Panic after sing-box running several hours

Operating system

Linux

System version

Ubuntu 22.04.3 LTS

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.9.0-rc.15 and sing-box version 1.8.13

Description

Hi
After several hours, suddenly sing-box crashes and panic happens.
I tested multiple times with different multiplex protocol such as yamux and smux, but the problem still exists.

Reproduction

Client (ss-out) > Server_1 (ss-in and vless-out) > Server_2 (vless_in)
The panic happens in Server_1

Server_1 Config:

{
   "log":{
    "disabled": false,
    "level": "error",
    "output": "#some_output",
    "timestamp": true
   },
   "dns": {
       "servers": [
	    {
		"tag": "tag1",
		"address": "tcp://#dns_server",
		"strategy": "ipv4_only"
	    },
            {
                "tag": "tag-2",
                "address": "tcp://#dns_server",
                "strategy": "ipv4_only"
            }
	]
   },
   "route": {
       "rules": [
           {
	       "rule_set": "#some_geoip",
	       "outbound": "direct-out"
	   }
       ],
       "rule_set": [
	      {
	        "tag": "#some_geoip",
	        "type": "remote",
	        "format": "binary",
	        "url": "#URL",
	        "download_detour": "direct-out"
	      }
       ]
   },
   "inbounds":[
     {
	  "type": "shadowsocks",
  	  "tag": "SS-In",

          "listen": "::",
          "listen_port": 443,
          "sniff": false,
  	  "sniff_override_destination": false,
          "domain_strategy": "ipv4_only",

	  "method": "2022-blake3-chacha20-poly1305",
	  "password": "#PASSWORD",

	  "multiplex": {
	   "enabled": true,
	   "padding": false
	  }
     }
   ],
   "outbounds":[
      {
	    "type": "vless",
            "tag": "vless-out",

            "server": "#IP",
            "server_port": 443,
            "uuid": "#UUID",
            "tls": {
                "enabled": true,
                "server_name": "#SERVER_NAME",
                "insecure": false,
                "utls": {
                  "enabled": true,
                  "fingerprint": "firefox"
                },
		"ech": {
		  "enabled": true,
		  "pq_signature_schemes_enabled": true,
		  "dynamic_record_sizing_disabled": false,
		  "config_path": "#PATH"
		}
	    },
	   "multiplex": {
	       "enabled": true,
	       "protocol": "smux",
	       "max_streams": 4,
	       "padding": false
	   }
      },
      {
	  "type": "direct",
	  "tag": "direct-out",
	  "domain_strategy": "ipv4_only"
      },
      {
          "type": "block",
          "tag": "block"
      }
   ]
}

Logs

08:31:57  sing-box[31668]: panic: runtime error: invalid memory address or nil pointer dereference
08:31:57  sing-box[31668]: [signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0xe522f7]
08:31:57  sing-box[31668]: goroutine 26653 [running]:
08:31:57  sing-box[31668]: github.com/sagernet/smux.(*Stream).tryRead(0x4495f9?, {0xc000890078?, 0x10?, 0xc000d42a18?})
08:31:57  sing-box[31668]:         github.com/sagernet/smux@v0.0.0-20231208180855-7041f6ea79e7/stream.go:84 +0x17
08:31:57  sing-box[31668]: github.com/sagernet/smux.(*Stream).Read(0x0, {0xc000890078, 0x2, 0x2})
08:31:57  sing-box[31668]:         github.com/sagernet/smux@v0.0.0-20231208180855-7041f6ea79e7/stream.go:71 +0x45
08:31:57  sing-box[31668]: github.com/sagernet/sing-mux.(*wrapStream).Read(0x0?, {0xc000890078?, 0xc000d42a40?, 0x4573e9?})
08:31:57  sing-box[31668]:         github.com/sagernet/sing-mux@v0.2.0/error.go:15 +0x22
08:31:57  sing-box[31668]: io.ReadAtLeast({0x7f4befff6f18, 0xc000fd80f0}, {0xc000890078, 0x2, 0x2}, 0x2)
08:31:57  sing-box[31668]:         io/io.go:335 +0x90
08:31:57  sing-box[31668]: io.ReadFull(...)
08:31:57  sing-box[31668]:         io/io.go:354
08:31:57  sing-box[31668]: encoding/binary.Read({0x7f4befff6f18, 0xc000fd80f0}, {0x1693810, 0x20c9760}, {0x11ea740, 0xc000d42bee})
08:31:57  sing-box[31668]:         encoding/binary/binary.go:241 +0xb4
08:31:57  sing-box[31668]: github.com/sagernet/sing-mux.ReadStreamRequest({0x7f4befff6f18, 0xc000fd80f0})
08:31:57  sing-box[31668]:         github.com/sagernet/sing-mux@v0.2.0/protocol.go:119 +0x50
08:31:57  sing-box[31668]: github.com/sagernet/sing-mux.(*Service).newConnection(0xc00007aaa0, {0x168cfc8, 0xc000986240}, {0x1695cd0, 0xc0009c8000}, {0x1698a58, 0x0}, {{0x0, 0x0}, {{{0x0, ...}, ...}, ...}, ...})
08:31:57  sing-box[31668]:         github.com/sagernet/sing-mux@v0.2.0/server.go:89 +0x117
08:31:57  sing-box[31668]: github.com/sagernet/sing-mux.(*Service).NewConnection.func1.1()
08:31:57  sing-box[31668]:         github.com/sagernet/sing-mux@v0.2.0/server.go:74 +0x7e
08:31:57  sing-box[31668]: created by github.com/sagernet/sing-mux.(*Service).NewConnection.func1 in goroutine 26652
08:31:57  sing-box[31668]:         github.com/sagernet/sing-mux@v0.2.0/server.go:73 +0xde

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start with the stack trace in smux/stream.go and follow the sing-mux entries in error.go, protocol.go, and server.go, especially Service.newConnection. Reproduce the Server_1 configuration and multiplex setup described in the issue, then verify that the long-running proxy path no longer panics under the reported scenario.