[FROG] ospfd crashes when deleting a route-map
Amol Lad
Amol.Lad at 4rf.com
Fri Sep 25 07:00:04 UTC 2020
Hi Donald,
Below stack dumps I got. I tried to link libfrr statically by using options (--enable-shared --enable-static --enable-static-bin) but then libyang shows error
2026/03/07 05:28:37 WATCHFRR: [EC 100663318] YANG model "frr-module-translator@*" not embedded, trying external file
2026/03/07 05:28:37 WATCHFRR: libyang: Data model "frr-module-translator" not found.
2026/03/07 05:28:37 WATCHFRR: [EC 100663318] yang_translator_init: failed to load the "frr-module-translator" module
CRASH-1:
GNU gdb (GDB) 8.3.1
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "--host=x86_64-pc-linux-gnu --target=arm-openwrt-linux-muslgnueabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
[New LWP 17289]
Core was generated by `/usr/sbin/ospfd -d -A 127.0.0.1 -f /opt/conf/openwrt/etc/frr/ospfd.conf'.
Program terminated with signal SIGABRT, Aborted.
#0 0xb6f4319c in a_crash () at ./arch/arm/syscall_arch.h:75
75 __asm_syscall(R7_OPERAND, "0"(r0), "r"(r1), "r"(r2), "r"(r3));
Thread 1 (LWP 17289):
#0 0xb6f4319c in a_crash () at ./arch/arm/syscall_arch.h:75
#1 abort () at src/exit/abort.c:29
#2 0xb6e513a8 in core_handler () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#3 <signal handler called>
#4 unbin (i=36, c=0xa226e6) at src/malloc/malloc.c:192
#5 alloc_rev (c=c at entry=0xa22bb8) at src/malloc/malloc.c:223
#6 0xb6f48884 in __bin_chunk (self=0xa22bb8) at src/malloc/malloc.c:465
#7 0xb6e34dd4 in nb_config_diff_del_changes () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#8 0xb6e3a094 in nb_candidate_commit_apply () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#9 0xb6e3a360 in nb_candidate_commit () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#10 0xb6e66d20 in nb_cli_apply_changes () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#11 0xb6e54700 in set_metric_magic.isra () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#12 0xb6e548c4 in set_metric () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#13 0xb6e2deb8 in cmd_execute_command_real.isra () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#14 0xb6e2e608 in cmd_execute_command () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#15 0xb6e3034c in cmd_execute () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#16 0xb6e8b0b4 in vty_command () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#17 0xb6e8b390 in vty_execute.lto_priv () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#18 0xb6e744fc in vtysh_read () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#19 0xb6e8c1a0 in thread_call () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#20 0xb6e3daec in frr_run () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#21 0x00492038 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
CRASH-2:
GNU gdb (GDB) 8.3.1
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "--host=x86_64-pc-linux-gnu --target=arm-openwrt-linux-muslgnueabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
[New LWP 9922]
Core was generated by `/usr/sbin/ospfd -d -A 127.0.0.1 -f /opt/conf/openwrt/etc/frr/ospfd.conf'.
Program terminated with signal SIGABRT, Aborted.
