From nobody Fri Jun 5 08:37:59 2026 X-Original-To: bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gWvvr0gq8z6ghTf for ; Fri, 05 Jun 2026 08:38:00 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gWvvr08YXz3cQG for ; Fri, 05 Jun 2026 08:38:00 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780648680; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Fa6zrZdNCywIWcabDgPhbUYIaf9YJTH5Lh9UEkV1LfE=; b=YE4F8kBUM1UxxvwiVveDvIsB+v7lVCGMSfX4m/2HMrtc6qp8s22wnx1yOY1hRwNrHWVdyI krsPEdEdYWdXgSt0uXIBgNE5/hZ1AehW0WVs8A6bTX57oe4y5+xi+qEQRUfq6ywncs/LfD iGhgm9OXUWpRcPPP2eZ180iXc4rmipmj4c3HtctlgG/lS1CsnG/IX4q2xdN2p9nyHjz9Qj BXaP7963yMSUccJ263FP5/8DZX0q1CIndIVYs88BscPjjFjfzJBJaXPRTsoXYSzkvP7ZEV 3pSifAQ5tjisDVUhxGfh8FziUdNOMjENV+IvmMw/rC5WYzEHsPHR0LfX6DnO7Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1780648680; a=rsa-sha256; cv=none; b=rYTxYL8mpw29WYqoqtnfXEx24k9akSAtVzPnfi2aCPfcptxaWqrmyOr24bNXs0Tx1Sixlv 65XMI7UB75uuitnl/2yLzYlJiWOHwna9C8biNBdvE9XRUos00ISqGWHsUJPTH9EmZx8vVV 0z02p81Y4UveThtXSzhSfg39K2NAt76o8jL+YsRlkzbkfElkonArCsLt3iKNUSl1uMMaqc TxvW4NkKuEvhn7Rog6+hLhXL1zVs4/nFW8AqkrTvZgVUXkq+ouq5gGakrLGF9BFudmZG3U ttDAFVOMg8hacCeUHuvKDAb0sqyZsqIW+5DbiHHls7uLj6HqxUwHIUdei6xegw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780648680; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Fa6zrZdNCywIWcabDgPhbUYIaf9YJTH5Lh9UEkV1LfE=; b=XSqswSRocvuaDA+EFqryZPrTNTFVIVhrT3CON3iqKklZrEHIbiYi1jYhd2FEaYMqt4y7dD w10/l9QLoxpDfbZmMHwbwtmepWl+3CiZ6JpR5SOs0tuCE6jwO+zAp4m7MKGYJ95n3WEScS Qka8n1iJcKN25qox3mv3ZgnY/9Sfo06gqIC7xXoEnUfgVVvfKMMRn28csUBGxyZCQOKRVc PCqq/D+AR+WoLRMbjV2+ORDi5n4KwsnIrqsGhCxTFtGlqgCm3vFVr+mJLYc9YEJsyahG1J T90ze/CKUFcdXICtJ5LPB7aNimWvzKcL7iUZn/hFMwysKF8vogAvEQaO4ph3hA== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4gWvvq66Lkz61c for ; Fri, 05 Jun 2026 08:37:59 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 6558bxDS017762 for ; Fri, 5 Jun 2026 08:37:59 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 6558bxxZ017761 for bugs@FreeBSD.org; Fri, 5 Jun 2026 08:37:59 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 295870] [tcp] page fault in tcp_default_output in response to TCP input Date: Fri, 05 Jun 2026 08:37:59 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 15.0-RELEASE X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: vegeta@tuxpowered.net X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter Message-ID: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-bugs@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D295870 Bug ID: 295870 Summary: [tcp] page fault in tcp_default_output in response to TCP input Product: Base System Version: 15.0-RELEASE Hardware: amd64 OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: vegeta@tuxpowered.net I have encountered this crash twice on FreeBSD 15.0, the later one precisel= y on 15.0-p9. (kgdb) bt #0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57 #1 doadump (textdump=3D) at /usr/src/sys/kern/kern_shutdown= .c:399 #2 0xffffffff80b55969 in kern_reboot (howto=3D260) at /usr/src/sys/kern/kern_shutdown.c:519 #3 0xffffffff80b55e77 in vpanic (fmt=3D0xffffffff811a72af "%s", ap=3Dap@entry=3D0xfffffe011f345730) at /usr/src/sys/kern/kern_shutdown.c:974 #4 0xffffffff80b55ca3 in panic (fmt=3D) at /usr/src/sys/kern/kern_shutdown.c:887 #5 0xffffffff81053c08 in trap_fatal (frame=3D, eva=3D) at /usr/src/sys/amd64/amd64/trap.c:969 #6 0xffffffff81053c08 in trap_pfault (frame=3D0xfffffe011f3457b0, usermode=3Dfalse, signo=3D, ucode=3D) #7 #8 m_copydata (m=3D0x0, m@entry=3D0xfffff80b6ea88100, off=3D0, len=3Dlen@e= ntry=3D1, cp=3D) at /usr/src/sys/kern/uipc_mbuf.c:694 #9 0xffffffff80d35cb8 in tcp_default_output (tp=3D0xfffff801d7df1000) at /usr/src/sys/netinet/tcp_output.c:1080 #10 0xffffffff80d2dce3 in tcp_output (tp=3D0xfffff80b6ea88100, tp@entry=3D0xfffff801d7df1000) at /usr/src/sys/netinet/tcp_var.h:662 #11 0xffffffff80d2c372 in tcp_do_segment (tp=3D0xfffff801d7df1000, m=3D, th=3D0xfffff8014447c296, drop_hdrlen=3D100, tlen=3D0, iptos=3D) at /usr/src/sys/netinet/tcp_input.c:2842 #12 0xffffffff80d29b8c in tcp_input_with_port (mp=3D, offp=3D, proto=3D, port=3Dport@entry=3D0) at /usr/src/sys/netinet/tcp_input.c:1160 #13 0xffffffff80d29fff in tcp6_input_with_port (mp=3D, offp=3D, proto=3D, port=3D0) at /usr/src/sys/netinet/tcp_input.c:582 #14 tcp6_input (mp=3D, offp=3D, proto=3D) at /usr/src/sys/netinet/tcp_input.c:589 #15 0xffffffff80d6d14e in ip6_input (m=3D0x0) at /usr/src/sys/netinet6/ip6_input.c:963 #16 0xffffffff80c9b668 in netisr_process_workstream_proto (nwsp=3D0xfffffe00469d5e00, proto=3D6) at /usr/src/sys/net/netisr.c:926 #17 swi_net (arg=3D0xfffffe00469d5e00) at /usr/src/sys/net/netisr.c:973 #18 0xffffffff80b11709 in intr_event_execute_handlers (ie=3D0xfffff80001482= a00, p=3D) at /usr/src/sys/kern/kern_intr.c:1191 #19 ithread_execute_handlers (ie=3D0xfffff80001482a00, p=3D)= at /usr/src/sys/kern/kern_intr.c:1204 #20 ithread_loop (arg=3Darg@entry=3D0xfffff80001401c20) at /usr/src/sys/kern/kern_intr.c:1297 #21 0xffffffff80b0dcab in fork_exit (callout=3D0xffffffff80b114d0 , arg=3D0xfffff80001401c20, frame=3D0xfffffe011f345f40) at /usr/src/sys/kern/kern_fork.c:1153 #22 (kgdb) I have a full memory dump, so I can provide additional information. --=20 You are receiving this mail because: You are the assignee for the bug.=