From: Maria Matejka <mq@ucw.cz>
Date: Sat, 10 May 2025 21:35:03 +0000 (+0200)
Subject: BGP: end of feeding MPLS channel must not try to schedule a packet
X-Git-Tag: v3.1.1~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=afa0dbd80dc72f0a24f41fe58322e23c783a7892;p=thirdparty%2Fbird.git

BGP: end of feeding MPLS channel must not try to schedule a packet

This caused a invalid memory use when reloading MPLS channels,
occasionally forcing BIRD to an endless loop due to invalid flag
in channel map.
---

diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c
index 8ca1214f0..5d5f85a2a 100644
--- a/proto/bgp/bgp.c
+++ b/proto/bgp/bgp.c
@@ -2210,6 +2210,8 @@ bgp_done_route_refresh(struct rt_feeding_request *rfr)
 const char *
 bgp_begin_route_refresh(struct bgp_proto *p, struct bgp_channel *c)
 {
+  ASSERT_DIE(&c->c != p->p.mpls_channel);
+
   if (c->tx_keep)
     return bgp_tx_resend(p, c);
 
@@ -2322,10 +2324,12 @@ bgp_refeed_begin(struct channel *C, struct rt_feeding_request *rfr)
 static void
 bgp_export_fed(struct channel *C)
 {
-  SKIP_BACK_DECLARE(struct bgp_channel, c, c, C);
-  SKIP_BACK_DECLARE(struct bgp_proto, p, p, c->c.proto);
+  SKIP_BACK_DECLARE(struct bgp_proto, p, p, C->proto);
+  if (C == p->p.mpls_channel)
+    return;
 
   /* Schedule End-of-RIB packet */
+  SKIP_BACK_DECLARE(struct bgp_channel, c, c, C);
   switch (c->feed_state)
   {
     case BFS_LOADING:
diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 6cba8b66c..5043da842 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -3270,6 +3270,8 @@ bgp_schedule_packet(struct bgp_conn *conn, struct bgp_channel *c, int type)
 
   if (c)
   {
+    ASSERT_DIE(c->index < p->channel_count);
+
     if (! conn->channels_to_send)
     {
       conn->last_channel = c->index;