#0 0xb6f3819c in a_crash () at ./arch/arm/syscall_arch.h:75
75 __asm_syscall(R7_OPERAND, "0"(r0), "r"(r1), "r"(r2), "r"(r3));
Thread 1 (LWP 9922):
#0 0xb6f3819c in a_crash () at ./arch/arm/syscall_arch.h:75
#1 abort () at src/exit/abort.c:29
#2 0xb6e463a8 in core_handler () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#3 <signal handler called>
#4 0xb6f3d6d0 in a_crash () at src/malloc/malloc.c:450
#5 __bin_chunk (self=0x15faba8) at src/malloc/malloc.c:450
#6 0xb6e46078 in route_map_rule_delete () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#7 0xb6e4dd3c in route_map_index_delete () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#8 0xb6e4dd88 in lib_route_map_entry_destroy () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#9 0xb6e2cacc in nb_callback_configuration.lto_priv () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#10 0xb6e2ccb4 in nb_transaction_process () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#11 0xb6e2f01c in nb_candidate_commit_apply () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#12 0xb6e2f360 in nb_candidate_commit () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#13 0xb6e5bd20 in nb_cli_apply_changes () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#14 0xb6e47fd8 in no_route_map_magic.isra () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#15 0xb6e48194 in no_route_map () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#16 0xb6e22eb8 in cmd_execute_command_real.isra () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#17 0xb6e23608 in cmd_execute_command () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#18 0xb6e2534c in cmd_execute () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#19 0xb6e800b4 in vty_command () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#20 0xb6e80390 in vty_execute.lto_priv () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#21 0xb6e694fc in vtysh_read () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#22 0xb6e811a0 in thread_call () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#23 0xb6e32aec in frr_run () from staging_dir/target-arm_cortex-a9+vfpv3_musl_eabi/root-mvebu/usr/lib/libfrr.so.0
#24 0x00500038 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) frame 5
#5 __bin_chunk (self=0x15faba8) at src/malloc/malloc.c:450
450 if (next->psize != self->csize) a_crash();
(gdb) list
445 int i;
446
447 final_size = new_size = CHUNK_SIZE(self);
448
449 /* Crash on corrupted footer (likely from buffer overflow) */
450 if (next->psize != self->csize) a_crash();
451
452 for (;;) {
453 if (self->psize & next->csize & C_INUSE) {
454 self->csize = final_size | C_INUSE;
-----Original Message-----
From: Donald Sharp <sharpd at cumulusnetworks.com>
Sent: Thursday, 24 September 2020 4:58 PM
To: Amol Lad <Amol.Lad at 4rf.com>
Cc: frog at lists.frrouting.org
Subject: Re: [FROG] ospfd crashes when deleting a route-map
That version of libyang should be sufficient. Can we get a full stack decode of ospf crashing then?
On Thu, Sep 24, 2020 at 7:25 AM Amol Lad <Amol.Lad at 4rf.com> wrote:
>
> Hi Donald,
>
> I'm using libyang version 1.0.167. What is recommended libyang version for FRR 7.4 release?
>
> Thanks
>
>
> -----Original Message-----
> From: Donald Sharp <sharpd at cumulusnetworks.com>
> Sent: Thursday, 24 September 2020 4:51 PM
> To: Amol Lad <Amol.Lad at 4rf.com>
> Cc: frog at lists.frrouting.org
> Subject: Re: [FROG] ospfd crashes when deleting a route-map
>
> Amol -
>
> I'm not seeing this when I try to run. What version of libyang are you using?
>
> donald
>
> On Thu, Sep 24, 2020 at 5:22 AM Amol Lad <Amol.Lad at 4rf.com> wrote:
> >
> > Hi,
> >
> > I'm using FRR 7.4 (OpenWrt). I'm not using the integrated-config (i.e. each daemon has it's own config file). Below sequence of commands crashes ospfd. Please advise if any more useful debug information I can provide regarding this issue.
> >
> >
> > ===
> > CRASH-1 [this happens after "no route-map SET_MED permit 10" command
> > is executed]
> >
> > OSPF[9944]: Received signal 4 at 1772832797 (si_addr 0xffffffffb6f206d0); aborting...
> > OSPF[9944]: in thread vtysh_read scheduled from lib/vty.c:2675
> >
> >
> > FRR(config)# log syslog
> > FRR(config)# debug ospf zebra
> > FRR(config)# debug ospf event
> > FRR(config)# debug ospf ism
> > FRR(config)# do show running-config
> > Building configuration...
> >
> > Current configuration:
> > !
> > frr version 7.4
> > frr defaults traditional
> > log syslog
> > hostname FRR
> > !
> > line vty
> > !
> > End
> >
> > FRR(config)# route-map SET_MED permit 10 FRR(config-route-map)# set
> > metric 3333 FRR(config-route-map)# exit FRR(config)# no route-map
> > SET_MED permit 10
> > (** console hangs here for very long time and finally shows below
> > error **)
> > vtysh: error reading from ospfd: No such file or directory (2)Warning: closing connection to ospfd because of an I/O error!
> > FRR(config)#
> >
> > ===
> > CRASH-2 [this happens after "set metric 1234" command is executed]
> >
> > ripd[9945]: route_set_metric_compile: Metric specified: 1234 is
> > greater than RIP_METRIC_INFINITY, using INFINITY instead
> > ripngd[9948]: route_set_metric_compile: Metric specified: 1234 is
> > being converted into METRIC_INFINITY
> > OSPF[9952]: Received signal 11 at 1772834027 (si_addr 0x8); aborting...
