Segfault with ifname filter and RTD_UNREACHABLE

[Lars Gierth]

I forgot to mention: the backtrace and binary+coredump are with the 
"babel bird's nest" patch included. I did test vanilla bird stable-v3.1 
without the patch and it segfaults the same.

On 11/14/25 18:33, Lars Gierth via Bird-users wrote:
> Hi all,
> 
> I'm migrating a bigger Babel network from Bird 2.17.x to 3.1.x. This is 
> on OpenWrt snapshot x86_64 with latest Bird stable-v3.1 branch. Shortly 
> after starting Bird, it segfaults.
> 
> I tested all the individual filter statements in my config and confirmed 
> it's those comparing against ifname, e.g.:
> 
>      if ifname = "ts_wg0" then
> 
> It doesn't segfault if I first check for unreachable:
> 
>      if dest != RTD_UNREACHABLE && ifname = "ts_wg0" then
> 
> The docs state that ifname returns an empty string for sink routes, and 
> that's what worked for us in 2.17.x, but maybe that broke somehow? 
> Anyway, with this workaround I can continue testing and rolling out.
> 
> Here's the backtrace. The config is attached and binary+coredump can be 
> downloaded here: https://github.com/user-attachments/files/23552707/ 
> bird-coredump.zip Let me know if the coredump is broken, gdb did say 
> "memory read failed".
> 
>      #0  0x00007ffff7fabd80 in ?? ()
>      #1  0x000000000041f881 in val_same (v1=v1 at entry=0x7fffffffdb90, 
> v2=0x7fffffffdba8) at filter/data.c:281
>      #2  0x0000000000415bd7 in interpret (line=<optimized out>, 
> argc=argc at entry=0, argv=argv at entry=0x0, resc=resc at entry=0, 
> resv=resv at entry=0x0, fs=<optimized out>) at filter/f-inst.c:453
>      #3  0x000000000041efb6 in f_run_args (filter=0x7ffff7f31300, 
> rte=rte at entry=0x7fffffffe8c0, argc=argc at entry=0, argv=argv at entry=0x0, 
> flags=flags at entry=0) at filter/filter.c:232
>      #4  0x000000000041f01b in f_run (filter=<optimized out>, 
> rte=rte at entry=0x7fffffffe8c0, flags=flags at entry=0) at filter/filter.c:215
>      #5  0x000000000045c328 in channel_rte_import 
> (c=c at entry=0x7ffff7e61830, n=n at entry=0x7ffff7df6ea8, 
> new=new at entry=0x7fffffffe8c0, src=0x7ffff7e6e1c0) at nest/rt-table.c:2348
>      #6  0x000000000046468f in babel_rte_update_unreachable 
> (p=p at entry=0x7ffff7e61440, e=e at entry=0x7ffff7df6e30, 
> announce=announce at entry=1 '\001') at proto/babel/babel.c:698
>      #7  0x0000000000466c7c in babel_rt_notify (c=<optimized out>, 
> old=<optimized out>, P=0x7ffff7e61440, net=<optimized out>, new=0x0) at 
> proto/babel/babel.c:2516
>      #8  babel_rt_notify (P=0x7ffff7e61440, c=<optimized out>, 
> net=<optimized out>, new=0x0, old=<optimized out>) at proto/babel/ 
> babel.c:2408
>      #9  0x00000000004581b7 in rt_notify_basic 
> (c=c at entry=0x7ffff7e61830, new=new at entry=0x0, 
> old=old at entry=0x7ffff7d983b8) at nest/rt-table.c:1250
>      #10 0x00000000004593ab in channel_notify_basic 
> (_channel=0x7ffff7e61830) at nest/rt-table.c:1661
>      #11 0x000000000043459b in ev_run_list_limited (l=0x53d860 
> <global_work_list>, limit=9, limit at entry=10) at lib/event.c:338
>      #12 0x00000000004a7f5d in io_loop () at sysdep/unix/io.c:2640
>      #13 0x00000000004037d7 in main (argc=<optimized out>, 
> argv=<optimized out>) at sysdep/unix/main.c:1106
> 
> Cheers, and thanks for your work!
> Lars
> Freifunk Berlin