[Bug 289734] [FreeBSD][NFS][TLS] panic tcp_usr_close while running mount command after configure NFS over TLS

From: <bugzilla-noreply_at_freebsd.org>
Date: Sun, 21 Sep 2025 05:48:03 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289734

            Bug ID: 289734
           Summary: [FreeBSD][NFS][TLS] panic tcp_usr_close while running
                    mount command after configure NFS over TLS
           Product: Base System
           Version: 15.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: wafah@nvidia.com

1. Short issue description:  We have panic in server side after configure NFS
on 
server and client sides and then try to run mount command on client side.

2. Steps for reproduction :
    A) Server Configuration:

Add the following lines to the file /etc/rc.conf

nfs_server_enable="YES"
tlsservd_enable="YES"
nfsd_enable="YES"
nfsv4_server_enable="YES"
nfsuserd_enable="YES"

Add the following lines to the file /etc/exports where the ip 13.0.0.1 is the
client ip
V4: / -sec=sys:krb5p:tls
/tmp -ro 13.0.0.1 -tls

Generate certificate and private key files (cert.pem and certkey.pem) and put
them in /etc/rpc.tlsservd folder (you need to create the folder).
Run the following command:
 # rpc.tlsservd

    B) Client Configuration:

Add the following lines to the file /etc/rc.conf
nfs_client_enable="YES"
rpc_statd_enable="YES"
rpc_lockd_enable="YES"
tlsclntd_enable="YES"
nfsuserd_enable="YES"

Run the following command:
# rpc.tlsclntd

Run the following command, where 13.0.0.2 is the server ip:
mount -o tls 13.0.0.2:/tmp /mnt

The issue might not reproduced from first run, you might need to run the mount
command more than once.

3.  Logs form crashed server:

Versions

Querying Mellanox devices firmware ...

Device #1:

----------

  Device Type:      ConnectX7

  Part Number:      CX713106AE-HEA_QP1_Ax

  Description:      NVIDIA ConnectX-7 HHHL adapter Card; 200GbE (default mode)
/ NDR200 IB; Dual-port QSFP112; PCIe 5.0 x16 with x16 PCIe extension option;
Crypto Enabled; Secure Boot Capable; IPN for internal use

  PSID:             MT_0000000894

  PCI Device Name:  pci0:8:0:0

  Base MAC:         1070fd658b48

  Versions:         Current        Available    

     FW             28.45.1020     N/A          

  Status:           No matching image found

Kernel version:

commit 7c0bc6c703eeaea737d0dbc21996764967e4dc97 (HEAD -> main, origin/main,
origin/HEAD)

Author: Colin Percival

Date:   Sun Sep 14 17:39:42 2025 -0700

    release: Always dist sets on dvd1

    In the !NOPKGBASE && !NODISTSETS case, we only want the pkgbase repo

    on disc1; but we want both packaging formats on dvd in order to allow

    for offline installs in both methods and also tools which ingest the

    dist sets from the dvd image.

    MFC after:      12 hours

    Sponsored by:   https://www.patreon.com/cperciva

    Differential Revision:  https://reviews.freebsd.org/D52537

BT:

GNU gdb (GDB) 15.1 [GDB v15.1 for FreeBSD]

Copyright (C) 2024 Free Software Foundation, Inc.

License GPLv3+: GNU GPL version 3 or later

This is free software: you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.

Type "show copying" and "show warranty" for details.

This GDB was configured as "x86_64-portbld-freebsd13.5".

Type "show configuration" for configuration details.

For bug reporting instructions, please see:

.

Find the GDB manual and other documentation resources online at:

    .



For help, type "help".

Type "apropos word" to search for commands related to "word"...

Reading symbols from /boot/kernel/kernel...

Reading symbols from /usr/lib/debug//boot/kernel/kernel.debug...