> > OSPF[9952]: in thread vtysh_read scheduled from lib/vty.c:2675
> >
> > FRR(config)# log syslog
> > FRR(config)# debug ospf ism
> > FRR(config)# debug ospf event
> > FRR(config)# debug ospf zebra
> > FRR(config)# do show running-config
> > Building configuration...
> >
> > Current configuration:
> > !
> > frr version 7.4
> > frr defaults traditional
> > log syslog
> > hostname FRR
> > !
> > line vty
> > !
> > End
> >
> > FRR(config)# route-map SET_MED permit 10 FRR(config-route-map)# set
> > metric 1234
> > (** console hangs here for very long time and finally shows below
> > error **)
> > vtysh: error reading from ospfd: No such file or directory (2)Warning: closing connection to ospfd because of an I/O error!
> > AprisaLTE(config-route-map)#
> >
> > ==
> >
> > root at AprisaLTE:/# cat /etc/frr/daemons # The watchfrr and zebra
> > daemons are always started.
> > #
> > bgpd=yes
> > ospfd=yes
> > #ospfd_instances=1,20
> > ospf6d=yes
> > ripd=yes
> > ripngd=yes
> > isisd=no
> > pimd=no
> > ldpd=no
> > nhrpd=yes
> > eigrpd=yes
> > babeld=no
> > sharpd=no
> > pbrd=no
> > bfdd=no
> > fabricd=no
> > vrrpd=no
> >
> > #
> > # If this option is set the /etc/init.d/frr script automatically
> > loads # the config via "vtysh -b" when the servers are started.
> > # Check /etc/pam.d/frr if you intend to use "vtysh"!
> > #
> > vtysh_enable=yes
> > zebra_options=" -A 127.0.0.1 -s 90000000 -f /opt/conf/openwrt/etc/frr/zebra.conf"
> > bgpd_options=" -A 127.0.0.1 -f /opt/conf/openwrt/etc/frr/bgpd.conf"
> > ospfd_options=" -A 127.0.0.1 -f /opt/conf/openwrt/etc/frr/ospfd.conf"
> > ospf6d_options=" -A ::1 -f /opt/conf/openwrt/etc/frr/ospf6d.conf"
> > ripd_options=" -A 127.0.0.1 -f /opt/conf/openwrt/etc/frr/ripd.conf"
> > ripngd_options=" -A ::1 -f /opt/conf/openwrt/etc/frr/ripngd.conf"
> > isisd_options=" -A 127.0.0.1"
> > pimd_options=" -A 127.0.0.1"
> > ldpd_options=" -A 127.0.0.1 -f /opt/conf/openwrt/etc/frr/ldpd.conf"
> > nhrpd_options=" -A 127.0.0.1 -f /opt/conf/openwrt/etc/frr/nhrpd.conf"
> > eigrpd_options=" -A 127.0.0.1 -f /opt/conf/openwrt/etc/frr/eigrpd.conf"
> > babeld_options=" -A 127.0.0.1"
> > sharpd_options=" -A 127.0.0.1"
> > pbrd_options=" -A 127.0.0.1 -f /opt/conf/openwrt/etc/frr/pbrd.conf"
> > staticd_options="-A 127.0.0.1 -f /opt/conf/openwrt/etc/frr/staticd.conf"
> > bfdd_options=" -A 127.0.0.1 -f /opt/conf/openwrt/etc/frr/bfdd.conf"
> > fabricd_options="-A 127.0.0.1"
> > vrrpd_options=" -A 127.0.0.1"
> >
> > # The list of daemons to watch is automatically generated by the init script.
> > #watchfrr_options=""
> >
> > # for debugging purposes, you can specify a "wrap" command to start
> > instead # of starting the daemon directly, e.g. to use valgrind on ospfd:
> > # ospfd_wrap="/usr/bin/valgrind"
> > # or you can use "all_wrap" for all daemons, e.g. to use perf record:
> > # all_wrap="/usr/bin/perf record --call-graph -"
> > # the normal daemon command is added to this at the end.
> > _______________________________________________
> > frog mailing list
> > frog at lists.frrouting.org
> > https://lists.frrouting.org/listinfo/frog
> ________________________________
> The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).
More information about the frog
mailing list