From: Maria Matejka <mq@ucw.cz>
Date: Sat, 10 May 2025 21:35:03 +0000 (+0200)
Subject: BGP: end of feeding MPLS channel must not try to schedule a packet
X-Git-Tag: v3.0.3~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5c38aa12bea0f0634c3c05012749080fba3ee90d;p=thirdparty%2Fbird.git

BGP: end of feeding MPLS channel must not try to schedule a packet

This caused a invalid memory use when reloading MPLS channels,
occasionally forcing BIRD to an endless loop due to invalid flag
in channel map.
---

diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c
index 33459add0..a5ec4e6ac 100644
--- a/proto/bgp/bgp.c
+++ b/proto/bgp/bgp.c
@@ -1711,6 +1711,8 @@ bgp_done_route_refresh(struct rt_feeding_request *rfr)
 const char *
 bgp_begin_route_refresh(struct bgp_proto *p, struct bgp_channel *c)
 {
+  ASSERT_DIE(&c->c != p->p.mpls_channel);
+
   if (c->tx_keep)
     return bgp_tx_resend(p, c);
 
@@ -1823,10 +1825,12 @@ bgp_refeed_begin(struct channel *C, struct rt_feeding_request *rfr)
 static void
 bgp_export_fed(struct channel *C)
 {
-  SKIP_BACK_DECLARE(struct bgp_channel, c, c, C);
-  SKIP_BACK_DECLARE(struct bgp_proto, p, p, c->c.proto);
+  SKIP_BACK_DECLARE(struct bgp_proto, p, p, C->proto);
+  if (C == p->p.mpls_channel)
+    return;
 
   /* Schedule End-of-RIB packet */
+  SKIP_BACK_DECLARE(struct bgp_channel, c, c, C);
   switch (c->feed_state)
   {
     case BFS_LOADING:
diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index d41921a5b..76238b715 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -3227,6 +3227,8 @@ bgp_schedule_packet(struct bgp_conn *conn, struct bgp_channel *c, int type)
 
   if (c)
   {
+    ASSERT_DIE(c->index < p->channel_count);
+
     if (! conn->channels_to_send)
     {
       conn->last_channel = c->index;