After NSX-V upgrade to 6.4.11 or later ESGs can face CPU race conditions

Products

• VMware NSX

Issue/Introduction

• You have recently upgraded to NSX 6.4.11 or later
• You are experiencing High CPU on the NSX edge appliances
• Entries similar to the below observed in the edge logs:

[719720.110725] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048

[719720.110917] IP: [<ffffffff8246c480>] nf_xfrm_me_harder+0x30/0x110 [nf_nat]

[719720.111034] PGD ffff8881f556a000 0 P4D ffff8881f556a000 0

[719720.111124] Oops: 0000 [#2] SMP

Cause

The NSX Edge Linux kernel was upgraded from 4.4.185 to 4.14.232 in 6.4.11, with this change came additional functionality, one of which was a function that revalidates configuration change on the edge. 

This revalidation is triggered whenever there are firewall configuration change, the process re-evaluates all the existing flows based on the new firewall configuration and terminates those not allowed.

The kernel oops occurs during connections (existing flows) revalidation.



 

Resolution

Currently there is no resolution, please raise a Support Request should you encounter this issue.