[Bug 293957] Kernel Panic in fusefs: page fault (0x78) in fuse_vnop_write during vnode recycling (csync2 synchro)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293957

            Bug ID: 293957
           Summary: Kernel Panic in fusefs: page fault (0x78) in
                    fuse_vnop_write during vnode recycling (csync2
                    synchro)
           Product: Base System
           Version: 15.0-RELEASE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: zjk7@wp.pl

I am experiencing a consistent kernel panic on FreeBSD 15.0-RELEASE-p4 when
running a heavy file scanning tool (csync2) on a local SSD, while having
MooseFS (FUSE) mounts active (even if the FUSE mounts are excluded from the
scan).
Panic details:

    Panic String: page fault
    Fault virtual address: 0x78 (NULL pointer dereference)
    Instruction pointer: fuse_vnop_write+0x1d5
    Stack Trace:
    #0 vpanic
    #1 panic
    #2 trap_pfault
    #3 calltrap
    #4 fuse_vnop_write+0x1d5
    #5 VOP_WRITE_APV
    #6 vn_write
    #7 vn_io_fault
    #8 dofilewrite
    #9 sys_write
    #10 amd64_syscall

Observed behavior:
The panic occurs when vfs.numvnodes grows rapidly due to local disk activity.
It seems like the vnode reclamation process (recycling) triggers a write
operation in the fusefs module, which then tries to access a NULL pointer
(offset 0x78).
System Environment:

    FreeBSD 15.0-RELEASE-p4 GENERIC
    RAM: 16GB
    FUSE mounts: MooseFS (mfsmount)
    Settings tried (but still panics): vfs.fusefs.data_cache_mode=0,
kern.maxvnodes=2000000, vfs.fusefs.iov_credit=4.

Dump header from device: /dev/gpt/swap
  Architecture: amd64
  Architecture Version: 2
  Dump Length: 2126323712
  Blocksize: 512
  Compression: none
  Dumptime: 2026-03-21 17:37:36 +0100
  Hostname: almach.zjk.pl
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 15.0-RELEASE-p4 GENERIC
  Panic String: page fault
  Dump Parity: 1743253822
  Bounds: 7
  Dump Status: good

-- 
You are receiving this mail because:
You are the assignee for the bug.