On Junos and Junos Evolved platforms with SRv6 (Segment Routing IPv6) and ISIS (Intermediate System-to-Intermediate System) configured, the rpd (Routing Protocol Process Daemon) crash is observed for the leaked ISIS SRv6 locator route holding a stale pointer when SRv6 locators are leaked across ISIS multi-instances (standard and non-standard) and also if changes to these locators are too frequent.

When SRv6 locators are leaked across ISIS multi-instances (standard and non-standard) and also if changes to these locators are too frequent, a corner case occurs involving the leaked ISIS SRv6 locator route holding a stale pointer (TSI in this case which represents how this route was learnt in ISIS. i.e., if it was leaked into ISIS via policy). Having a stale pointer can cause corruption in random sections of memory resulting in the rpd crash i.e. traffic impact.

To check the rpd core file, execute the CLI command:



user@device> show system core-dumps

-rw-rw---- 1 root wheel 227343638 <timestamp> /var/tmp/rpd.core-tarball.0.tgz

 When the SRv6 locator changes to active for an downloaded ISIS route, the TSI pointer's memory is freed while the LSP's exported SRv6 locator TLV (local_data) continues to refer to this stale pointer. Having access to a stale pointer would eventually lead to corrupting this pointer when accessed again (while it is legitimately allocated to another application).

This issue is tracked on the PR1808185 and fixed on the following Junos releases:

evo:23.4R2-EVO evo:24.2R2-EVO evo:24.3R1-EVO evo:24.4R1-EVO junos:23.4R1-S2 junos:23.4R2 junos:24.2R1 junos:24.2R2 junos:24.3R1 junos:24.4R1

https://prsearch.juniper.net/problemreport/PR1808185