BGP: end of feeding MPLS channel must not try to schedule a packet

This caused a invalid memory use when reloading MPLS channels,
occasionally forcing BIRD to an endless loop due to invalid flag
in channel map.

diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c
index 8ca1214f0de19d722441ce614c51af15088db684..5d5f85a2a0f8f10a97c60b24183fb97ff425d882 100644 (file)
--- a/proto/bgp/bgp.c
+++ b/proto/bgp/bgp.c
@@ -2210,6 +2210,8 @@ bgp_done_route_refresh(struct rt_feeding_request *rfr)
 const char *
 bgp_begin_route_refresh(struct bgp_proto *p, struct bgp_channel *c)
 {
+  ASSERT_DIE(&c->c != p->p.mpls_channel);
+
   if (c->tx_keep)
     return bgp_tx_resend(p, c);
 
@@ -2322,10 +2324,12 @@ bgp_refeed_begin(struct channel *C, struct rt_feeding_request *rfr)
 static void
 bgp_export_fed(struct channel *C)
 {
-  SKIP_BACK_DECLARE(struct bgp_channel, c, c, C);
-  SKIP_BACK_DECLARE(struct bgp_proto, p, p, c->c.proto);
+  SKIP_BACK_DECLARE(struct bgp_proto, p, p, C->proto);
+  if (C == p->p.mpls_channel)
+    return;
 
   /* Schedule End-of-RIB packet */
+  SKIP_BACK_DECLARE(struct bgp_channel, c, c, C);
   switch (c->feed_state)
   {
     case BFS_LOADING:

diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 6cba8b66cd31c3de574b5f2c4e03aa108eda52af..5043da842e80ee806a199b0198b62697972898cd 100644 (file)
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -3270,6 +3270,8 @@ bgp_schedule_packet(struct bgp_conn *conn, struct bgp_channel *c, int type)
 
   if (c)
   {
+    ASSERT_DIE(c->index < p->channel_count);
+
     if (! conn->channels_to_send)
     {
       conn->last_channel = c->index;