Bug 297273 - tcp rack+fastopen can panic or crash in m_copydata()
Summary: tcp rack+fastopen can panic or crash in m_copydata()
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 16.0-CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: Michael Tuexen
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2026-08-04 14:21 UTC by Robert Morris
Modified: 2026-08-04 14:44 UTC (History)
2 users (show)

See Also:

Attachments
tickle a tcp/rack/fastopen panic in m_copydata() (8.12 KB, text/plain)
2026-08-04 14:21 UTC, Robert Morris 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Morris 2026-08-04 14:21:29 UTC 
Created attachment 273446 [details]
tickle a tcp/rack/fastopen panic in m_copydata()

The attached program causes a tcp+rack+fastopen client to
to panic here in m_copydata() if INVARIANTS:

    KASSERT(m != NULL, ("m_copydata, length > size of mbuf chain"));

If not INVARIANTS, the result is a kernel page fault due to the loop
in m_copydata() running off the end of the mbuf chain.

# uname -a
FreeBSD xxx 16.0-CURRENT FreeBSD 16.0-CURRENT #37 main-n275529-da69298e9825: Fri Jul 17 07:08:15 AST 2026     root@xxx:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
# cc tcp28b.c
# ./a.out
panic: m_copydata, length > size of mbuf chain
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x36/frame 0xfffffe00d75907a0
vpanic() at vpanic+0x149/frame 0xfffffe00d75908d0
panic() at panic+0x43/frame 0xfffffe00d7590930
m_copydata() at m_copydata+0x204/frame 0xfffffe00d75909c0
rack_output() at rack_output+0x342b/frame 0xfffffe00d7590cd0
tcp_hptsi() at tcp_hptsi+0x99b/frame 0xfffffe00d7590e00
tcp_hpts_thread() at tcp_hpts_thread+0x184/frame 0xfffffe00d7590e60
ithread_loop() at ithread_loop+0x266/frame 0xfffffe00d7590ef0
fork_exit() at fork_exit+0x82/frame 0xfffffe00d7590f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00d7590f30
--- trap 0xb, rip = 0x6, rsp = 0x33d7793da056, rbp = 0x33d7792aca02 ---