Hello! Could you please provide a description how to replicate this bug without any external app? It's quite uncommon to receive 16k routes by OSPF so we don't test such scenarios and by your report, I can imagine lots of variants to check. Thanks Maria On 9/23/22 16:38, mukund via Bird-users wrote:

Hi,

We are using bird version 2.0.9.  We have IXIA traffic which is sending 16K OSPF  routes to our App which we send to Bird. Issue is seen when we restart our App. As part of our restart app handling, we restart Bird as well. We see a crash  with following BT

VT33-VT33_PRI:~/backup/cores/coredump_2022-09-20.20.31.33# gdb bird core.bird.30975 GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-120.0.1.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.  Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /home/talariuser/backup/cores/coredump_2022-09-20.20.31.33/bird...done. [New LWP 30975] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `/home/talariuser/bird/sbin/bird -f'. Program terminated with signal 8, Arithmetic exception. *#0  0x000000000047262e in sl_free (s=0x783170, oo=0x7ffff6e1fc60) at /tn-build/src/third_party/bird/lib/slab.c:315* 315     /tn-build/src/third_party/bird/lib/slab.c: No such file or directory. Missing separate debuginfos, use: debuginfo-install glibc-2.17-325.0.1.el7_9.x86_64 openssl-libs-1.0.2k-22.el7_9.x86_64 zlib-1.2.7-19.el7_9.x86_64 (gdb) bt #0  0x000000000047262e in sl_free (s=0x783170, oo=0x7ffff6e1fc60) at /tn-build/src/third_party/bird/lib/slab.c:315 #1  0x0000000000462e33 in fib_delete (f=0x75f508, E=0x7ffff6e1fc60) at /tn-build/src/third_party/bird/nest/rt-fib.c:479 #2  0x0000000000420915 in rt_sync (p=0x75f350) at /tn-build/src/third_party/bird/proto/ospf/rt.c:2104 #3  0x00000000004218da in ospf_rt_spf.part.31 (p=0x75f350) at /tn-build/src/third_party/bird/proto/ospf/rt.c:1721 #4  0x000000000041f403 in ospf_rt_spf (p=0x75f350) at /tn-build/src/third_party/bird/proto/ospf/rt.c:1692 #5  0x000000000042fb8f in ospf_disp (timer=0x782f10) at /tn-build/src/third_party/bird/proto/ospf/ospf.c:482 #6  0x00000000004736cf in timers_fire (loop=0x74e0e0 <main_timeloop>) at /tn-build/src/third_party/bird/lib/timer.c:235 #7  0x0000000000408d0a in io_loop () at /tn-build/src/third_party/bird/sysdep/unix/io.c:2260 #8  0x0000000000405af6 in main (argc=2, argv=0x7fffffffeb68) at /tn-build/src/third_party/bird/sysdep/unix/main.c:952

Since all routes are newly passed and OSPF SPF calculation is done from scratch, not sure why delete / free has an issue.

Also issue is not seen when there are less routes say ~200. Seems to be specific to huge number. If any pointers to this will be helpful

Thanks in advance .

Regards Mukund