Reconfiguring MPLS channel while down causes segfault on bird 3.2.0

Max Hearnden bird-user at zandoodle.me.uk
Fri Apr 3 02:38:06 CEST 2026


Hello, I've found an issue with bird 3.2.0 which can be reproduced with 
the following configuration (no peer required). Just run configure after 
starting bird.


router id 1;

mpls table mtab;
mpls domain mdom;

protocol bgp test {
   local 192.0.2.2 port 8179 as 65000;
   neighbor 192.0.2.1 as 65001;
   mpls {label policy aggregate;};
}

It appears that this issue is caused because c->mpls_map is only set in 
mpls_channel_start instead of mpls_channel_init which would also match 
the deallocation in mpls_channel_cleanup. This means that before the 
channel is first up c->mpls_map is null and would cause a null pointer 
dereference as part of mpls_fec_map_reconfigure (called in 
mpls_channel_reconfigure).



More information about the Bird-users mailing list