Unread portion of the kernel message buffer:

panic: tcp_usr_close: inp == NULL

cpuid = 15

time = 1758193160

KDB: stack backtrace:

db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe010279fb10

vpanic() at vpanic+0x136/frame 0xfffffe010279fc40

panic() at panic+0x43/frame 0xfffffe010279fca0

tcp_usr_close() at tcp_usr_close+0x16a/frame 0xfffffe010279fcf0

soclose() at soclose+0x154/frame 0xfffffe010279fd50

svc_vc_destroy_common() at svc_vc_destroy_common+0xf2/frame 0xfffffe010279fd80

svc_vc_destroy() at svc_vc_destroy+0xa9/frame 0xfffffe010279fdb0

svc_run_internal() at svc_run_internal+0x8e6/frame 0xfffffe010279fee0

svc_thread_start() at svc_thread_start+0xb/frame 0xfffffe010279fef0

fork_exit() at fork_exit+0x82/frame 0xfffffe010279ff30

fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe010279ff30

--- trap 0xc, rip = 0xf2ba85581da, rsp = 0xf2ba5ca4118, rbp = 0xf2ba5ca43b0 ---

Uptime: 5h7m39s

Dumping 1391 out of 32733 MB:..2%..11%..21%..32%..41%..51%..61%..71%..81%..91%



Reading symbols from /boot/kernel/linux.ko...

Reading symbols from /usr/lib/debug//boot/kernel/linux.ko.debug...

Reading symbols from /boot/kernel/mqueuefs.ko...

Reading symbols from /usr/lib/debug//boot/kernel/mqueuefs.ko.debug...

Reading symbols from /boot/kernel/linux_common.ko...

Reading symbols from /usr/lib/debug//boot/kernel/linux_common.ko.debug...

Reading symbols from /boot/kernel/linux64.ko...

Reading symbols from /usr/lib/debug//boot/kernel/linux64.ko.debug...

Reading symbols from /boot/kernel/pty.ko...

Reading symbols from /usr/lib/debug//boot/kernel/pty.ko.debug...

Reading symbols from /boot/kernel/fdescfs.ko...

Reading symbols from /usr/lib/debug//boot/kernel/fdescfs.ko.debug...

Reading symbols from /boot/kernel/linprocfs.ko...

Reading symbols from /usr/lib/debug//boot/kernel/linprocfs.ko.debug...

Reading symbols from /boot/kernel/linsysfs.ko...

Reading symbols from /usr/lib/debug//boot/kernel/linsysfs.ko.debug...

Reading symbols from /boot/kernel/autofs.ko...

Reading symbols from /usr/lib/debug//boot/kernel/autofs.ko.debug...

Reading symbols from /boot/kernel/ipsec.ko...

Reading symbols from /usr/lib/debug//boot/kernel/ipsec.ko.debug...

Reading symbols from /boot/kernel/mac_ntpd.ko...

Reading symbols from /usr/lib/debug//boot/kernel/mac_ntpd.ko.debug...

Reading symbols from /boot/kernel/mlx5en.ko...

Reading symbols from /usr/lib/debug//boot/kernel/mlx5en.ko.debug...

Reading symbols from /boot/kernel/linuxkpi.ko...

Reading symbols from /usr/lib/debug//boot/kernel/linuxkpi.ko.debug...

--Type for more, q to quit, c to continue without paging--Reading symbols from
/boot/kernel/iicbus.ko...

Reading symbols from /usr/lib/debug//boot/kernel/iicbus.ko.debug...

Reading symbols from /boot/kernel/iicbb.ko...

Reading symbols from /usr/lib/debug//boot/kernel/iicbb.ko.debug...

Reading symbols from /boot/kernel/backlight.ko...

Reading symbols from /usr/lib/debug//boot/kernel/backlight.ko.debug...

Reading symbols from /boot/kernel/mlx5.ko...

Reading symbols from /usr/lib/debug//boot/kernel/mlx5.ko.debug...

Reading symbols from /boot/kernel/mlxfw.ko...

Reading symbols from /usr/lib/debug//boot/kernel/mlxfw.ko.debug...

