XPost: linux.debian.bugs.dist, linux.kernel   
   From: carnil@debian.org   
      
   Control: forwarded -1 https://lore.kernel.org/netdev/17699627962   
   .3109699.15382994681575380467@eldamar.lan   
      
   Hi Antonio and all,   
      
   In Debian we got the following report from Jon Penn using ovpn,   
   reported at https://bugs.debian.org/1126499   
      
   On Tue, Jan 27, 2026 at 10:37:40AM -0600, Jon Penn wrote:   
   > Package: src:linux   
   > Version: 6.17.13-1   
   > Severity: normal   
   >   
   > Dear Maintainer,   
   >   
   > This is an OpenVPN server serving primarially TCP clients (but also some UDP   
   > clients). As I write this there are 1161 TCP clients and 74 UDP clients. It   
   > is running debian testing in order to have ovpn-dco-offload functionality   
   > for TCP connections. We observe that under hevy load (in terms of   
   > connections count, not really under much load in terms of bandwidth) this   
   > server will become locked up from time to time and the graphical console   
   > will become completely non-responsive. When this happens we reset the VM and   
   > things continue running normally. I attempted to monitor the system using   
   > dmesg and notice that I am getting some interesting messages about "BUG:   
   > kernel NULL pointer dereference" that mention the ovpn module, leading me to   
   > believe that this is a kernel bug in that module. Unfortunatly this issue   
   > only occours when the server has many connections, and that is only   
   > happening because most of my users are working from home today due to   
   > weather. This gives me a rather small window of reproducability but if there   
   > is any additional information I can provide let me know.   
   > -- Package-specific info:   
   > ** Version:   
   > Linux version 6.17.13+deb14-amd64 (debian-kernel@lists.debian.org)   
   > (x86_64-linux-gnu-gcc-15 (Debian 15.2.0-12) 15.2.0, GNU ld (GNU Binutils for   
   > Debian) 2.45.50.20251209) #1 SMP PREEMPT_DYNAMIC Debian 6.17.13-1   
   > (2025-12-20)   
   >   
   > ** Command line:   
   > BOOT_IMAGE=/boot/vmlinuz-6.17.13+deb14-amd64   
   > root=UUID=f00f1200-b8d8-4432-bb0b-593a5ab9075a ro quiet   
   >   
   > ** Tainted: D (128)   
   > * kernel died recently, i.e. there was an OOPS or BUG   
   >   
   > ** Kernel log:   
   > [ 709.018150] tun1: deleting peer with id 719, reason 1   
   > [ 709.056997] tun1: deleting peer with id 1055, reason 1   
   > [ 711.054524] tun1: deleting peer with id 201, reason 2   
   > [ 711.055070] BUG: kernel NULL pointer dereference, address:   
   > 0000000000000020   
   > [ 711.055096] #PF: supervisor write access in kernel mode   
   > [ 711.055429] #PF: error_code(0x0002) - not-present page   
   > [ 711.055656] PGD 0 P4D 0   
   > [ 711.055824] Oops: Oops: 0002 [#1] SMP NOPTI   
   > [ 711.055991] CPU: 12 UID: 0 PID: 527 Comm: kworker/12:2 Not tainted   
   > 6.17.13+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.13-1   
   > [ 711.056154] Hardware name: Red Hat KVM, BIOS   
   > edk2-20221207gitfff6d81270b5-9.el9_2 12/07/2022   
   > [ 711.056333] Workqueue: events ovpn_peer_keepalive_work [ovpn]   
