[Bug 297273] tcp rack+fastopen can panic or crash in m_copydata()

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297273

            Bug ID: 297273
           Summary: tcp rack+fastopen can panic or crash in m_copydata()
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu
 Attachment #273446 text/plain
         mime type:

Created attachment 273446
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=273446&action=edit
tickle a tcp/rack/fastopen panic in m_copydata()

The attached program causes a tcp+rack+fastopen client to
to panic here in m_copydata() if INVARIANTS:

    KASSERT(m != NULL, ("m_copydata, length > size of mbuf chain"));

If not INVARIANTS, the result is a kernel page fault due to the loop
in m_copydata() running off the end of the mbuf chain.

# uname -a
FreeBSD xxx 16.0-CURRENT FreeBSD 16.0-CURRENT #37 main-n275529-da69298e9825:
Fri Jul 17 07:08:15 AST 2026    
root@xxx:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
# cc tcp28b.c
# ./a.out
panic: m_copydata, length > size of mbuf chain
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x36/frame 0xfffffe00d75907a0
vpanic() at vpanic+0x149/frame 0xfffffe00d75908d0
panic() at panic+0x43/frame 0xfffffe00d7590930
m_copydata() at m_copydata+0x204/frame 0xfffffe00d75909c0
rack_output() at rack_output+0x342b/frame 0xfffffe00d7590cd0
tcp_hptsi() at tcp_hptsi+0x99b/frame 0xfffffe00d7590e00
tcp_hpts_thread() at tcp_hpts_thread+0x184/frame 0xfffffe00d7590e60
ithread_loop() at ithread_loop+0x266/frame 0xfffffe00d7590ef0
fork_exit() at fork_exit+0x82/frame 0xfffffe00d7590f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00d7590f30
--- trap 0xb, rip = 0x6, rsp = 0x33d7793da056, rbp = 0x33d7792aca02 ---

-- 
You are receiving this mail because:
You are the assignee for the bug.