7 Nov
2024
7 Nov
'24
8:13 p.m.
### Description
Kamailio service crashed occasionally on `sock_cb` callback function of
`http_async_client` module
#### Reproduction
The crash happens occasionally, no specific conditions have been identified for this
issue.
#### Debugging Data
```
Program terminated with signal SIGSEGV, Segmentation fault.
(gdb) bt full
#0 0x0000ffff9f4205e4 in event_del_ () from /lib64/libevent-2.1.so.6
No symbol table info available.
#1 0x0000ffff9e7c9b24 in sock_cb (e=0xffffa2027ba8, s=9, what=4, cbp=0xffffa1c0fe58,
sockp=0xffffa202d258) at http_multi.c:166
g = 0xffffa1c0fe58
cell = 0xffffa202d258
whatstr = {0xffff9e7eb508 "none", 0xffff9e7eb510 "IN",
0xffff9e7eb518 "OUT", 0xffff9e7eb520 "INOUT", 0xffff9e7eb528
"REMOVE"}
__func__ = "sock_cb"
#2 0x0000ffff9e73ffa8 in Curl_multi_closed () from /lib64/libcurl.so.4
No symbol table info available.
#3 0x0000ffff9e73d43c in Curl_closesocket () from /lib64/libcurl.so.4
No symbol table info available.
#4 0x0000ffff9e72c8f8 in conn_free.part () from /lib64/libcurl.so.4
No symbol table info available.
#5 0x0000ffff9e72d544 in Curl_disconnect () from /lib64/libcurl.so.4
No symbol table info available.
#6 0x0000ffff9e740948 in multi_done () from /lib64/libcurl.so.4
No symbol table info available.
#7 0x0000ffff9e742b10 in curl_multi_remove_handle () from /lib64/libcurl.so.4
No symbol table info available.
#8 0x0000ffff9e7c7f2c in event_cb (fd=59, kind=1, userp=0xffffa2027ba8) at
http_multi.c:123
error = 0xffff9e7eac70 "TIMEOUT"
g = 0xffffa1c0fe58
rc = 1968268110
easy = 0xffffa2027ba8
cell = 0xffffa202d258
__func__ = "event_cb"
action = 0
#9 0x0000ffff9f423628 in event_process_active_single_queue () from
/lib64/libevent-2.1.so.6
No symbol table info available.
#10 0x0000ffff9f423ee8 in event_base_loop () from /lib64/libevent-2.1.so.6
No symbol table info available.
#11 0x0000ffff9e7b7160 in async_http_run_worker (worker=0xffffa1606ed8) at
async_http.c:95
ret = 65535
__func__ = "async_http_run_worker"
#12 0x0000ffff9e7dc364 in child_init (rank=0) at http_async_client_mod.c:380
pid = 0
i = 0
__func__ = "child_init"
#13 0x0000000000607fa8 in init_mod_child (m=0xffffb136c2f0, rank=0) at
core/sr_module.c:899
--Type <RET> for more, q to quit, c to continue without paging--
ret = 0
__func__ = "init_mod_child"
#14 0x0000000000607b38 in init_mod_child (m=0xffffb136d018, rank=0) at
core/sr_module.c:892