__curthread () at /usr/kernel_git/sys/amd64/include/pcpu_aux.h:57

57              __asm("movq %%gs:%c1,%0" : "=r" (td)

(kgdb)

PANIC:



c-237-171-20-025.mtl.labs.mlnx dumped core - see /var/crash/vmcore.5



Thu Sep 18 10:59:41 UTC 2025



FreeBSD c-237-171-20-025.mtl.labs.mlnx 16.0-CURRENT FreeBSD 16.0-CURRENT #1
main-n280456-7c0bc6c703ee: Thu Sep 18 05:44:51 UTC 2025    
root@c-237-171-20-025.mtl.labs.mlnx:/usr/obj/usr/kernel_git/amd64.amd64/sys/LATEST
 amd64



panic: tcp_usr_close: inp == NULL



Reading symbols from /boot/kernel/kernel...

Reading symbols from /usr/lib/debug//boot/kernel/kernel.debug...

Reading symbols from /boot/kernel/linux.ko...

Reading symbols from /usr/lib/debug//boot/kernel/linux.ko.debug...

Reading symbols from /boot/kernel/mqueuefs.ko...

Reading symbols from /usr/lib/debug//boot/kernel/mqueuefs.ko.debug...

Reading symbols from /boot/kernel/linux_common.ko...

Reading symbols from /usr/lib/debug//boot/kernel/linux_common.ko.debug...

Reading symbols from /boot/kernel/linux64.ko...

Reading symbols from /usr/lib/debug//boot/kernel/linux64.ko.debug...

Reading symbols from /boot/kernel/pty.ko...

Reading symbols from /usr/lib/debug//boot/kernel/pty.ko.debug...

Reading symbols from /boot/kernel/fdescfs.ko...

Reading symbols from /usr/lib/debug//boot/kernel/fdescfs.ko.debug...

Reading symbols from /boot/kernel/linprocfs.ko...

Reading symbols from /usr/lib/debug//boot/kernel/linprocfs.ko.debug...

Reading symbols from /boot/kernel/linsysfs.ko...

Reading symbols from /usr/lib/debug//boot/kernel/linsysfs.ko.debug...

Reading symbols from /boot/kernel/autofs.ko...

Reading symbols from /usr/lib/debug//boot/kernel/autofs.ko.debug...

Reading symbols from /boot/kernel/ipsec.ko...

Reading symbols from /usr/lib/debug//boot/kernel/ipsec.ko.debug...

Reading symbols from /boot/kernel/mac_ntpd.ko...

Reading symbols from /usr/lib/debug//boot/kernel/mac_ntpd.ko.debug...

Reading symbols from /boot/kernel/mlx5en.ko...

Reading symbols from /usr/lib/debug//boot/kernel/mlx5en.ko.debug...

Reading symbols from /boot/kernel/linuxkpi.ko...

Reading symbols from /usr/lib/debug//boot/kernel/linuxkpi.ko.debug...

Reading symbols from /boot/kernel/iicbus.ko...

Reading symbols from /usr/lib/debug//boot/kernel/iicbus.ko.debug...

Reading symbols from /boot/kernel/iicbb.ko...

Reading symbols from /usr/lib/debug//boot/kernel/iicbb.ko.debug...

Reading symbols from /boot/kernel/backlight.ko...

Reading symbols from /usr/lib/debug//boot/kernel/backlight.ko.debug...

Reading symbols from /boot/kernel/mlx5.ko...

Reading symbols from /usr/lib/debug//boot/kernel/mlx5.ko.debug...

Reading symbols from /boot/kernel/mlxfw.ko...

Reading symbols from /usr/lib/debug//boot/kernel/mlxfw.ko.debug...

__curthread () at /usr/kernel_git/sys/amd64/include/pcpu_aux.h:57

57              __asm("movq %%gs:%c1,%0" : "=r" (td)

(kgdb) #0  __curthread () at /usr/kernel_git/sys/amd64/include/pcpu_aux.h:57

        td =

-- 
You are receiving this mail because:
You are the assignee for the bug.