Hi Lars, you are 100 % correct. This looks like a bug in v3. I managed to reproduce it in our test setup consistently as well, so thank you for all the info you provided! Hopefully we will fix it in the upcoming version v3.1.3 and backport it to stable-v3.1 as well. Thanks again for helping us make BIRD better! Cheers, David David Petera (he/him) | BIRD Tech Support | CZ.NIC, z.s.p.o. On 11/14/25 18:53, Lars Gierth via Bird-users wrote:
I forgot to mention: the backtrace and binary+coredump are with the "babel bird's nest" patch included. I did test vanilla bird stable-v3.1 without the patch and it segfaults the same.
On 11/14/25 18:33, Lars Gierth via Bird-users wrote:
Hi all,
I'm migrating a bigger Babel network from Bird 2.17.x to 3.1.x. This is on OpenWrt snapshot x86_64 with latest Bird stable-v3.1 branch. Shortly after starting Bird, it segfaults.
I tested all the individual filter statements in my config and confirmed it's those comparing against ifname, e.g.:
if ifname = "ts_wg0" then
It doesn't segfault if I first check for unreachable:
if dest != RTD_UNREACHABLE && ifname = "ts_wg0" then
The docs state that ifname returns an empty string for sink routes, and that's what worked for us in 2.17.x, but maybe that broke somehow? Anyway, with this workaround I can continue testing and rolling out.
Here's the backtrace. The config is attached and binary+coredump can be downloaded here: https://github.com/user-attachments/files/23552707/ bird-coredump.zip Let me know if the coredump is broken, gdb did say "memory read failed".
#0 0x00007ffff7fabd80 in ?? () #1 0x000000000041f881 in val_same (v1=v1@entry=0x7fffffffdb90, v2=0x7fffffffdba8) at filter/data.c:281 #2 0x0000000000415bd7 in interpret (line=<optimized out>, argc=argc@entry=0, argv=argv@entry=0x0, resc=resc@entry=0, resv=resv@entry=0x0, fs=<optimized out>) at filter/f-inst.c:453 #3 0x000000000041efb6 in f_run_args (filter=0x7ffff7f31300, rte=rte@entry=0x7fffffffe8c0, argc=argc@entry=0, argv=argv@entry=0x0, flags=flags@entry=0) at filter/filter.c:232 #4 0x000000000041f01b in f_run (filter=<optimized out>, rte=rte@entry=0x7fffffffe8c0, flags=flags@entry=0) at filter/filter.c:215 #5 0x000000000045c328 in channel_rte_import (c=c@entry=0x7ffff7e61830, n=n@entry=0x7ffff7df6ea8, new=new@entry=0x7fffffffe8c0, src=0x7ffff7e6e1c0) at nest/rt-table.c:2348 #6 0x000000000046468f in babel_rte_update_unreachable (p=p@entry=0x7ffff7e61440, e=e@entry=0x7ffff7df6e30, announce=announce@entry=1 '\001') at proto/babel/babel.c:698 #7 0x0000000000466c7c in babel_rt_notify (c=<optimized out>, old=<optimized out>, P=0x7ffff7e61440, net=<optimized out>, new=0x0) at proto/babel/babel.c:2516 #8 babel_rt_notify (P=0x7ffff7e61440, c=<optimized out>, net=<optimized out>, new=0x0, old=<optimized out>) at proto/babel/ babel.c:2408 #9 0x00000000004581b7 in rt_notify_basic (c=c@entry=0x7ffff7e61830, new=new@entry=0x0, old=old@entry=0x7ffff7d983b8) at nest/rt-table.c:1250 #10 0x00000000004593ab in channel_notify_basic (_channel=0x7ffff7e61830) at nest/rt-table.c:1661 #11 0x000000000043459b in ev_run_list_limited (l=0x53d860 <global_work_list>, limit=9, limit@entry=10) at lib/event.c:338 #12 0x00000000004a7f5d in io_loop () at sysdep/unix/io.c:2640 #13 0x00000000004037d7 in main (argc=<optimized out>, argv=<optimized out>) at sysdep/unix/main.c:1106
Cheers, and thanks for your work! Lars Freifunk Berlin