BGP daemon cored after configuring default-originate in ipv4 label unicast family

[vijaykug]

Things you may try first
(put "x" in "[ ]" if you already tried following)

Did you check if this is a duplicate issue? [x]
Did you test it on the latest FRRouting/frr master branch? [x]

Related Issue:-
N/A
Description
BGP daemon cored after configuring default-originate in ipv4 label unicast family

Steps to Reproduce

Configure the BGP neighbors using address family ipv4 labeled unicast and advertise the default-originate:

R4(config-router)# address-family ipv4 labeled-unicast 
R4(config-router-af)# neighbor 15.1.1.2 default-originate 
vtysh: error reading from bgpd: Success (0)Warning: closing connection to bgpd because of an I/O error!
R4(config-router-af)# 
R4(config-router-af)# exit
Warning: connecting to bgpd...failed!
bgpd is not running
R4(config-router)# 
R4(config-router)# exit
Warning: connecting to bgpd...failed!
bgpd is not running
Warning: connecting to bgpd...failed!
Warning: connecting to bgpd...failed!
R4(config)#

Expected behavior:
BGPD should not core.

Actual behavior:
BGP process cored below is the core dump.

 [Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
0x00007f1429f55b5d in poll () at ../sysdeps/unix/syscall-template.S:84
84         ../sysdeps/unix/syscall-template.S: No such file or directory.
(gdb) c
Continuing.
 
Thread 1 "bgpd" received signal SIGSEGV, Segmentation fault.
stream_put_labeled_prefix (s=s@entry=0xbdd9c0, p=p@entry=0x7ffe1a815030, label=label@entry=0x0) at lib/stream.c:920
920                     stream_putc(s, label_pnt[0]);
(gdb) bt
#0  stream_put_labeled_prefix (s=s@entry=0xbdd9c0, p=p@entry=0x7ffe1a815030, label=label@entry=0x0) at lib/stream.c:920
#1  0x000000000043219a in bgp_packet_mpattr_prefix (s=s@entry=0xbdd9c0, afi=afi@entry=AFI_IP, safi=safi@entry=SAFI_LABELED_UNICAST, p=p@entry=0x7ffe1a815030, 
    prd=prd@entry=0x0, label=label@entry=0x0, num_labels=0, addpath_encode=0, addpath_tx_id=1, attr=0x7ffe1a817250) at bgp_attr.c:2859
#2  0x000000000043230f in bgp_packet_attribute (bgp=0xb6f240, bgp@entry=0x0, peer=peer@entry=0xbe02d0, s=s@entry=0xbdd9c0, attr=attr@entry=0x7ffe1a817250, 
    vecarr=vecarr@entry=0x7ffe1a815020, p=p@entry=0x7ffe1a815030, afi=AFI_IP, safi=SAFI_LABELED_UNICAST, from=0xb70510, prd=0x0, label=0x0, num_labels=0, 
    addpath_encode=0, addpath_tx_id=1) at bgp_attr.c:3016
#3  0x0000000000479e75 in subgroup_default_update_packet (subgrp=subgrp@entry=0xbd4390, attr=0x7ffe1a817250, from=from@entry=0xb70510) at bgp_updgrp_packet.c:1142
#4  0x000000000047ab0f in subgroup_default_originate (subgrp=0xbd4390, withdraw=withdraw@entry=0) at bgp_updgrp_adv.c:769
#5  0x000000000043d0eb in bgp_default_originate (peer=peer@entry=0xbc2650, afi=afi@entry=AFI_IP, safi=safi@entry=SAFI_LABELED_UNICAST, withdraw=withdraw@entry=0)
    at bgp_route.c:3612
#6  0x0000000000427e85 in peer_default_originate_set (peer=0xbc2650, afi=afi@entry=AFI_IP, safi=safi@entry=SAFI_LABELED_UNICAST, rmap=rmap@entry=0x0) at bgpd.c:4503
#7  0x0000000000469691 in peer_default_originate_set_vty (set=1, rmap=0x0, safi=SAFI_LABELED_UNICAST, afi=AFI_IP, peer_str=<optimized out>, vty=0xb6cc30) at bgp_vty.c:4763
#8  neighbor_default_originate (self=<optimized out>, vty=0xb6cc30, argc=<optimized out>, argv=<optimized out>) at bgp_vty.c:4779
#9  0x00007f142ab83157 in cmd_execute_command_real (vline=vline@entry=0xbd5300, vty=vty@entry=0xb6cc30, cmd=cmd@entry=0x0, filter=FILTER_RELAXED) at lib/command.c:1048
#10 0x00007f142ab852a6 in cmd_execute_command (vline=vline@entry=0xbd5300, vty=vty@entry=0xb6cc30, cmd=cmd@entry=0x0, vtysh=vtysh@entry=0) at lib/command.c:1102
#11 0x00007f142ab853c1 in cmd_execute (vty=vty@entry=0xb6cc30, cmd=cmd@entry=0xb6d220 "neighbor 15.1.1.2 default-originate ", matched=matched@entry=0x0, 
    vtysh=vtysh@entry=0) at lib/command.c:1252
#12 0x00007f142abb7e31 in vty_command (vty=vty@entry=0xb6cc30, buf=0xb6d220 "neighbor 15.1.1.2 default-originate ") at lib/vty.c:527
#13 0x00007f142abb802b in vty_execute (vty=vty@entry=0xb6cc30) at lib/vty.c:1375
#14 0x00007f142abb9ff0 in vtysh_read (thread=<optimized out>) at lib/vty.c:2211
#15 0x00007f142abb4cfd in thread_call (thread=thread@entry=0x7ffe1a819ad8) at lib/thread.c:1578
#16 0x00007f142ab97c15 in frr_run (master=0x749830) at lib/libfrr.c:925
#17 0x000000000041d37d in main (argc=4, argv=0x7ffe1a819d28) at bgp_main.c:452

