If a recirculating packet gets originated from packet-out with no in_port specified, and then matches a rule with normal action, vswitchd crashes with the following: 0x0000000000450d42 xlate_output_action (ovs-vswitchd + 0x50d42) 0x000000000044c2d1 do_xlate_actions (ovs-vswitchd + 0x4c2d1) 0x000000000044ae4b xlate_actions (ovs-vswitchd + 0x4ae4b) 0x00000000004470b0 process_upcall (ovs-vswitchd + 0x470b0) 0x000000000044224c upcall_cb (ovs-vswitchd + 0x4224c) 0x0000000000483e8c dp_netdev_upcall (ovs-vswitchd + 0x83e8c) 0x0000000000483b37 handle_packet_upcall (ovs-vswitchd + 0x83b37) 0x000000000048336c fast_path_processing (ovs-vswitchd + 0x8336c) 0x000000000047652d dp_netdev_input__ (ovs-vswitchd + 0x7652d) 0x0000000000485a55 dp_execute_cb (ovs-vswitchd + 0x85a55) 0x00000000004c2850 odp_execute_actions (ovs-vswitchd + 0xc2850) 0x0000000000479571 dpif_netdev_operate (ovs-vswitchd + 0x79571) 0x000000000048ed2b dpif_operate (ovs-vswitchd + 0x8ed2b) 0x000000000048f348 dpif_execute (ovs-vswitchd + 0x8f348) The reproducer is straightforward: create a bridge with a simple actions=NORMAL flow: ovs-ofctl dump-flows br0 cookie=0x0, duration=10.436s, table=0, n_packets=0, n_bytes=0, priority=0 actions=NORMAL and then: ovs-ofctl packet-out br0 "packet=50540000000a50540000000908004500001c000000000011a4cd0a0101010a0101020001000200080000, action=ct(commit,table=0)"
the issue is present for both in_port=none and in_port=controller
patch posted upstream: https://patchwork.ozlabs.org/project/openvswitch/patch/164703112546.2423483.15628969556445986960.stgit@fed.void/