Bug 2062466

Summary: vswitchd crashes in case of normal action after recirculation with packets originated from packet-out without in_port
Product: Red Hat Enterprise Linux Fast Datapath Reporter: Paolo Valerio <pvalerio>
Component: openvswitchAssignee: Paolo Valerio <pvalerio>
openvswitch sub component: daemons and tools QA Contact: qding
Status: POST --- Docs Contact:
Severity: unspecified    
Priority: unspecified CC: ctrautma, jhsiao
Version: FDP 22.A   
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Paolo Valerio 2022-03-09 19:58:59 UTC 
If a recirculating packet gets originated from packet-out with no in_port specified, and 
then matches a rule with normal action, vswitchd crashes with the following:

0x0000000000450d42 xlate_output_action (ovs-vswitchd + 0x50d42)
0x000000000044c2d1 do_xlate_actions (ovs-vswitchd + 0x4c2d1)
0x000000000044ae4b xlate_actions (ovs-vswitchd + 0x4ae4b)
0x00000000004470b0 process_upcall (ovs-vswitchd + 0x470b0)
0x000000000044224c upcall_cb (ovs-vswitchd + 0x4224c)
0x0000000000483e8c dp_netdev_upcall (ovs-vswitchd + 0x83e8c)
0x0000000000483b37 handle_packet_upcall (ovs-vswitchd + 0x83b37)
0x000000000048336c fast_path_processing (ovs-vswitchd + 0x8336c)
0x000000000047652d dp_netdev_input__ (ovs-vswitchd + 0x7652d)
0x0000000000485a55 dp_execute_cb (ovs-vswitchd + 0x85a55)
0x00000000004c2850 odp_execute_actions (ovs-vswitchd + 0xc2850)
0x0000000000479571 dpif_netdev_operate (ovs-vswitchd + 0x79571)
0x000000000048ed2b dpif_operate (ovs-vswitchd + 0x8ed2b)
0x000000000048f348 dpif_execute (ovs-vswitchd + 0x8f348)

The reproducer is straightforward:

create a bridge with a simple actions=NORMAL flow:

ovs-ofctl dump-flows br0
 cookie=0x0, duration=10.436s, table=0, n_packets=0, n_bytes=0, priority=0 actions=NORMAL

and then:

ovs-ofctl packet-out br0 "packet=50540000000a50540000000908004500001c000000000011a4cd0a0101010a0101020001000200080000, action=ct(commit,table=0)"
Comment 2 Paolo Valerio 2022-03-11 13:54:27 UTC 
the issue is present for both in_port=none and in_port=controller
Comment 3 Paolo Valerio 2022-03-11 20:41:59 UTC 
patch posted upstream:

https://patchwork.ozlabs.org/project/openvswitch/patch/164703112546.2423483.15628969556445986960.stgit@fed.void/