ret = 0
__func__ = "init_mod_child"
#15 0x0000000000607b38 in init_mod_child (m=0xffffb136ead0, rank=0) at
core/sr_module.c:892
ret = 0
__func__ = "init_mod_child"
#16 0x0000000000607b38 in init_mod_child (m=0xffffb13a98f8, rank=0) at
core/sr_module.c:892
ret = 0
__func__ = "init_mod_child"
#17 0x0000000000607b38 in init_mod_child (m=0xffffb140ab28, rank=0) at
core/sr_module.c:892
ret = 0
__func__ = "init_mod_child"
#18 0x0000000000607b38 in init_mod_child (m=0xffffb145ebf8, rank=0) at
core/sr_module.c:892
ret = 1
__func__ = "init_mod_child"
#19 0x00000000006089c4 in init_child (rank=0) at core/sr_module.c:953
ret = -783429656
type = 0x923dc0 "PROC_MAIN"
__func__ = "init_child"
#20 0x0000000000433030 in main_loop () at main.c:1843
i = 8
pid = 2823204
si = 0x0
si_desc = "udp receiver child=7
sock=[2605:84c0:48:205:1::6]:5080\000\000\220\036ٰ\377\377\000\000
\321M\321\377\377\000\000h\220\066\261\377\377\000\000\320\377\377\377\200\377\377\377\020\321M\321\377\377\000\000
\321M\321\377\377\000\000
\321M\321\377\377\000\000\360\320M\321\377\377\000\000\320\377\377\377\200\377\377\377"
nrprocs = 8
woneinit = 1
__func__ = "main_loop"
#21 0x000000000043f4e8 in main (argc=11, argv=0xffffd14dd6a8) at main.c:3086
cfg_stream = 0xc2502a0
c = -1
r = 0
tmp = 0xffffd14dfe34 ""
tmp_len = 0
port = 0
proto = 65535
ahost = 0x0
--Type <RET> for more, q to quit, c to continue without paging--
aport = 0
options = 0x8e7c08
":f:cm:M:dVIhEeb:l:L:n:vKrRDTN:W:w:t:u:g:P:G:SQ:O:a:A:x:X:Y:"
ret = -1
seed = 203142350
rfd = 4
debug_save = 0
debug_flag = 0
dont_fork_cnt = 2
n_lst = 0xffffffff
p = 0xffffb3d34348 <__libc_start_main+160> ""
st = {st_dev = 25, st_ino = 18459, st_mode = 16877, st_nlink = 3, st_uid = 0,
st_gid = 987, st_rdev = 0, __pad1 = 0, st_size = 80, st_blksize = 65536,
__pad2 = 0, st_blocks = 0, st_atim = {tv_sec = 1707863213, tv_nsec = 9999979},
st_mtim = {tv_sec = 1729635590, tv_nsec = 702238079}, st_ctim = {
tv_sec = 1729635598, tv_nsec = 32030431}, __glibc_reserved = {0, 0}}
tbuf = '\000' <repeats 56 times>,
"x\376\b\264\377\377\000\000h\376\b\264\377\377\000\000\b\376\b\264\377\377\000\000(\376\b\264\377\377\000\000\070\376\b\264\377\377\000\000\250\376\b\264\377\377\000\000\270\376\b\264\377\377\000\000\310\376\b\264\377\377\000\000H\376\b\264\377\377\000\000X\376\b\264\377\377",
'\000' <repeats 18 times>, "\330\375\b\264\377\377",
'\000' <repeats 42 times>...
