Public bug reported:
Description
-----------
ovn-controller segfaults when the representor provider cannot find a requested
VF. We hit this on two BlueField DPUs while their compute hosts were rebooting
and the VF representors were being recreated.
The crash comes from upstream commit fcc2bf154ea591ec267940ba9ba9ef3fa16af6ab
("vif-plug: Avoid Transaction failures in ovsdb"), which I backported to
24.03.8. The same error path is still present in upstream main at
1c8d7419a73743f79ff54102c6b66f6c8061b756.
Environment
-----------
- Ubuntu 24.04 arm64, NVIDIA BlueField-3 DPUs.
- ovn-host 24.03.8-0ubuntu0.24.04.1+backport: 24.03.8 plus the commit above.
- Representor provider: ovn-vif 24.03.1.
- OpenStack remote-managed SR-IOV ports.
- Also affected by source inspection: 24.03.9-2ubuntu0.24.04.1 from
ppa:crypticcoder/ppa. Its patched controller/vif-plug.c is
identical to our 24.03.8+backport source.
Steps to reproduce
------------------
1. Run ovn-controller with the commit above and the representor provider.
2. Create ports using vif-plug-type=representor, with the host PF MAC, VF number
and requested chassis set.
3. Reboot the compute host while its DPU controller remains running.
4. During VF recovery, the provider fails to resolve a representor and returns
false. ovn-controller crashes immediately afterwards.
This is the sequence observed on two DPUs. An isolated regression test has not
yet been run.
Expected result
---------------
ovn-controller defers plugging that port and keeps running. The VIF plug
provider
contract allows the preparation callback to return false when a resource is not
ready.
Actual result
-------------
ovn-controller segfaults repeatedly, then reaches systemd's restart limit.
Neutron sees a dead OVN agent and subsequent VM builds fail with
PortBindingFailed.
Evidence collected on the affected hosts
---------------------------------------
One of the recorded crashes:
```text
2026-10-28T17:02:56.787Z|00040|vif_plug_representor|INFO|No representor port
found for lport: 673ebeef-144a-4be6-b16e-9b18e948a2d3 pf-mac:
'b8:e9:24:37:35:d0' vf-num: '28'
2026-10-28T17:02:56.787Z|00041|vif_plug|INFO|Not plugging/updating lport
673ebeef-144a-4be6-b16e-9b18e948a2d3 on direction from VIF plug provider.
SIGSEGV detected, backtrace:
ovn-controller(+0xa8644)[0xb640f5c48644]
linux-vdso.so.1(__kernel_rt_sigreturn+0x0)[0xf94dfd8a88f8]
ovn-controller(+0x138bc8)[0xb640f5cd8bc8]
ovn-controller(+0x831a8)[0xb640f5c231a8]
ovn-controller(+0x25c18)[0xb640f5bc5c18]
/lib/aarch64-linux-gnu/libc.so.6(+0x284c4)[0xf94dfcfc84c4]
/lib/aarch64-linux-gnu/libc.so.6(__libc_start_main+0x98)[0xf94dfcfc8598]
ovn-controller(+0x26970)[0xb640f5bc6970]
```
The source explains the NULL dereference: when the provider returns false,
consider_plug_lport__() destroys its context and returns true without setting
the output pointer. Its caller initialized that pointer to NULL, but continues
and reads context->vif_plug_port_ctx_out.name.
The matching ARM64 binary faults at 0x138bc8, `ldr x2, [x26, #0x78]`, which
reads
that field through the NULL context. Both affected binaries have build ID
c5960f17c58205b961077419b126d74378729ba7. This was checked against the exact
packaged source and disassembly; we do not have a symbolized core backtrace.
On both DPUs, kernel logs show the target VF representor being renamed about
23 seconds after the final crash, during a burst of 64 VF representor renames.
A later controller start succeeded without changing OVS or hardware LAG.
The lookup uses the provider's cache, so the logs do not establish whether the
kernel device was absent or its cache entry was incomplete at the exact lookup
instant. Either case should be handled without crashing.
Introducing commit:
https://github.com/ovn-org/ovn/commit/fcc2bf154ea591ec267940ba9ba9ef3fa16af6ab
Current upstream source:
https://github.com/ovn-org/ovn/blob/1c8d7419a73743f79ff54102c6b66f6c8061b756/controller/vif-plug.c
No exact duplicate was found in upstream OVN/ovn-vif issues or Ubuntu OVN bugs
on 2026-10-28. Related representor lookup and port-reuse reports (#169 and #312
on GitHub, LP #2122319) do not describe this NULL-context crash.
** Affects: ovn (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172411
Title:
ovn-controller crashes when a VIF plug provider cannot prepare a port
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/2172411/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
