[FROG] FRR 7.2 bgpd core seen during bringup

23 May 2022


      Hi Folks,
Looking to see if such a core is seen earlier in bgpd due to thread being
NULL.
Similar core is also seen in zebra.


warning: Could not load shared library symbols for 3 libraries, e.g.
/lib/libnetsnmp.so.35.
Use the "info sharedlibrary" command to see the complete listing.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
--Type <RET> for more, q to quit, c to continue without paging--
Core was generated by `/usr/lib/frr/bgpd -d -A 127.0.0.1 -M snmp'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
[Current thread is 1 (Thread 0xffffb9352450 (LWP 634))]
(gdb) up
#1  0x0000ffffb8dd2a28 in __GI_abort () at abort.c:79
79 abort.c: No such file or directory.
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x0000ffffb8dd2a28 in __GI_abort () at abort.c:79
#2  0x0000ffffb9287494 in core_handler (signo=11, siginfo=0xffffdf24b1b0,
context=0xffffdf24b230) at lib/sigevent.c:228
#3  <signal handler called>
#4  0x0000ffffb929c9b0 in do_thread_cancel (master=0xaaaaf9433ff0) at
lib/thread.c:1184
#5  0x0000ffffb929cc10 in thread_cancel (thread=0xaaaaf98a4230) at
lib/thread.c:1234
#6  0x0000ffffb87eca64 in agentx_events_update () at lib/agentx.c:124
#7  0x0000ffffb87ec5bc in agentx_timeout (t=0xffffdf24c848) at
lib/agentx.c:51
#8  0x0000ffffb929ded0 in thread_call (thread=0xffffdf24c848) at
lib/thread.c:1762
#9  0x0000ffffb924ff24 in frr_run (master=0xaaaaf9433ff0) at
lib/libfrr.c:1054
#10 0x0000aaaad4723ed8 in main (argc=6, argv=0xffffdf24cae8) at
bgpd/bgp_main.c:488
(gdb) fr 6
#6  0x0000ffffb87eca64 in agentx_events_update () at lib/agentx.c:124
124 lib/agentx.c: No such file or directory.
(gdb) p ln
$1 = (struct listnode *) 0xaaaaf997dc40
(gdb) p *ln
$2 = {next = 0x0, prev = 0xaaaaf997d920, data = 0xaaaaf98a4230}


lib/thread.c:
/**
 * Process cancellation requests.
 *
 * This may only be run from the pthread which owns the thread_master.
 *
 * @param master the thread master to process
 * @REQUIRE master->mtx
 */
static void do_thread_cancel(struct thread_master *master)
{
        struct thread_list_head *list = NULL;
        struct thread **thread_array = NULL;
        struct thread *thread;

        struct cancel_req *cr;
        struct listnode *ln;
        for (ALL_LIST_ELEMENTS_RO(master->cancel_req, ln, cr)) {
                /* If this is an event object cancellation, linear search
                 * through event
                 * list deleting any events which have the specified
argument.
                 * We also
                 * need to check every thread in the ready queue. */
                if (cr->eventobj) {
                        struct thread *t;

                        frr_each_safe(thread_list, &master->event, t) {
                                if (t->arg != cr->eventobj)
                                        continue;
                                thread_list_del(&master->event, t);
                                if (t->ref)
                                        *t->ref = NULL;
                                thread_add_unuse(master, t);
                        }

                        frr_each_safe(thread_list, &master->ready, t) {
                                if (t->arg != cr->eventobj)
                                        continue;
                                thread_list_del(&master->ready, t);
                                if (t->ref)
                                        *t->ref = NULL;
                                thread_add_unuse(master, t);
                        }
                        continue;
                }

                /* The pointer varies depending on whether the cancellation
                 * request was
                 * made asynchronously or not. If it was, we need to check
                 * whether the
                 * thread even exists anymore before cancelling it. */
                thread = (cr->thread) ? cr->thread : *cr->threadref;

                if (!thread)
                        continue;

                /* Determine the appropriate queue to cancel the thread
from */
                switch (thread->type) {
                case THREAD_READ:
                        thread_cancel_rw(master, thread->u.fd, POLLIN);
                        thread_array = master->read;
                        break;
                case THREAD_WRITE:
                        thread_cancel_rw(master, thread->u.fd, POLLOUT);
                        thread_array = master->write;
                        break;
                case THREAD_TIMER:
                        thread_timer_list_del(&master->timer, thread);
                        break;
                case THREAD_EVENT:
                        list = &master->event;
                        break;
                case THREAD_READY:
                        list = &master->ready;
                        break;
                default:
                        continue;
                        break;
                }

                if (list) {
                        thread_list_del(list, thread);
                } else if (thread_array) {
                        thread_array[thread->u.fd] = NULL;
                }

                if (thread->ref)
                        *thread->ref = NULL;

                thread_add_unuse(thread->master, thread); <=====Line 1184
where the core generated(thread is NULL here)
        }

        /* Delete and free all cancellation requests */
        list_delete_all_node(master->cancel_req);

        /* Wake up any threads which may be blocked in
thread_cancel_async() */
        master->canceled = true;
        pthread_cond_broadcast(&master->cancel_cond);
}
Thanks
Thippanna

[FROG] FRR 7.2 bgpd core seen during bringup

hongal