[nsp] C6500 crash on BGP MD5 session

[Sam Stickland]

Jared Mauch <jared at puck.nether.net> wrote:
> On Wed, May 19, 2004 at 10:05:28AM +0100, Sam Stickland wrote:
>> Hi,
>>
>> I recently added our sixth MD5 five to a C6500, and the router
>> rebooted 23 seconds later. Extract from the log files is:
>>
>> May 19 09:28:48 cat6500-1 23334: May 19 09:28:46.552:
>> %BGP-5-ADJCHANGE: neighbor 195.47.243.35 Up
>> May 19 09:29:09 cat6500-1 23335: May 19 09:29:09.236:
>> %ALIGN-3-SPURIOUS: Spurious memory access made at 0x409D45E0 r
>> eading 0x19
>> May 19 09:29:09 cat6500-1 23336: May 19 09:29:09.236:
>> %ALIGN-3-TRACE: -Traceback= 409D45E0 409ACDE4 409AD190 409AD7B
>> 8 40264914 40264900 00000000 00000000
>>
>> Router had been running fine before this incident. This is 12.1(20)E
>> on a Sup2/MFSC2 (512MB on each).
>>
>> Is anyone aware of any bugs that might had caused this?
>
> Not at all.
>
> I'd paste this into the output interpreter or contact the tac..
>
> We've been using md5 on the 6500 (and on 12.1(20)E) for some
> time without problems.

FYI: The output interpreter came up with two points. The first was a lot of
buffer allocation errors, but the router doesn't ususally have any problems
of this nature (graphs of recent buffer creates etc. show nothing, and sh
buf fail is clean), so it was probably caused by a traffic burst some time
in the past.

The stack decode begins as follows:

STACK DECODE NOTIFICATIONS (if any)

The failure was caused by a software defect.

The stack trace decoded symbols are:
bgp_route_map_find_net
bgp_route_map_find_net
bgp_tables_genscan
bgp_perform_general_scan
bgp_scanner
bgp_route_map_find_net
bgp_route_map_find_net
bgp_tables_genscan
bgp_perform_general_scan
bgp_scanner
r4k_level_table
ip_a_loop
process_last_gasp
bgp_tables_genscan
bgp_route_map_find_net
bgp_route_map_find_net
bgp_tables_genscan
bgp_perform_general_scan
bgp_scanner
bgp_io
bgp_io
bgp_io
bgp_io

And likely bug matches are:

0.93 CSCdp89695 R 12.1(3)DC 12.1(3)DB 12.1(1.2) 12.1(1.3)E 12.0(9.6)ST
None BGP: bgp.c code review - part 4

0.77 CSCdw69366 R 12.0(27)SV 12.0(21.1)SY2 12.0(21.1)S2
None BGP Aggregate for Window-A

0.66 CSCdw87068 V 4.0(0)
None Daytona reboots in tftp_read()

0.66 CSCdx01942 D CSCdw87068
Daytona crashes when CDP disabled using the following ...

0.66 CSCed91799 D CSCdy53931 router
reload during uncfging bgp

0.66 CSCdx08709 D CSCdw87068 Daytona
Crashes intermittently when shut/no-shut of POS member ...

CSCdp89695 simply says:

Headline  BGP: bgp.c code review - part 4
Severity 3 bug
First Fixed-in Version  12.1(1.2), 12.0(9.6)ST, 12.1(1.3)E, 12.1(3)DB,
12.1(3)DC

> I'd also like to suggest that you can look at using
> 12.2(17d)SXB to pick up ipv6 support and other neat features
> on the sup2/mfsc2 combo.  That's what we've moved to.

I think we might be moving to that release anyway.

Sam