option_index = 12
long_options = {{name = 0x8e9fe0 "help", has_arg = 0, flag = 0x0, val =
104}, {name = 0x8e4e48 "version", has_arg = 0, flag = 0x0, val = 118}, {
name = 0x8e9fe8 "alias", has_arg = 1, flag = 0x0, val = 1024}, {name
= 0x8e9ff0 "subst", has_arg = 1, flag = 0x0, val = 1025}, {name = 0x8e9ff8
"substdef",
has_arg = 1, flag = 0x0, val = 1026}, {name = 0x8ea008 "substdefs",
has_arg = 1, flag = 0x0, val = 1027}, {name = 0x8ea018 "server-id", has_arg = 1,
flag = 0x0, val = 1028}, {name = 0x8ea028 "loadmodule", has_arg = 1,
flag = 0x0, val = 1029}, {name = 0x8ea038 "modparam", has_arg = 1, flag = 0x0,
val = 1030}, {name = 0x8ea048 "log-engine", has_arg = 1, flag = 0x0,
val = 1031}, {name = 0x8ea058 "debug", has_arg = 1, flag = 0x0, val = 1032}, {
name = 0x8ea060 "cfg-print", has_arg = 0, flag = 0x0, val = 1033},
{name = 0x8ea070 "atexit", has_arg = 1, flag = 0x0, val = 1034}, {
name = 0x8ea078 "all-errors", has_arg = 0, flag = 0x0, val = 1035},
{name = 0x0, has_arg = 0, flag = 0x0, val = 0}}
__func__ = "main"
(gdb) f 8
#8 0x0000ffff9e7c7f2c in event_cb (fd=59, kind=1, userp=0xffffa2027ba8) at
http_multi.c:123
123 curl_multi_remove_handle(g->multi, easy);
(gdb) f 1
#1 0x0000ffff9e7c9b24 in sock_cb (e=0xffffa2027ba8, s=9, what=4, cbp=0xffffa1c0fe58,
sockp=0xffffa202d258) at http_multi.c:166
166 event_del(cell->ev);
(gdb) p cell
$1 = (struct http_m_cell *) 0xffffa202d258
(gdb) p cell->ev
$2 = (struct event *) 0x92fbf0
(gdb) p *cell->ev
$3 = {type = 1701998435, name = {s = 0x615f7273752f6572 <error: Cannot access memory at
address 0x615f7273752f6572>, len = 1663987830}, params = {hooks = {contact = {
expires = 0x7273752f65726f63, q = 0x632e7076615f, methods = 0x5b203e65726f633c,
received = 0x7273752f65726f63, instance = 0x393a632e7076615f,
reg_id = 0x203a5d32, ob = 0x6f6e20646c756f63, flags = 0x61636f6c6c612074}, uri =
{transport = 0x7273752f65726f63, lr = 0x632e7076615f, r2 = 0x5b203e65726f633c,
maddr = 0x7273752f65726f63, ttl = 0x393a632e7076615f, dstip = 0x203a5d32, dstport
= 0x6f6e20646c756f63, ftag = 0x61636f6c6c612074, ob = 0x6572616873206574},
event_dialog = {call_id = 0x7273752f65726f63, from_tag = 0x632e7076615f, to_tag =
0x5b203e65726f633c, include_session_description = 0x7273752f65726f63,
sla = 0x393a632e7076615f, ma = 0x203a5d32}}, list = 0x79726f6d656d2064}}
```
As it's seen in the stack backtrace the `cell` object is already released at the
moment when `event_del` with this object is called.
#### Log Messages
-
#### SIP Traffic
-
### Possible Solutions
-
### Additional Information
```
[centos@esrp-1b ~]$ kamailio -v
version: kamailio 5.7.2 (aarch64/linux) 968dbe
flags: USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST,
DNS_IP_HACK, SHM_MMAP, PKG_MALLOC, MEM_JOIN_FREE, Q_MALLOC, F_MALLOC, TLSF_MALLOC,
DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT-NOSMP, USE_DNS_CACHE, USE_DNS_FAILOVER,
USE_NAPTR, USE_DST_BLOCKLIST, HAVE_RESOLV_RES, TLS_PTHREAD_MUTEX_SHARED
ADAPTIVE_WAIT_LOOPS 1024, MAX_RECV_BUFFER_SIZE 262144, MAX_URI_SIZE 1024, BUF_SIZE 65535,
DEFAULT PKG_SIZE 8MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: 968dbe
compiled on 19:25:05 Nov 10 2023 with gcc 8.5.0
```
* **Operating System**:
```
[centos@esrp-1b ~]$ cat /etc/centos-release
CentOS Stream release 8
[centos@esrp-1b ~]$ uname -a
Linux esrp-1b.fl.base911.com 4.18.0-536.el8.aarch64 #1 SMP Thu Jan 18 15:21:54 UTC 2024
aarch64 aarch64 aarch64 GNU/Linux
```
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/4019
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/4019(a)github.com>