loopback protocol causes nil pointer dereference panic in loopback.go:50

[Xpos587]

Integrity requirements

• I have read all the comments in the issue template and ensured that this issue meet the requirements.
• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I provided the complete config and logs, rather than just providing the truncated parts based on my own judgment.
• I searched issues and did not find any similar issues.
• The problem can be successfully reproduced in the latest Release

Description

Version: Xray-core 26.2.6 (12ee51e)

When using the loopback outbound protocol to route traffic back to the router for additional processing (multi-tier routing), Xray crashes with nil pointer dereference at proxy/loopback/loopback.go:50.

Stack trace:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x50 pc=0xe95938]

github.com/xtls/xray-core/proxy/loopback.(*Loopback).Process.func1()
    github.com/xtls/xray-core/proxy/loopback/loopback.go:50 +0x198

Expected behavior: The loopback protocol should route traffic from an outbound back to a specified inbound tag, allowing for multi-tier routing with additional processing (e.g., geo-based selection of middle proxy).

Actual behavior: Xray crashes immediately when traffic tries to pass through the loopback outbound.

Root cause: Missing nil check for l.config at line 50:

inbound.Tag = l.config.InboundTag  // l.config is nil!

The config field is nil even though the configuration JSON correctly specifies settings.inboundTag.

Reproduction Method

1. Configure a loopback outbound with settings.inboundTag pointing to an existing inbound
2. Configure a VMESS/VLESS outbound with proxySettings.tag pointing to the loopback outbound
3. Configure routing rules to send traffic through the chain
4. Start Xray-core
5. Send any HTTP request through the proxy

Xray will crash when the outbound tries to use the loopback via proxySettings.

Client config

Details

{
  "log": {
    "loglevel": "debug",
    "dnsLog": true
  },
  "inbounds": [
    {
      "tag": "proxy-in",
      "port": 10808,
      "protocol": "socks",
      "settings": {
        "auth": "noauth",
        "udp": true
      }
    },
    {
      "tag": "middle-selector-in",
      "port": 10999,
      "protocol": "dokodemo-door",
      "settings": {
        "network": "tcp,udp",
        "followRedirect": true
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls", "quic"],
        "routeOnly": true
      }
    }
  ],
  "outbounds": [
    {
      "tag": "direct-out",
      "protocol": "freedom"
    },
    {
      "tag": "loopback-to-middle",
      "protocol": "loopback",
      "settings": {
        "inboundTag": "middle-selector-in"
      }
    },
    {
      "tag": "test-proxy",
      "protocol": "vmess",
      "proxySettings": {
        "tag": "loopback-to-middle"
      },
      "settings": {
        "vnext": [{
          "address": "example.com",
          "port": 443,
          "users": [{
            "id": "00000000-0000-0000-0000-000000000000",
            "alterId": 0,
            "security": "auto"
          }]
        }]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "none"
      }
    }
  ],
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "inboundTag": ["middle-selector-in"],
        "outboundTag": "direct-out"
      },
      {
        "inboundTag": ["proxy-in"],
        "outboundTag": "test-proxy"
      }
    ]
  }
}

Server config

N/A (this is a client-side bug, no server config required)

Client log

Details

2026/02/20 20:45:18.489911 [Warning] common/errors: The feature VLESS (with no Flow, etc.) is deprecated, not recommended for using and might be removed. Please migrate to VLESS with Flow & Seed as soon as possible.
2026/02/20 20:45:18.668059 [Warning] core: Xray 26.2.6 started
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x50 pc=0xe95938]
goroutine 82 [running]:

github.com/xtls/xray-core/proxy/loopback.(*Loopback).Process.func1()

github.com/xtls/xray-core/proxy/loopback/loopback.go:50 +0x198

github.com/xtls/xray-core/common/retry.(*retryer).On(0xc000807d18, 0xc000807d50)

