diag: log conn add/remove/free pointers to pinpoint BGP senders_list UAF

src/routing_layer/topo_group.c

@@ -744,7 +744,9 @@ void topo_group_remove_conn(struct TOPO_GROUP* group, struct ETCP_CONN* conn) {
     while (e) { struct TOPO_GROUP_CONN_ITEM* item = (struct TOPO_GROUP_CONN_ITEM*)e->data; if (item->conn == conn) { found_in_list = true; break; } e = e->next; }
     if (!found_in_list) { DEBUG_WARN(DEBUG_CATEGORY_BGP, "conn already removed or not in list, skipping"); return; }
 
-    DEBUG_INFO(DEBUG_CATEGORY_BGP, "peer=%016llx", (unsigned long long)conn->peer_node_id);
+    DEBUG_INFO(DEBUG_CATEGORY_BGP, "senders_remove conn=%p peer=%016llx name='%s' grp=%016llx",
+               (void*)conn, (unsigned long long)conn->peer_node_id, conn->log_name,
+               (unsigned long long)group->group_id);
 
     struct ROUTE_TABLE* rt = conn->instance->rt;
     int nodes_removed = 0;
@@ -1157,7 +1159,7 @@ void topo_group_send_nodeinfo(struct TOPO_GROUP* group, struct TOPO_GROUP_NODE*
         u_free(p);
         return;
     }
-    DEBUG_DEBUG(DEBUG_CATEGORY_BGP, "send_nodeinfo: node %016llx ver=%d grp=%016llx to conn=%s", (unsigned long long)node->node_id, sni->ver, (unsigned long long)group->group_id, conn->log_name);
+    DEBUG_DEBUG(DEBUG_CATEGORY_BGP, "send_nodeinfo: node %016llx ver=%d grp=%016llx to conn=%p name='%s'", (unsigned long long)node->node_id, sni->ver, (unsigned long long)group->group_id, (void*)conn, conn->log_name);
     uint8_t sflags = (group->group_type == TOPO_GROUP_TYPE_CHAT) ? 0 : TOPO_FLAG_SEND_SUBNETS;
     int ser_len = topo_node_serialize(sni, node, group->group_id, sflags, p + 2, max_sz - 2, cumulative_rtt);
     if (ser_len < 0) { DEBUG_ERROR(DEBUG_CATEGORY_BGP, "send_nodeinfo: serialize failed for node %016llx", (unsigned long long)node->node_id); u_free(p); return; }
@@ -1182,6 +1184,9 @@ static void topo_group_add_to_senders(struct TOPO_GROUP* group, struct ETCP_CONN
             item->conn = conn;
             item->handle = NULL;
             queue_data_put(group->senders_list, item_entry);
+            DEBUG_DEBUG(DEBUG_CATEGORY_BGP, "senders_add conn=%p peer=%016llx name='%s' grp=%016llx",
+                        (void*)conn, (unsigned long long)conn->peer_node_id, conn->log_name,
+                        (unsigned long long)group->group_id);
         }
     }
 }

src/transport_layer/etcp.c

@@ -349,7 +349,8 @@ static void etcp_on_down(struct ETCP_CONN* etcp, struct ETCP_LINK* down_link) {
 // Phase 2 resources cleanup (callable both sync and async via call_soon)
 static void etcp_connection_free_resources(struct ETCP_CONN* etcp) {
     if (!etcp) return;
-    DEBUG_DEBUG(DEBUG_CATEGORY_ETCP, "[%s] freeing resources phase 2", etcp->log_name);
+    DEBUG_DEBUG(DEBUG_CATEGORY_ETCP, "[%s] freeing resources phase 2 conn=%p peer=%016llx",
+                etcp->log_name, (void*)etcp, (unsigned long long)etcp->peer_node_id);
 
     // Close links
     if (etcp->links) {
@@ -400,6 +401,7 @@ void etcp_connection_close(struct ETCP_CONN* etcp) {
     if (etcp->links_up != 0) etcp->links_up = 0;
 
     etcp_fire_conn_status(etcp, ETCP_CONN_STATUS_DELETE);
+    DEBUG_DEBUG(DEBUG_CATEGORY_ETCP, "[%s] close: state=2 conn=%p peer=%016llx (DELETE fired)", etcp->log_name, (void*)etcp, (unsigned long long)etcp->peer_node_id);
     etcp_cbk_fire(etcp, ETCP_CBK_EVENT_DOWN);
 
     // Cancel active timers