BGP: end of feeding MPLS channel must not try to schedule a packet

This caused a invalid memory use when reloading MPLS channels,
occasionally forcing BIRD to an endless loop due to invalid flag
in channel map.

diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c
index 33459add0ad76c96390469f314ae45c90c2c9ed5..a5ec4e6acab483bfb7a1cd7331cc8d1669e40920 100644 (file)
--- a/proto/bgp/bgp.c
+++ b/proto/bgp/bgp.c
@@ -1711,6 +1711,8 @@ bgp_done_route_refresh(struct rt_feeding_request *rfr)
 const char *
 bgp_begin_route_refresh(struct bgp_proto *p, struct bgp_channel *c)
 {
+  ASSERT_DIE(&c->c != p->p.mpls_channel);
+
   if (c->tx_keep)
     return bgp_tx_resend(p, c);
 
@@ -1823,10 +1825,12 @@ bgp_refeed_begin(struct channel *C, struct rt_feeding_request *rfr)
 static void
 bgp_export_fed(struct channel *C)
 {
-  SKIP_BACK_DECLARE(struct bgp_channel, c, c, C);
-  SKIP_BACK_DECLARE(struct bgp_proto, p, p, c->c.proto);
+  SKIP_BACK_DECLARE(struct bgp_proto, p, p, C->proto);
+  if (C == p->p.mpls_channel)
+    return;
 
   /* Schedule End-of-RIB packet */
+  SKIP_BACK_DECLARE(struct bgp_channel, c, c, C);
   switch (c->feed_state)
   {
     case BFS_LOADING:

diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index d41921a5b6f3ed6dce060962f9a2515e8d8f1a4e..76238b7156e21e83fd7be98ed92de79370437599 100644 (file)
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -3227,6 +3227,8 @@ bgp_schedule_packet(struct bgp_conn *conn, struct bgp_channel *c, int type)
 
   if (c)
   {
+    ASSERT_DIE(c->index < p->channel_count);
+
     if (! conn->channels_to_send)
     {
       conn->last_channel = c->index;