github.com/xtls/xray-core/common/retry/retry.go:27 +0xc3

github.com/xtls/xray-core/proxy/loopback.(*Loopback).Process(0xc00047c810, {0x1a7d1e0, 0xc002956390}, 0xc00167aac0, {0x159eae0?, 0xc00251c840?})

github.com/xtls/xray-core/app/proxyman/outbound.(*Handler).Dispatch(0xc00251ab40, {0x1a7d1e0, 0xc00296e840}, 0xc00167aac0)

github.com/xtls/xray-core/app/proxyman/outbound/handler.go:242 +0x992

created by github.com/xtls/xray-core/app/proxyman/outbound.(*Handler).Dial in goroutine 130

github.com/xtls/xray-core/app/proxyman/outbound/handler.go:289 +0xe30

Server log

N/A (this is a client-side issue, no server log required)

[Fangliding]

try https://github.com/XTLS/Xray-core/actions/runs/22273367201

[dansean]

我今天尝试将 SOCKS出站 链式代理，通过loopback 协议 重新路由到 balancerTag。发生了同样的错误。

  {
      "protocol": "socks",
      "settings": {
        "address": "10.124.0.190",
        "port": 1080
      },
      "proxySettings": {
        "tag": "LOOP"
      }
    }

tag直接写 balancerTag 出站不支持，会提示没有 这个 outbound。
配置loopback后崩溃:

2026/03/17 07:04:05.291688 [Info] infra/conf/serial: Reading config: &{Name:/usr/local/etc/xray/99_outbounds.json Format:json}
2026/03/17 07:04:05.291702 [Info] infra/conf: [/usr/local/etc/xray/99_outbounds.json] prepend outbound with tag: direct
2026/03/17 07:04:05.291716 [Info] infra/conf: [/usr/local/etc/xray/99_outbounds.json] prepend outbound with tag: block
2026/03/17 07:04:05.291725 [Info] infra/conf: [/usr/local/etc/xray/99_outbounds.json] prepend outbound with tag: drop
2026/03/17 07:04:05.291735 [Info] infra/conf: [/usr/local/etc/xray/99_outbounds.json] prepend outbound with tag: LOOP
2026/03/17 07:04:07.251798 [Info] app/dns: DNS: created Local TCP client initialized for tcp+local://coredns
2026/03/17 07:04:07.416654 [Info] app/dns: DNS: client tcp+local://coredns uses clientIP 180.163.43.159
2026/03/17 07:04:07.416726 [Info] app/dns: DNS: created Local TCP client initialized for tcp+local://coredns
2026/03/17 07:04:07.459584 [Info] app/dns: DNS: client tcp+local://coredns uses clientIP 23.234.96.1
2026/03/17 07:04:07.459920 [Info] app/dns: DNS: created UDP client initialized for 192.168.255.1:53
2026/03/17 07:04:07.496330 [Info] app/dns: DNS: client 192.168.255.1 uses clientIP 23.234.96.1
2026/03/17 07:04:09.107965 [Info] transport/internet/tcp: listening TCP on 0.0.0.0:1080
2026/03/17 07:04:09.108169 [Info] transport/internet/udp: listening UDP on 0.0.0.0:1080
2026/03/17 07:04:09.108294 [Info] transport/internet/tcp: listening TCP on [::]:8080
2026/03/17 07:04:09.109058 [Info] transport/internet/tcp: listening TCP on [::]:6060
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x50 pc=0xe95938]

