VPP crash in l2_efp_filter_node_fn_hsw when enabling EFP filter on VLAN sub-interfaces #3656
Description
Summary:
VPP 25.10 consistently crashes with SIGSEGV inside l2_efp_filter_node_fn_hsw when enabling l2_interface_efp_filter on VLAN sub-interfaces that also have VLAN tag rewrite (push) and are bound into a bridge-domain. Before the crash, VPP logs repeated clib_c11_violation: s1 NULL and s2 NULL, suggesting null-pointer dereference inside the EFP filter path.
VPP Version
libvnet.so.25.10
libvppinfra.so.25.10
Binary: vpp (25.10)
Platform: x86_64 Linux
Environment
Interface types: Physical interfaces + dot1q exact-match sub-interfaces
Features in use:
bridge-domain (per VLAN)
l2fib
l2_interface_vlan_tag_rewrite (PUSH)
l2_interface_efp_filter (enable) ← this triggers crash
linux-cp (tap pair auto-created)
Control-plane: Python VPP API client (but crash occurs even when calling APIs manually via CLI)
Crash symptoms
Repeated warnings:
clib_c11_violation: s1 NULL
clib_c11_violation: s2 NULL
clib_c11_violation: s1 NULL
clib_c11_violation: s2 NULL
...
Then a segmentation fault:
received signal SIGSEGV, PC 0x739697a46248, faulting address 0x0
#0 l2_efp_filter_node_fn_hsw + 0xa38 in libvnet.so.25.10
#1 vlib_main
#2 vlib_unix_main
#3 clib_calljmp
After crash:
systemd: vpp.service: Main process exited code=killed status=6/ABRT