Hi all, A follow-up to close this out, with a correction. Stanislav Zaikin analysed both cores (thank you!). Neither crash was a use-after-free.
*Crash 1 (router A, ip4-rewrite, garbage adjacency): recursive VXLAN encapsulation.* Our bridge domain has a BVI and VXLAN tunnels, and the remote VTEP sits inside a /24 that we also learn over the overlay. When the VTEP's OSPF /32 briefly disappears, the VTEP resolves via the overlay through the BVI. The encapsulated packet then re-enters the same bridge domain and is encapsulated again. After a few laps the prepended headers run past the buffer's pre_data and overwrite buffer metadata. The "freed adjacency" I reported was that corrupted metadata. The earlier ip4-rewrite crash on router B (2026-09-30) came straight after its underlay VLAN was bounced, which fits the same loop. A fix is under review in https://gerrit.fd.io/r/c/vpp/+/47106 (there's an open discussion about whether the check belongs in the rewrite nodes or the encap nodes). Our workaround is floating /32 blackhole routes for every remote VTEP, so VXLAN traffic is dropped instead of looped if the underlay route goes away. *Crash 2 (router B, ethernet-input, ei=NULL): not a freed buffer.* I misread the core. The buffer index in the frame was garbage: it pointed into the middle of another buffer's data, so the "metadata" I quoted was packet data. The cause is the sFlow drop-monitoring feature. With sflow drop-monitoring enable , interface_drop_punt() also started the drop feature arc in error-punt, which has no such arc, and that produced a corrupted frame. It's fixed by https://gerrit.fd.io/r/c/vpp/+/47175 (merged on master 2026-10-24; no stable/2606 or 2610 cherry-pick yet). Anyone running 26.06 or 26.10 with drop-monitoring enabled should pick it up, or run sflow drop-monitoring disable until then. We haven't had a crash since Oct 5. Regards, Pieter
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#27297): https://lists.fd.io/g/vpp-dev/message/27297 Mute This Topic: https://lists.fd.io/mt/121592811/21656 Group Owner: [email protected] Unsubscribe: https://lists.fd.io/g/vpp-dev/leave/14379924/21656/631435203/xyzzy [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