goroutine 81 [running]:
github.com/xtls/xray-core/proxy/loopback.(*Loopback).Process.func1()
        github.com/xtls/xray-core/proxy/loopback/loopback.go:50 +0x198
github.com/xtls/xray-core/common/retry.(*retryer).On(0xc0004e4d18, 0xc0004e4d50)
        github.com/xtls/xray-core/common/retry/retry.go:27 +0xc3
github.com/xtls/xray-core/proxy/loopback.(*Loopback).Process(0xc0004343c0, {0x1a7d1c0, 0xc0004141b0}, 0xc0079f0000, {0x159eae0?, 0xc00011b680?})
        github.com/xtls/xray-core/proxy/loopback/loopback.go:40 +0x314
github.com/xtls/xray-core/app/proxyman/outbound.(*Handler).Dispatch(0xc0004db5f0, {0x1a7d1c0, 0xc000414000}, 0xc0079f0000)
        github.com/xtls/xray-core/app/proxyman/outbound/handler.go:242 +0x992
created by github.com/xtls/xray-core/app/proxyman/outbound.(*Handler).Dial in goroutine 53
        github.com/xtls/xray-core/app/proxyman/outbound/handler.go:289 +0xe30

[dansean]

不崩溃了
但是 想问下：
Socks 出站通过 proxySettings 到 Loopback 出站。这是不支持的吗？

Xray 26.2.6 (Xray, Penetrates Everything.) 5f7b2ca (go1.26.1 linux/amd64)

{
  "outbounds": [
    {
      "tag": "direct",
      "protocol": "freedom"
    },
    {
      "tag": "block",
      "protocol": "blackhole",
      "settings": {
        "response": {
          "type": "http"
        }
      }
    },
    {
      "tag": "drop",
      "protocol": "blackhole"
    },
    {
      "tag": "Mullvad_loop",
      "protocol": "loopback",
      "settings": {
        "inboundTag": "loop-in"
      }
    },
...
    {
      "tag": "Mullvad_FI_HEL_201_socks",
      "protocol": "socks",
      "settings": {
        "address": "10.124.0.155",
        "port": 1080
      },
      "proxySettings": {
        "tag": "Mullvad_loop",
        "transportLayer": false
      }
    }
...
  ]
}

{
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "ruleTag": "api_rule",
        "inboundTag": [
          "api_in"
        ],
        "outboundTag": "api"
      },
      {
        "ruleTag": "metrics_rule",
        "inboundTag": [
          "metrics_in"
        ],
        "outboundTag": "metrics"
      },
      {
        "ruleTag": "loop_rule",
        "inboundTag": [
          "loop_in"
        ],
        "outboundTag": "Mullvad_US_LAX_Tzulo_002"
      }........

curl http://127.0.0.1:8062/debug/vars |jq :

 "observatory": {
    "Mullvad_FI_HEL_201_socks": {
      "outbound_tag": "Mullvad_FI_HEL_201_socks",
      "health_ping": {
        "all": 1,
        "fail": 1
      }
    },
    "Mullvad_FI_HEL_202_US_LAX_Tzulo_002": {
      "alive": true,
      "delay": 1072,
      "outbound_tag": "Mullvad_FI_HEL_202_US_LAX_Tzulo_002",
      "health_ping": {
        "all": 3,
        "deviation": 517387101,
        "average": 1072974925,
        "max": 1778255007,
        "min": 551606926
      }
    },
.......
      },
      "Mullvad_loop": {
        "downlink": 0,
        "uplink": 0
      },
      "block": {
        "downlink": 0,
        "uplink": 0
      },
      "direct": {
        "downlink": 3962,
        "uplink": 900
      },
.....

error.log:

