Commit 79d51fee91 for frr

commit 79d51fee91dee76fcee45115653f9030ad385670
Author: Justin Iurman <justin.iurman@6wind.com>
Date:   Fri Oct 23 14:53:08 2026 +0200

    zebra: fix crash when releasing a SID of a locator without prefix

    When the prefix of an SRv6 locator is removed ("no prefix"), zebra frees
    all the SIDs allocated from the locator and releases its parent block
    (locator->sid_block is set to NULL), but keeps the locator itself. It
    also notifies the clients, which may react by releasing their SIDs by
    locator name, e.g. bgpd for its SRv6 unicast SID ("sid export auto")
    via bgp_srv6_unicast_sid_withdraw().

    srv6_manager_release_sid_internal() then finds the locator by name and
    walks the SID contexts of its parent block without checking it, which
    dereferences a NULL pointer:

      Received signal 11 at ... (si_addr 0x48, ...); aborting...
      srv6_manager_release_sid_internal+0x79
      srv6_manager_release_sid_call+0x3e
      zread_srv6_manager_release_srv6_sid+0x126
      zserv_handle_commands+0x113
      zserv_process_messages+0x70

    Since all the SIDs of such a locator were already freed, there is
    nothing to release: return early, like when the locator does not exist.

    Fixes: 81f1b5b723aa ("zebra: Move SRv6 SIDs data structure under the block")
    Signed-off-by: Justin Iurman <justin.iurman@6wind.com>

diff --git a/zebra/zebra_srv6.c b/zebra/zebra_srv6.c
index e05550946c..4f49bf348c 100644
--- a/zebra/zebra_srv6.c
+++ b/zebra/zebra_srv6.c
@@ -2840,6 +2840,17 @@ static int srv6_manager_release_sid_internal(struct zserv *client, struct srv6_s

 	block = locator->sid_block;

+	/*
+	 * A locator whose prefix was removed has no parent block anymore, and
+	 * all its SIDs were already freed along with it: nothing to release.
+	 */
+	if (!block) {
+		if (IS_ZEBRA_DEBUG_SRV6)
+			zlog_debug("%s: SRv6 locator '%s' has no prefix, no SID to release",
+				   __func__, locator_name);
+		return 0;
+	}
+
 	/* Lookup Zebra SID context and release it */
 	frr_each_safe (zebra_srv6_sid_ctx_list, &block->sids, zctx)
 		if (memcmp(&zctx->ctx, ctx, sizeof(struct srv6_sid_ctx)) == 0) {