on br_client
Jul 19 08:24:18 bird: radv1: Adding new prefix xxxx:xxxx:xxxx:xxxx::/64 on br_client
Jul 19 08:24:18 bird: radv1: Timer fired on br_client
Jul 19 08:24:18 bird: radv1: Sending RA via br_client
Jul 19 08:24:18 bird: radv1 < address xxxx:xxxx:xxxx:xxxx::/64 on interface br_client removed
Jul 19 08:24:18 bird: radv1: Event Change on br_client

I would appreciate any help.

Thanks in advance and best regards
Julian Schuh