Components
[bgpd,]

Versions
Versions
OS: Ubuntu 16.04
Kernel: Linux 4.9
FRR: 6.0 (master)

Running config

frr version 6.0
frr defaults traditional
hostname dev
log syslog informational
no ipv6 forwarding
hostname R3
service integrated-vtysh-config
username cumulus nopassword
!
debug bgp keepalives
debug bgp neighbor-events
debug bgp update-groups
debug bgp updates in
debug bgp updates out
debug bgp zebra
!
ip route 44.4.4.4/32 blackhole
ip route 44.44.4.4/32 blackhole
!
interface ens192
 ip address 12.1.1.2/24
 ipv6 address 2005::1/64
!
interface ens193
 ip address 15.1.1.2/24
!
interface lo
 ip address 103.103.103.103/32
!
router bgp 1
 bgp router-id 103.103.103.103
 coalesce-time 1000
 neighbor 15.1.1.1 remote-as 2
 neighbor 101.101.101.101 remote-as 1
 neighbor 101.101.101.101 update-source 103.103.103.103
 neighbor 102.102.102.102 remote-as internal
 neighbor 102.102.102.102 update-source 103.103.103.103
 !
 address-family ipv4 unicast
  no neighbor 15.1.1.1 activate
  neighbor 101.101.101.101 weight 200
  neighbor 102.102.102.102 weight 50
 exit-address-family
 !
 address-family ipv4 labeled-unicast
  neighbor 15.1.1.1 activate
 exit-address-family
!
router ospf
 ospf router-id 103.103.103.103
 passive-interface lo
 network 12.1.1.0/24 area 0
 network 103.103.103.103/32 area 0
!
ip prefix-list P1 seq 5 permit 12.1.1.0/24
!
ipv6 prefix-list P1 seq 5 permit 2005::/64
!
line vty

Logs :-

2018/11/06 06:39:30 BGP: 15.1.1.2 [Event] BGP connection closed fd 19
2018/11/06 06:39:30 BGP: 15.1.1.2 [FSM] TCP_connection_closed (Established->Clearing), fd 19
2018/11/06 06:39:30 BGP: 15.1.1.2 remove from all update group
2018/11/06 06:39:30 BGP: delete subgroup u1:s1
2018/11/06 06:39:30 BGP: delete update group 1
2018/11/06 06:39:30 BGP: 15.1.1.2 went from Established to Clearing
2018/11/06 06:39:30 BGP: 15.1.1.2 [FSM] Clearing_Completed (Clearing->Idle), fd -1
2018/11/06 06:39:30 BGP: 15.1.1.2 went from Clearing to Idle
2018/11/06 06:39:31 BGP: 15.1.1.2 [FSM] Timer (start timer expire).
2018/11/06 06:39:31 BGP: 15.1.1.2 [FSM] BGP_Start (Idle->Connect), fd -1
2018/11/06 06:39:31 BGP: 15.1.1.2 [Event] Connect start to 15.1.1.2 fd 19
2018/11/06 06:39:31 BGP: 15.1.1.2 [FSM] Non blocking connect waiting result, fd 19
2018/11/06 06:39:31 BGP: 15.1.1.2 went from Idle to Connect
2018/11/06 06:39:51 BGP: [Event] BGP connection from host 15.1.1.2 fd 24
2018/11/06 06:39:51 BGP: 15.1.1.2 went from Idle to Active
2018/11/06 06:39:51 BGP: 15.1.1.2 [FSM] TCP_connection_open (Active->OpenSent), fd 24
2018/11/06 06:39:51 BGP: 15.1.1.2 passive open

Thanks,
Vijay

[qlyoung]

Looks like we try to build an update for a labeled unicast peer, but without any labels and crash on a npd assuming we have labels.

[ton31337]

I would guess that's already fixed. @vijaykug are you able to test with the latest release?