BIRD 2.17 crash on Debian 12 / kernel 6.1.0-33 apparently related to TCP-AO ocde

[Radu-Adrian Feurdean]

Hello,

Just found this morning a condition that crashes BIRD 2.17 (nic.cz <http://nic.cz/> .deb version for Debian 12) on today’s up-to-date Deb12.
The issue seems to be related to the TCP-AO code.
GDB tells me this:

(gdb) bt full
#0  0x0000556005dcd7f0 in bgp_incoming_connection (sk=0x55603a779860, dummy=<optimized out>) at proto/bgp/bgp.c:1705
        p = 0x55603a79c750
        acc = <optimized out>
        hops = <optimized out>
#1  0x0000556005e04e61 in sk_passive_connected (s=0x55603a7c5aa0, type=type at entry=2) at sysdep/unix/io.c:1337
        loc_sa = {sa = {sa_family = 2, sa_data = "\000\263\271\001\220\001\000\000\000\000\000\000\000"}, padding = "\005\030\020\000\000y{\\ \000\000\000\314Q\000"}
        rem_sa = {sa = {sa_family = 2, sa_data = "\215-\271\001\220\022\000\000\000\000\000\000\000"}, padding = "\000\000\000\000\000\000\000\000\000+ \"\257\371", <incomplete sequence \354\270>}
        loc_sa_len = 16
        rem_sa_len = 16
        fd = 27
        t = 0x55603a779860
#2  0x0000556005e05ce2 in sk_read_noflush (revents=<optimized out>, s=0x55603a7c5aa0) at sysdep/unix/io.c:2105
No locals.
#3  sk_read (s=s at entry=0x55603a7c5aa0, revents=<optimized out>) at sysdep/unix/io.c:2165
        e = <optimized out>
#4  0x0000556005e06907 in io_loop () at sysdep/unix/io.c:2626
        s = 0x55603a7c5aa0
        count = 3
        poll_tout = <optimized out>
        timeout = <optimized out>
        nfds = <optimized out>
        events = <optimized out>
        pout = <optimized out>
        t = <optimized out>
        s = <optimized out>
        n = <optimized out>
        fdmax = 256
        pfd = 0x55603a7c5190
        next = <optimized out>
        next2 = <optimized out>
#5  0x0000556005d550df in main (argc=<optimized out>, argv=<optimized out>) at sysdep/unix/main.c:1089
        use_uid = <optimized out>
        use_gid = <optimized out>
        conf = 0x7fa680793010

Please let mw know how should I send you a coredump (I actually have 2), if needed.

I have also identified the pice of config that turns on the behaviour.

2.16.2 seems to be fine, which is kind of normal, since the piece of code pointed to by gdb is not there in 2.16.2.

Regards,
--
Radu-Adrian FEURDEAN
Web : www.franceix.net