What causes "failed to unmarshal IP address" in cilium/cilium?

Delete and regenerate the corrupted state/WAL file

failed to unmarshal IP address

Error message

failed to unmarshal IP address

What it means

After the length checks pass, the address bytes are converted with netip.AddrFromSlice; failure means the addrLen bytes are not a valid 4- or 16-byte IP address. The serialized key contains garbage in the address field.

Source

Thrown at pkg/datapath/linux/route/reconciler/table.go:108

		return fmt.Errorf("data too short to unmarshal DesiredRouteKey")
	}

	if data[0] != byte(desiredRouteKeyBinaryVersion) {
		return fmt.Errorf("unsupported DesiredRouteKey version: %d", data[0])
	}
	data = data[1:]

	k.Table = TableID(binary.LittleEndian.Uint32(data[0:4]))
	data = data[4:]

	addrLen := int(data[0])
	data = data[1:]
	if len(data) < addrLen+1+4 { // addr + 1 (prefix bits) + 4 (priority)
		return fmt.Errorf("data too short to unmarshal DesiredRouteKey")
	}
	addr, ok := netip.AddrFromSlice(data[0:addrLen])
	if !ok {
		return fmt.Errorf("failed to unmarshal IP address")
	}
	prefixBits := int(data[addrLen])
	k.Prefix = netip.PrefixFrom(addr, prefixBits)
	data = data[addrLen+1:]

	k.Priority = binary.LittleEndian.Uint32(data[0:4])

	return nil
}

type NexthopInfo struct {
	Device  *tables.Device
	Nexthop netip.Addr
}

func (nh *NexthopInfo) String() string {
	if nh == nil {
		return "none"

View on GitHub (pinned to ac7b90affa)

Solutions

Delete and regenerate the corrupted state/WAL file
Confirm the writing side always marshals valid netip.Addr values (4 or 16 bytes)
Verify addrLen in the stream matches the actual address bytes present
Check for storage corruption on the node

Defensive patterns

Strategy: validation

Validate before calling

addrLen := int(data[5])
if addrLen != 4 && addrLen != 16 {
    return fmt.Errorf("invalid addrLen %d in serialized key", addrLen)
}

Type guard

func hasValidAddrBytes(data []byte, addrLen int) bool {
    if addrLen != 4 && addrLen != 16 { return false }
    _, ok := netip.AddrFromSlice(data[0:addrLen])
    return ok
}

Try / catch

if err := k.UnmarshalBinary(data); err != nil {
    if strings.Contains(err.Error(), "unmarshal IP address") {
        log.Warn("corrupt address in key, discarding record")
        return nil
    }
    return err
}

Prevention

Only marshal keys whose Addr comes from netip.ParseAddr with error handling
Add checksums to persisted key blobs
Reject invalid CIDRs at the user/config input layer

When it happens

Trigger: addrLen in the key data is corrupted or the bytes at data[0:addrLen] are not 4 or 16 bytes of a valid IP — netip.AddrFromSlice only accepts those lengths.

Common situations: Bit-rot or manual corruption of the WAL/state file; a writer bug producing wrong addrLen; deserializing non-key bytes.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/5a83afff0b28b736. Report an issue: GitHub.