lb: crashed with some specific commit under heavy traffic

- When deleting VIP member with flush, VPP will crash.
- When deleting VIP member without flush, vpp won't crash.
- This crash is almost 100% reproductive.

Ticket: VPP-1680
Type: fix
Change-Id: Ia4e8f9e0f987176c7f6ec52c92e66563f313b0c3
Signed-off-by: Hongjun Ni <hongjun.ni@intel.com>

3 files changed, 13 insertions, 5 deletions

diff --git a/src/plugins/lb/lb.c b/src/plugins/lb/lb.c
index a75f6761c0e..75ca40f5f00 100644
--- a/src/plugins/lb/lb.c
+++ b/src/plugins/lb/lb.c
@@ -442,7 +442,7 @@ out:
   //Let's create a new flow table
   vec_validate(new_flow_table, vip->new_flow_table_mask);
   for (i=0; i<vec_len(new_flow_table); i++)
-    new_flow_table[i].as_index = ~0;
+    new_flow_table[i].as_index = 0;
 
   u32 done = 0;
   while (1) {
@@ -450,7 +450,7 @@ out:
       while (1) {
         u32 last = pr->last;
         pr->last = (pr->last + pr->skip) & vip->new_flow_table_mask;
-        if (new_flow_table[last].as_index == ~0) {
+        if (new_flow_table[last].as_index == 0) {
           new_flow_table[last].as_index = pr->as_index;
           break;
         }
@@ -773,7 +773,7 @@ lb_flush_vip_as (u32 vip_index, u32 as_index)
               vlib_refcount_add(&lbm->as_refcount, thread_index, b->value[i], -1);
               vlib_refcount_add(&lbm->as_refcount, thread_index, 0, 1);
               b->vip[i] = ~0;
-              b->value[i] = ~0;
+              b->value[i] = 0;
             }
         }
         if (vip_index == ~0)
@@ -1375,6 +1375,7 @@ lb_init (vlib_main_t * vm)
   //Allocate and init default VIP.
   lbm->vips = 0;
   pool_get(lbm->vips, default_vip);
+  default_vip->new_flow_table_mask = 0;
   default_vip->prefix.ip6.as_u64[0] = 0xffffffffffffffffL;
   default_vip->prefix.ip6.as_u64[1] = 0xffffffffffffffffL;
   default_vip->protocol = ~0;
@@ -1418,6 +1419,12 @@ lb_init (vlib_main_t * vm)
   default_as->address.ip6.as_u64[0] = 0xffffffffffffffffL;
   default_as->address.ip6.as_u64[1] = 0xffffffffffffffffL;
 
+  /* Generate a valid flow table for default VIP */
+  default_vip->as_indexes = NULL;
+  lb_get_writer_lock();
+  lb_vip_update_new_flow_table(default_vip);
+  lb_put_writer_lock();
+
   lbm->vip_index_by_nodeport
     = hash_create_mem (0, sizeof(u16), sizeof (uword));
 
diff --git a/src/plugins/lb/lbhash.h b/src/plugins/lb/lbhash.h
index 585b377b8aa..375227cfd06 100644
--- a/src/plugins/lb/lbhash.h
+++ b/src/plugins/lb/lbhash.h
@@ -89,6 +89,7 @@ lb_hash_t *lb_hash_alloc(u32 buckets, u32 timeout)
   u8 *mem = 0;
   lb_hash_t *h;
   vec_alloc_aligned(mem, size, CLIB_CACHE_LINE_BYTES);
+  clib_memset(mem, 0, size);
   h = (lb_hash_t *)mem;
   h->buckets_mask = (buckets - 1);
   h->timeout = timeout;
@@ -114,7 +115,7 @@ void lb_hash_get(lb_hash_t *ht, u32 hash, u32 vip, u32 time_now,
 		 u32 *available_index, u32 *found_value)
 {
   lb_hash_bucket_t *bucket = &ht->buckets[hash & ht->buckets_mask];
-  *found_value = ~0;
+  *found_value = 0;
   *available_index = ~0;
 #if __SSE4_2__ && LB_HASH_DO_NOT_USE_SSE_BUCKETS == 0
   u32 bitmask, found_index;
diff --git a/src/plugins/lb/node.c b/src/plugins/lb/node.c
index ab192af11aa..a2c35bd8e72 100644
--- a/src/plugins/lb/node.c
+++ b/src/plugins/lb/node.c
@@ -343,7 +343,7 @@ lb_node_fn (vlib_main_t * vm,
                        vip_index0, lb_time,
                        &available_index0, &asindex0);
 
-          if (PREDICT_TRUE(asindex0 != ~0))
+          if (PREDICT_TRUE(asindex0 != 0))
             {
               //Found an existing entry
               counter = LB_VIP_COUNTER_NEXT_PACKET;