nat44-ei: 'nat44 ei del user' crashes VPP (SIGSEGV) with more than one worker #3749

#!/bin/bash
# Reproduces: "nat44 ei del user" crashes VPP (SIGSEGV) when there is more than one worker.
# nat44_ei_user_del() finds the user in its worker's per_thread_data but calls
# nat44_ei_user_del_sessions (u, tnm->thread_index); tnm->thread_index is only set by
# nat44_ei_set_workers() ("set nat workers"), so it is 0 and the sessions are looked up in the
# main thread's pools.
# Needs root, iproute2 and python3. Uses veth + network namespaces and af_packet (no NICs).
# Usage: repro.sh [extra-plugin ...]   (e.g. "repro.sh pnat" also fixes the #3747 arc order;
#                                       the crash happens either way)
# Env: PLUGIN_DIR (default: the packaged plugins), MAIN_CORE / WORKERS (default 0 / 1-2).
set -u
D=$(mktemp -d /tmp/nat44ei-deluser.XXXX)
PLUGIN_DIR=${PLUGIN_DIR:-/usr/lib/x86_64-linux-gnu/vpp_plugins}
MAIN_CORE=${MAIN_CORE:-0}; WORKERS=${WORKERS:-1-2}
EXTRA=""; for p in "$@"; do EXTRA="$EXTRA plugin ${p}_plugin.so { enable }"; done
CLI="vppctl -s $D/cli.sock"

cleanup() {
  [ -n "${VPP_PID:-}" ] && kill "$VPP_PID" 2>/dev/null && wait "$VPP_PID" 2>/dev/null
  ip netns del nd-in 2>/dev/null; ip netns del nd-out 2>/dev/null
  ip link del nd-vin 2>/dev/null; ip link del nd-vout 2>/dev/null
  rm -rf "$D"
}
trap cleanup EXIT

# inside host 10.0.0.2 <-> VPP 10.0.0.1 | VPP 192.0.2.1 <-> outside host 192.0.2.2 ; pool 198.51.100.1
ip netns add nd-in; ip netns add nd-out
ip link add nd-vin type veth peer name in0 netns nd-in
ip link add nd-vout type veth peer name out0 netns nd-out
ip link set nd-vin up; ip link set nd-vout up
ip -n nd-in addr add 10.0.0.2/24 dev in0; ip -n nd-in link set in0 up; ip -n nd-in link set lo up
ip -n nd-in route add default via 10.0.0.1
ip -n nd-out addr add 192.0.2.2/24 dev out0; ip -n nd-out link set out0 up; ip -n nd-out link set lo up
ip -n nd-out route add 198.51.100.0/24 via 192.0.2.1

cat > "$D/startup.conf" <<EOF
unix { cli-listen $D/cli.sock nodaemon log $D/vpp.log }
api-segment { prefix nd$$ }
socksvr { socket-name $D/api.sock }
statseg { socket-name $D/stats.sock size 32m page-size 4k }
cpu { main-core $MAIN_CORE corelist-workers $WORKERS }
memory { main-heap-size 512M main-heap-page-size 4k }
buffers { buffers-per-numa 16384 page-size 4k }
plugins {
  path $PLUGIN_DIR
  plugin default { disable }
  plugin af_packet_plugin.so { enable }
  plugin nat44_ei_plugin.so { enable }
  $EXTRA
}
EOF
vpp -c "$D/startup.conf" > "$D/stdout" 2>&1 & VPP_PID=$!
for i in $(seq 1 50); do $CLI show version >/dev/null 2>&1 && break; sleep 0.2; done

$CLI create host-interface name nd-vin >/dev/null
$CLI create host-interface name nd-vout >/dev/null
$CLI set interface state host-nd-vin up
$CLI set interface state host-nd-vout up
$CLI set interface ip address host-nd-vin 10.0.0.1/24
$CLI set interface ip address host-nd-vout 192.0.2.1/24
$CLI nat44 ei plugin enable sessions 1024
$CLI nat44 ei add address 198.51.100.1
$CLI set interface nat44 ei in host-nd-vin out host-nd-vout

echo "== show version";  $CLI show version
echo "== workers";       $CLI show threads | awk 'NR>1 {print "  " $2}' | tr '\n' ' '; echo

echo "== 5 UDP flows from the inside host"
ip netns exec nd-in python3 -c '
import socket
for p in range(40000, 40005):
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.bind(("10.0.0.2", p))
    s.sendto(b"x", ("192.0.2.2", 7000))'
sleep 1
echo "== nat44 ei users / sessions"
$CLI show nat44 ei sessions | grep -E "^ +10\.0\.0\.2"

echo "== nat44 ei del user 10.0.0.2"
$CLI nat44 ei del user 10.0.0.2
sleep 1
if kill -0 "$VPP_PID" 2>/dev/null; then
  echo "VPP still running"
else
  echo "VPP CRASHED:"; grep -E "SIGSEGV|^#[0-9]" "$D/stdout" | head -8
fi