[sr-dev] Re: [kamailio/kamailio] uac_req_send crash Kamailio (Issue #3522)

Here is the full backtrace: GNU gdb (Ubuntu 12.1-0ubuntu1~22.04) 12.1 Copyright (C) 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/local/sbin/kamailio... warning: Can't open file /dev/zero (deleted) during file-backed mapping note processing [New LWP 4110362] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/usr/local/sbin/kamailio -P /var/run/kamailio/kamailio.pid -f /etc/kamailio/kam'. Program terminated with signal SIGABRT, Aborted. #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140359291291456) at ./nptl/pthread_kill.c:44 44 ./nptl/pthread_kill.c: No such file or directory. (gdb) bt full #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140359291291456) at ./nptl/pthread_kill.c:44 tid = <optimized out> ret = 0 pd = 0x7fa7f1b2c740 old_mask = {__val = {528280977419, 1438814044166, 0, 0, 93910694406720, 6483051068034487040, 5529999408, 18446744073709551488, 4, 6483051068034487040, 1, 18446744073709551488, 4, 21, 1, 93910688023664}} ret = <optimized out> pd = <optimized out> old_mask = <optimized out> ret = <optimized out> tid = <optimized out> ret = <optimized out> resultvar = <optimized out> resultvar = <optimized out> __arg3 = <optimized out> __arg2 = <optimized out> __arg1 = <optimized out> _a3 = <optimized out> _a2 = <optimized out> _a1 = <optimized out> __futex = <optimized out> resultvar = <optimized out> __arg3 = <optimized out> __arg2 = <optimized out> __arg1 = <optimized out> _a3 = <optimized out> _a2 = <optimized out> _a1 = <optimized out> __futex = <optimized out> __private = <optimized out> __oldval = <optimized out> result = <optimized out> #1 __pthread_kill_internal (signo=6, threadid=140359291291456) at ./nptl/pthread_kill.c:78 No locals. #2 __GI___pthread_kill (threadid=140359291291456, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 No locals. #3 0x00007fa7f1b71476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 ret = <optimized out> #4 0x00007fa7f1b577f3 in __GI_abort () at ./stdlib/abort.c:79 save_stage = 1 act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {11204472, 4646408, 5572744, 140358732006944, 140358731771904, 47, 6483051068034487040, 140724813621040, 6483051068034487040, 0, 93910686282567, 93910688017824, 93910688018232, 140358743675984, 6483051068034487040, 0}}, sa_flags = 1228091018, sa_restorer = 0x0} sigs = {__val = {32, 6483051068034487040, 140724813621104, 93910686336197, 1701480744, 337218937, 93910687653044, 0, 93910688018058, 140358731771904, 44, 21474838579, 93909459927052, 140358720490894, 1284195221895, 0}} #5 0x000055694918b36e in qm_debug_check_frag (qm=0x7fa7d0593000, f=0x7fa7d10ed450, file=0x7fa7cf3365f4 "uac: uac_send.c", line=860, efile=0x556949332db9 "core/mem/q_malloc.c", eline=511) at core/mem/q_malloc.c:129 p = 0x7fa7f0c99f58 __func__ = "qm_debug_check_frag" #6 0x000055694918fbe4 in qm_free (qmp=0x7fa7d0593000, p=0x7fa7d10ed488, file=0x7fa7cf3365f4 "uac: uac_send.c", func=0x7fa7cf3373d0 <__func__.2> "uac_send_tm_callback", line=860, mname=0x7fa7cf3364d4 "uac") at core/mem/q_malloc.c:511 qm = 0x7fa7d0593000 f = 0x7fa7d10ed450 size = 89856 next = 0x7fa7d10e5658 prev = 0x7fa7d10cf6f0 __func__ = "qm_free" #7 0x000055694919b9aa in qm_shm_free (qmp=0x7fa7d0593000, p=0x7fa7d10ed488, file=0x7fa7cf3365f4 "uac: uac_send.c", func=0x7fa7cf3373d0 <__func__.2> "uac_send_tm_callback", line=860, mname=0x7fa7cf3364d4 "uac") at core/mem/q_malloc.c:1350 No locals. #8 0x00007fa7cf32b331 in uac_send_tm_callback (t=0x7fa7d11592f0, type=131072, ps=0x7ffd0c86f5d0) at uac_send.c:860 ret = 11203376 hdr = 0x55694919883f <qm_info+50> response = "\220\354\206\f\375\177\000\000@R\324\361\247\177\000\000@u\233IiU\000\000\b\000\000\000\000\000\000\000i" new_auth_hdr = 0x0 auth = {flags = 0, realm = {s = 0x0, len = 0}, domain = {s = 0x0, len = 0}, nonce = {s = 0x0, len = 0}, opaque = {s = 0x0, len = 0}, qop = {s = 0x0, len = 0}, nc = 0x0, cnonce = 0x0} cred = {realm = {s = 0x7fa7f0e15060 "\370\002", len = -256724976}, user = {s = 0x7ffd0c86ead0 "", len = -810742386}, passwd = {s = 0x7fa7f0b2d9e0 "", len = 0}, aflags = 16777216, next = 0xaaf1a8} b_hdrs = "h\221\320\361\247\177\000\000\312O\272\361\247\177\000\000ȆV\000\000\000\000\000e\221\320\361\247\177\000\000\000\000\000\000\060\000\000\000\300\362\206\f\375\177\000\000\340\361\206\f\375\177\000\000\000\000\000\000iU\000\000h\r\000\000\000\000\000\000 \260\262\360\005\000\000\000\000\000\000\000\247\177", '\000' <repeats 14 times>, "\375\177\000\000\000\000\000\000\000\000\000\000\n\000\000\000\247\177\000\000f\221\320\361\247\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\377\377\377\377\377\377\377\377lλ\361\247\177\000\000~D3IiU", '\000' <repeats 18 times>, "@R\324\361\247\177\000\000@u\233IiU\000\000\314\000\000\000\000\000\000\000"... s_hdrs = {s = 0x7ffd0c86ea90 "", len = -256724976} uac_r = {method = 0x0, headers = 0x549332db4, body = 0x7ffd0c86ec00, ssock = 0x59f86c9900000000, ssockname = 0x7ffd0c86ec00, dialog = 0x55694918e87e <qm_malloc+2777>, cb_flags = -253670144, cb = 0x7fa7f0b2b010, cbp = 0x7fa7cfeb4a6c, callid = 0x4acfad0d8e} tmdlg = {id = {call_id = {s = 0x7fa7cfeb4b70 <__func__.5> "dupl_string_name", len = -806663567}, rem_tag = {s = 0x10 <error: Cannot access memory at address 0x10>, len = -256724976}, loc_tag = {s = 0x46e6c8 <error: Cannot access memory at address 0x46e6c8>, len = -794453264}}, loc_seq = {value = 1, is_set = 0 '\000'}, rem_seq = {value = 1228090809, is_set = 105 'i'}, loc_uri = {s = 0x7fa7f0b2b010 "\001", len = -253669400}, rem_uri = {s = 0x7ffd0c86ebc0 "", len = -256724976}, rem_target = {s = 0x7fa7f0e14e10 "H\005", len = -256724976}, dst_uri = {s = 0x7ffd0c86ec00 "'\002", len = -810742386}, loc_dname = {s = 0x7fa7f0b2fa40 "", len = 0}, rem_dname = {s = 0x1000000 <error: Cannot access memory at address 0x1000000>, len = 48861952}, secure = 128 '\200', state = DLG_NEW, route_set = 0x7fa7d0a59af0, hooks = {ru = {s = 0x0, len = 1227726035}, nh = {s = 0x32 <error: Cannot access memory at address 0x32>, len = 1228090809}, request_uri = 0x18d00000227, next_hop = 0x55694919883f <qm_info+50>, first_route = 0x7ffd0c86ec50, last_route = 0x7fa7f0b2b010}, send_sock = 0x7fa7f0bf60eb} tp = 0x7fa7d10ed488 __func__ = "uac_send_tm_callback" #9 0x00007fa7cf9bb79c in run_trans_callbacks_internal (cb_lst=0x7fa7d1159398, type=131072, trans=0x7fa7d11592f0, params=0x7ffd0c86f5d0) at t_hooks.c:241 cbp = 0x7fa7d109e778 backup_xd = {uri_avps_from = 0x55694947b080 <def_list>, uri_avps_to = 0x55694947b088 <def_list+8>, user_avps_from = 0x55694947b090 <def_list+16>, user_avps_to = 0x55694947b098 <def_list+24>, domain_avps_from = 0x55694947b0a0 <def_list+32>, domain_avps_to = 0x55694947b0a8 <def_list+40>, xavps_list = 0x55694947b1d8 <_xavp_list_head>, xavus_list = 0x55694947b1e0 <_xavu_list_head>, xavis_list = 0x55694947b1e8 <_xavi_list_head>} --Type <RET> for more, q to quit, c to continue without paging-- c __func__ = "run_trans_callbacks_internal" #10 0x00007fa7cf9bb893 in run_trans_callbacks (type=131072, trans=0x7fa7d11592f0, req=0x0, rpl=0x0, code=0) at t_hooks.c:261 params = {req = 0x0, rpl = 0x0, param = 0x7fa7d109e788, code = 0, flags = 0, branch = 0, t_rbuf = 0x0, dst = 0x0, send_buf = {s = 0x0, len = 0}} #11 0x00007fa7cf95ffde in free_cell_helper (dead_cell=0x7fa7d11592f0, silent=0, fname=0x7fa7cfa86442 "timer.c", fline=653) at h_table.c:165 b = 0x0 i = 1 rpl = 0x7ffd0c86f6f0 tt = 0x1 foo = 0x0 cbs = 0x7fa7d083df40 cbs_tmp = 0x7fa7cf95da29 <futex_get+40> __func__ = "free_cell_helper" #12 0x00007fa7cf9c2796 in wait_handler (ti=867279095, wait_tl=0x7fa7d11593a8, data=0x7fa7d11592f0) at timer.c:653 p_cell = 0x7fa7d11592f0 ret = 0 unlinked = 0 rcount = 1 __func__ = "wait_handler" #13 0x000055694914ccc3 in timer_list_expire (t=867279095, h=0x7fa7d0611b38, slow_l=0x7fa7d0612ac0, slow_mark=8405) at core/timer.c:857 tl = 0x7fa7d11593a8 ret = 0 #14 0x000055694914d20d in timer_handler () at core/timer.c:922 saved_ticks = 867279095 run_slow_timer = 0 i = 213 __func__ = "timer_handler" #15 0x000055694914d743 in timer_main () at core/timer.c:961 No locals. #16 0x0000556948e53fcb in main_loop () at main.c:1833 i = 8 pid = 0 si = 0x0 si_desc = "udp receiver child=7 sock=127.0.0.1:5060\000\065\060\066\060\000\000\000\004\000\000\000\062\000\000\000\000\223\351\002\231l\370Y@P\350\361\247\177\000\000\210\060,IiU\000\000\000\000\000\000\000\000\000\000Ӝ-IiU\000\000\062\000\000\000\000\000\000\000\360\325\304\361\247\177\000\000\360\372\206\f\375\177\000\000\000j\002IiU\000" nrprocs = 8 woneinit = 1 __func__ = "main_loop" #17 0x0000556948e5f614 in main (argc=14, argv=0x7ffd0c870068) at main.c:3086 cfg_stream = 0x556949855380 c = -1 r = 0 tmp = 0x7ffd0c870814 "" tmp_len = 37 port = 0 proto = -236668592 ahost = 0x0 aport = 0 options = 0x5569492c6268 ":f:cm:M:dVIhEeb:l:L:n:vKrRDTN:W:w:t:u:g:P:G:SQ:O:a:A:x:X:Y:" ret = -1 seed = 1551333326 rfd = 4 debug_save = 0 debug_flag = 0 dont_fork_cnt = 0 n_lst = 0x7ffd0c86fcc0 p = 0x7fa7f1b4af7a "_dl_audit_preinit" st = {st_dev = 25, st_ino = 4629, st_nlink = 2, st_mode = 16873, st_uid = 1002, st_gid = 1002, __pad0 = 0, st_rdev = 0, st_size = 80, st_blksize = 4096, st_blocks = 0, st_atim = {tv_sec = 1701353239, tv_nsec = 334017865}, st_mtim = {tv_sec = 1701472337, tv_nsec = 891030255}, st_ctim = {tv_sec = 1701472337, tv_nsec = 891030255}, __glibc_reserved = {0, 0, 0}} tbuf = "\000\000\000\000\000\000\000\000\r\000\000\000\000\000\000\000`\226\344\361\247\177\000\000\270\201\324\361\247\177\000\000\311X\345HiU\000\000H':IiU\000\000@P\350\361\247\177\000\000q\337\345\361\247\177\000\000\001", '\000' <repeats 15 times>, "\b\271\344\361\247\177\000\000`f\346\361\247\177\000\000\000\000\000\000\000\000\000\000\340\377\206\f\375\177\000\000\016\000\000\000\000\000\000\000h\000\207\f\375\177\000\000\311X\345HiU\000\000'\f\346\361\247\177\000\000\000\000\000\000\000\000\000\000H':IiU\000\000\340\000\207\f\375\177\000\000\000\000\000\000\000\000\000\000\340b\350\361\247\177\000\000\020\237\324\361\247\177\000\000@\020\345\361\247\177\000\000"... option_index = 12 long_options = {{name = 0x5569492c86a6 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x5569492c3514 "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x5569492c86ab "alias", has_arg = 1, flag = 0x0, val = 1024}, {name = 0x5569492c86b1 "subst", has_arg = 1, flag = 0x0, val = 1025}, {name = 0x5569492c86b7 "substdef", has_arg = 1, flag = 0x0, val = 1026}, {name = 0x5569492c86c0 "substdefs", has_arg = 1, flag = 0x0, val = 1027}, {name = 0x5569492c86ca "server-id", has_arg = 1, flag = 0x0, val = 1028}, {name = 0x5569492c86d4 "loadmodule", has_arg = 1, flag = 0x0, val = 1029}, {name = 0x5569492c86df "modparam", has_arg = 1, flag = 0x0, val = 1030}, {name = 0x5569492c86e8 "log-engine", has_arg = 1, flag = 0x0, val = 1031}, {name = 0x5569492c86f3 "debug", has_arg = 1, flag = 0x0, val = 1032}, {name = 0x5569492c86f9 "cfg-print", has_arg = 0, flag = 0x0, val = 1033}, {name = 0x5569492c8703 "atexit", has_arg = 1, flag = 0x0, val = 1034}, {name = 0x5569492c870a "all-errors", has_arg = 0, flag = 0x0, val = 1035}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} __func__ = "main" -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/3522#issuecomment-1838023565 You are receiving this because you are subscribed to this thread. Message ID: &lt;kamailio/kamailio/issues/3522/1838023565(a)github.com&gt;