2026/03/22 21:45:43.688478 [Info] transport/internet/tcp: dialing TCP to tcp:10.124.0.155:1080
2026/03/22 21:45:49.753049 [Info] transport/internet/tcp: dialing TCP to tcp:10.124.0.155:1080
2026/03/22 21:45:53.671466 [Info] transport/internet/tcp: dialing TCP to tcp:10.124.0.155:1080
2026/03/22 21:45:59.369495 [Info] transport/internet/udp: failed to handle UDP input > io: read/write on closed pipe
2026/03/22 21:45:59.989618 [Info] transport/internet/tcp: dialing TCP to tcp:10.124.0.155:1080
2026/03/22 21:46:06.159159 [Info] app/proxyman/outbound: app/proxyman/outbound: failed to process outbound traffic > proxy/freedom: failed to open connection to tcp:10.124.0.155:1080 > common/retry: [dial tcp 10.124.0.155:1080: i/o timeout] > common/retry: all retry attempts failed
2026/03/22 21:46:09.775363 [Info] transport/internet/tcp: dialing TCP to tcp:10.124.0.155:1080
2026/03/22 21:46:16.396354 [Info] app/proxyman/outbound: app/proxyman/outbound: failed to process outbound traffic > proxy/freedom: failed to open connection to tcp:10.124.0.155:1080 > common/retry: [dial tcp 10.124.0.155:1080: i/o timeout] > common/retry: all retry attempts failed
2026/03/22 21:46:25.985884 [Info] transport/internet/tcp: dialing TCP to tcp:10.124.0.155:1080
2026/03/22 21:46:37.160365 [Info] app/dispatcher: taking platform initialized detour [Mullvad_FI_HEL_201_socks] for [tcp:www.google.com:443]
2026/03/22 21:46:37.160671 [Info] proxy/loopback: opening connection to tcp:10.124.0.155:1080
2026/03/22 21:46:37.161042 [Info] app/dispatcher: default route for tcp:10.124.0.155:1080
2026/03/22 21:46:37.161069 [Info] transport/internet/tcp: dialing TCP to tcp:10.124.0.155:1080
2026/03/22 21:46:42.171619 [Warning] app/observatory/burst: error ping https://www.google.com/generate_204 with Mullvad_FI_HEL_201_socks: Head "https://www.google.com/generate_204": context deadline exceeded (Client.Timeout exceeded while awaiting headers)

没有数据通过，outboundTag 和 balancerTag 都不行

[RPRX]

所以我感觉 #5710 (comment) 是另一个问题，@Fangliding 你看看

[RPRX]

@dansean 你试试 sockopt dialer-proxy 吧

@Fangliding 要不把 outbound 的 proxySettings 配置项和相关代码删了吧，现在没必要兼容这个了

[dansean]

@dansean 你试试 sockopt dialer-proxy 吧

@Fangliding 要不把 outbound 的 proxySettings 配置项和相关代码删了吧，现在没必要兼容这个了

修改后结果是一样的。

......
    {
      "tag": "Mullvad_FI_HEL_201_socks",
      "protocol": "socks",
      "settings": {
        "address": "10.124.0.155",
        "port": 1080
      },
      "streamSettings": {
        "sockopt": {
          "dialerProxy": "Mullvad_loop"
        }
      }
    }
  ]
}

error.log:

2026/03/23 10:38:12.748836 [Info] [1048072538] app/dispatcher: Hit route rule: [metrics_rule] so taking detour [metrics] for [tcp:127.0.0.1:8062]
2026/03/23 10:38:13.306485 [Info] transport/internet/tcp: dialing TCP to tcp:10.124.0.155:1080
2026/03/23 10:38:13.509380 [Info] transport/internet/tcp: dialing TCP to tcp:10.124.0.155:1080
2026/03/23 10:38:29.825582 [Info] transport/internet/tcp: dialing TCP to tcp:10.124.0.155:1080
2026/03/23 10:38:46.231210 [Info] app/proxyman/outbound: app/proxyman/outbound: failed to process outbound traffic > proxy/freedom: failed to open connection to tcp:10.124.0.155:1080 > common/retry: [dial tcp 10.124.0.155:1080: i/o timeout dial tcp 10.124.0.155:1080: connect: network is unreachable dial tcp 10.124.0.155:1080: i/o timeout] > common/retry: all retry attempts failed

curl http://127.0.0.1:8062/debug/vars |jq :

......
  "observatory": {
    "Mullvad_FI_HEL_201_socks": {
      "outbound_tag": "Mullvad_FI_HEL_201_socks",
      "health_ping": {
        "all": 3,
        "fail": 3
      }
    },
......