[FROG] ospf6d issues (crashes getting routes from my network)

[Rudy Rucker]

I just upgraded from FreeBSD 11 to 12 and upgrade from quagga to FRR at 
the same time.
bgpd and ospfd work fine, but ospf6 doesn't work.  Not sure what I'm 
going wrong.  Here is the output from zebra and ospf6.

If I commend out all the interfaces EXCEPT lo0, ospf6d does not crash.

router ospf6
  ospf6 router-id 172.17.18.98
  redistribute connected route-map MONKEY-ospf6
  redistribute static route-map MONKEY-AND-MORE-ospf6
  !interface cxl1 area 0.0.0.0
  !interface cxl2 area 0.0.0.0
  !interface cxl3 area 0.0.0.0
  interface lo0 area 0.0.0.0

As soon as I get routes from my network, ospf6d tanks.

  Any thoughts?

*** LOGS ***

2019/10/10 23:19:31 OSPF6: Scheduling cxl1 for sso
2019/10/10 23:19:31 OSPF6: SPF: Scheduled in 0 msec
2019/10/10 23:19:31 OSPF6: SPF processing: # Areas: 1, SPF runtime: 0 
sec 5 usec, Reason: L+

2019/10/10 23:19:31 OSPF6: Scheduling cxl2 for sso
2019/10/10 23:19:31 OSPF6: SPF: Scheduled in 50 msec
2019/10/10 23:19:31 OSPF6: Scheduling cxl3 for sso
2019/10/10 23:19:31 OSPF6: Neighbor state change 172.17.24.25%cxl3: 
[Down]->[Init] (HelloReceived)
2019/10/10 23:19:31 OSPF6: Neighbor state change 172.17.24.25%cxl3: 
[Init]->[ExStart] (2-WayReceived)
2019/10/10 23:19:31 OSPF6: Neighbor state change 172.17.24.25%cxl3: 
[ExStart]->[ExChange] (NegotiationDone)
2019/10/10 23:19:31 OSPF6: Neighbor state change 172.17.24.25%cxl3: 
[ExChange]->[Loading] (ExchangeDone)
2019/10/10 23:19:31 OSPF6: SPF processing: # Areas: 1, SPF runtime: 0 
sec 109 usec, Reason: R+, R-, L+

2019/10/10 23:19:31 OSPF6: SPF: Scheduled in 83 msec
2019/10/10 23:19:31 OSPF6: SPF processing: # Areas: 1, SPF runtime: 0 
sec 116 usec, Reason: R+, N+, L+

2019/10/10 23:19:33 OSPF6: Neighbor state change 10.8.254.122%cxl1: 
[Down]->[Init] (HelloReceived)
2019/10/10 23:19:33 OSPF6: Neighbor state change 10.8.254.122%cxl1: 
[Init]->[ExStart] (2-WayReceived)
2019/10/10 23:19:33 OSPF6: Neighbor state change 10.8.254.122%cxl1: 
[ExStart]->[ExChange] (NegotiationDone)
2019/10/10 23:19:33 OSPF6: Neighbor state change 10.8.254.122%cxl1: 
[ExChange]->[Loading] (ExchangeDone)
2019/10/10 23:19:33 OSPF6: SPF: Scheduled in 0 msec
2019/10/10 23:19:33 OSPF6: SPF processing: # Areas: 1, SPF runtime: 0 
sec 99 usec, Reason: R+, R-

2019/10/10 23:19:36 OSPF6: Neighbor state change 172.17.24.25%cxl3: 
[Loading]->[Full] (LoadingDone)
2019/10/10 23:19:36 OSPF6: SPF: Scheduled in 0 msec
2019/10/10 23:19:31 ZEBRA: client 32 says hello and bids fair to 
announce only ospf6 routes vrf=0
2019/10/10 23:19:38 ZEBRA: [EC 4043309117] Client 'ospf6' encountered an 
error and is shutting down.
2019/10/10 23:19:38 ZEBRA: release_daemon_table_chunks: Released 0 table 
chunks
2019/10/10 23:19:38 ZEBRA: release_daemon_label_chunks: Released 0 label 
chunks
2019/10/10 23:19:39 ZEBRA: client 32 disconnected. 100 ospf6 routes 
removed from the rib

*** CRASH ***
If I run on the command line and don't background, it bombs after 7 seconds:
# ospf6d
Illegal instruction


Here is the end of truss:
# truss ospf6d
...
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 
34863378432 (0x81e04f000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 
34863382528 (0x81e050000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 
34863386624 (0x81e051000)
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 
34863390720 (0x81e052000)
SIGNAL 11 (SIGSEGV) code=SEGV_ACCERR trapno=12 addr=0x7fffdffffff8
process killed, signal = 4

I wasn't seeing any CORE files when the process dumped, so I turned this 
knob:
sysctl kern.sugid_coredump=1

Now there is a 1 GByte core file!

# /usr/obj/usr/src/amd64.amd64/gnu/usr.bin/gdb/gdb/gdb 
/usr/local/sbin/ospf6d ospf6d.core

(gdb) bt
#0  0x000000080030678c in hash_get () from /usr/local/lib/libfrr.so.0
#1  0x000000080033a9b2 in route_node_lookup () from 
/usr/local/lib/libfrr.so.0
#2  0x0000000000241345 in ospf6_route_lookup ()
#3  0x000000000022e718 in ospf6_abr_examin_summary ()
#4  0x000000000022f13b in ospf6_abr_examin_brouter ()
#5  0x00000000002473ad in ospf6_top_init ()
#6  0x000000000022efda in ospf6_abr_examin_summary ()
#7  0x000000000022f13b in ospf6_abr_examin_brouter ()
#8  0x00000000002473ad in ospf6_top_init ()
#9  0x000000000022efda in ospf6_abr_examin_summary ()
#10 0x000000000022f13b in ospf6_abr_examin_brouter ()
#11 0x00000000002473ad in ospf6_top_init ()
.... lines #3 - #5 repeat to over #8500 ... I stopped hitting ENTER 
around there and quit.



Any help would be appreciated.

Rudy