   > [ 711.056524] RIP: 0010:ovpn_tcp_socket_detach+0x61/0x80 [ovpn]   
   > [ 711.056695] Code: 01 00 00 48 8b 83 b8 01 00 00 48 89 85 c0 02 00 00 48 8b   
   > 83 c0 01 00 00 48 89 45 28 48 8b 85 20 01 00 00 48 8b 93 c8 01 00 00 <48> 89   
   > 50 20 48 c7 85 98 02 00 00 00 00 00 00 5b 5d c3 cc cc cc cc   
   > [ 711.056986] RSP: 0018:ffffd3988153fdb8 EFLAGS: 00010246   
   > [ 711.057136] RAX: 0000000000000000 RBX: ffff8e65873a5400 RCX:   
   > 0000000000000004   
   > [ 711.057314] RDX: ffffffff92d6d660 RSI: 0000000000000068 RDI:   
   > ffff8e65873a5568   
   > [ 711.057475] RBP: ffff8e6590fb4280 R08: 0000000000000000 R09:   
   > 0000000000000101   
   > [ 711.057644] R10: 0000000000000000 R11: ffffffff93a080e0 R12:   
   > 000000006978de32   
   > [ 711.057794] R13: 0000000000000001 R14: ffff8e65839c1aa8 R15:   
   > 0000000000000000   
   > [ 711.057940] FS: 0000000000000000(0000) GS:ffff8e695b708000(0000)   
   > knlGS:0000000000000000   
   > [ 711.058087] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033   
   > [ 711.058246] CR2: 0000000000000020 CR3: 000000010862d001 CR4:   
   > 00000000007726f0   
   > [ 711.058412] PKRU: 55555554   
   > [ 711.058584] Call Trace:   
   > [ 711.058739]    
   > [ 711.058892] ovpn_socket_release+0x165/0x1a0 [ovpn]   
   > [ 711.059048] unlock_ovpn+0x48/0x80 [ovpn]   
   > [ 711.059199] ovpn_peer_keepalive_work+0xf3/0x1b0 [ovpn]   
   > [ 711.059360] ? __schedule+0x464/0xd20   
   > [ 711.059557] process_one_work+0x18f/0x350   
   > [ 711.059740] worker_thread+0x25a/0x3a0   
   > [ 711.059889] ? __pfx_worker_thread+0x10/0x10   
   > [ 711.060046] kthread+0xfc/0x240   
   > [ 711.060203] ? __pfx_kthread+0x10/0x10   
   > [ 711.060358] ? __pfx_kthread+0x10/0x10   
   > [ 711.060559] ret_from_fork+0x194/0x1c0   
   > [ 711.060801] ? __pfx_kthread+0x10/0x10   
   > [ 711.061019] ret_from_fork_asm+0x1a/0x30   
   > [ 711.061269]    
   > [ 711.061494] Modules linked in: intel_rapl_msr intel_rapl_common   
   > intel_uncore_frequency_common isst_if_mbox_msr isst_if_common ovpn   
   > ip6_udp_tunnel udp_tunnel skx_edac_common nfit libnvdimm kvm_intel kvm   
   > binfmt_misc irqbypass ghash_clmulni_intel aesni_intel rapl nls_ascii   
   > nls_cp437 vfat fat qxl drm_ttm_helper ttm drm_exec pcspkr drm_client_lib sg   
   > drm_kms_helper button evdev joydev drm configfs efi_pstore nfnetlink   
   > vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport   
   > vsock vmw_vmci efivarfs qemu_fw_cfg autofs4 ext4 crc16 mbcache jbd2   
   > crc32c_cryptoapi hid_generic usbhid hid sr_mod sd_mod cdrom ahci libahci   
   > xhci_pci libata xhci_hcd iTCO_wdt intel_pmc_bxt iTCO_vendor_support watchdog   
   > psmouse usbcore scsi_mod e1000 serio_raw i2c_i801 lpc_ich scsi_common   
   > usb_common i2c_smbus   
   > [ 711.062827] CR2: 0000000000000020   
   > [ 711.063051] ---[ end trace 0000000000000000 ]---   
   > [ 711.600092] RIP: 0010:ovpn_tcp_socket_detach+0x61/0x80 [ovpn]   
   > [ 711.602044] Code: 01 00 00 48 8b 83 b8 01 00 00 48 89 85 c0 02 00 00 48 8b   
   > 83 c0 01 00 00 48 89 45 28 48 8b 85 20 01 00 00 48 8b 93 c8 01 00 00 <48> 89   
      
   [continued in next message]   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)