[kamailio/kamailio] tm core.when free ack cancel_buf. (#2321) - sr-dev

11 May 2020

### Description

wh have a too long 500msg,when the build ack,it abort

we use ka listen two port ,and use port 1 send port 2 after port2 send port1,it loop in
kamailio.cfg.its my wrong,but kamailio core....

### Troubleshooting

#### Debugging Data  this is core bt
#0  0x00002ae1c343c5f7 in raise () from /lib64/libc.so.6
#1  0x00002ae1c343dce8 in abort () from /lib64/libc.so.6
#2  0x000000000068155a in qm_debug_check_frag (qm=0x2ae1c8fb4000, f=0x2ae1c93bf558,
file=0x2ae1c4a1b9ff "tm: t_msgbuilder.c", line=518, efile=0x7f1ca7
"core/mem/q_malloc.c", 
    eline=504) at core/mem/q_malloc.c:139
#3  0x0000000000684bf5 in qm_free (qmp=0x2ae1c8fb4000, p=0x2ae1c93bf590,
file=0x2ae1c4a1b9ff "tm: t_msgbuilder.c", 
    func=0x2ae1c4a1fb50 <__FUNCTION__.11261> "build_local_reparse",
line=518, mname=0x2ae1c4a1aa30 "tm") at core/mem/q_malloc.c:504
#4  0x000000000068e83f in qm_shm_free (qmp=0x2ae1c8fb4000, p=0x2ae1c93bf590,
file=0x2ae1c4a1b9ff "tm: t_msgbuilder.c", 
    func=0x2ae1c4a1fb50 <__FUNCTION__.11261> "build_local_reparse",
line=518, mname=0x2ae1c4a1aa30 "tm") at core/mem/q_malloc.c:1268
#5  0x00002ae1c4951e76 in build_local_reparse (Trans=0x2ae1c94524d8, branch=0,
len=0x7ffe977ff370, method=0x2ae1c4a2399b "ACK", method_len=3,
to=0x7ffe977ff130, reason=0x0)
    at t_msgbuilder.c:518
#6  0x00002ae1c497336e in build_ack (rpl=0x2ae1c3d3bb08, trans=0x2ae1c94524d8, branch=0,
ret_len=0x7ffe977ff370) at t_reply.c:354
#7  0x00002ae1c4986066 in reply_received (p_msg=0x2ae1c3d3bb08) at t_reply.c:2292
#8  0x000000000053da31 in do_forward_reply (msg=0x2ae1c3d3bb08, mode=0) at
core/forward.c:748
#9  0x000000000053f5a9 in forward_reply (msg=0x2ae1c3d3bb08) at core/forward.c:853
#10 0x000000000059c633 in receive_msg (
    buf=0xa6ee20 <buf.6868> "SIP/2.0 500 Internal Server Error\r\nVia:
SIP/2.0/UDP 172.18.67.32;branch=z9hG4bK4301.6c6183869659ad37775254042e1ec6f4.0\r\nVia:
SIP/2.0/UDP 172.18.67.32;branch=z9hG4bK4301.a149a0620b507cd0ba760eeb1cd32b3"...,
len=27098, rcv_info=0x7ffe977ffae0) at core/receive.c:434
#11 0x000000000048e42c in udp_rcv_loop () at core/udp_server.c:541
#12 0x000000000042509d in main_loop () at main.c:1669
#13 0x000000000042c788 in main (argc=9, argv=0x7ffe97800028) at main.c:2710

(gdb) up
#1  0x00002ae1c343dce8 in abort () from /lib64/libc.so.6
(gdb) up
#2  0x000000000068155a in qm_debug_check_frag (qm=0x2ae1c8fb4000, f=0x2ae1c93bf558,
file=0x2ae1c4a1b9ff "tm: t_msgbuilder.c", line=518, efile=0x7f1ca7
"core/mem/q_malloc.c", 
    eline=504) at core/mem/q_malloc.c:139
139	core/mem/q_malloc.c: 没有那个文件或目录.
(gdb) up
#3  0x0000000000684bf5 in qm_free (qmp=0x2ae1c8fb4000, p=0x2ae1c93bf590,
file=0x2ae1c4a1b9ff "tm: t_msgbuilder.c", 
    func=0x2ae1c4a1fb50 <__FUNCTION__.11261> "build_local_reparse",
line=518, mname=0x2ae1c4a1aa30 "tm") at core/mem/q_malloc.c:504
504	in core/mem/q_malloc.c
(gdb) up
#4  0x000000000068e83f in qm_shm_free (qmp=0x2ae1c8fb4000, p=0x2ae1c93bf590,
file=0x2ae1c4a1b9ff "tm: t_msgbuilder.c", 
    func=0x2ae1c4a1fb50 <__FUNCTION__.11261> "build_local_reparse",
line=518, mname=0x2ae1c4a1aa30 "tm") at core/mem/q_malloc.c:1268
1268	in core/mem/q_malloc.c
(gdb) up
#5  0x00002ae1c4951e76 in build_local_reparse (Trans=0x2ae1c94524d8, branch=0,
len=0x7ffe977ff370, method=0x2ae1c4a2399b "ACK", method_len=3,
to=0x7ffe977ff130, reason=0x0)
    at t_msgbuilder.c:518
518	t_msgbuilder.c: 没有那个文件或目录.
(gdb) p cancel_buf
$1 = 0x2ae1c93bf590 "ACK sip:2002@172.18.67.42 SIP/2.0\r\n\253"
(gdb) p reason
$2 = (struct cancel_reason *) 0x0

#### Log Messages

[2020-05-11 11:10:27] (124796) INFO: <script>: IN_REPLY_PBX

[2020-05-11 11:10:27] (124796) INFO: <script>: IN_REPLY_PBX IN Call <null>:
Status 100 3001@172.18.67.42:5060 -----> 2002@172.18.67.32:5060

[2020-05-11 11:10:27] (124796) ERROR: tm [t_msgbuilder.c:516]: build_local_reparse():
HDR_EOH_T was not found

[2020-05-11 11:10:27] (124796) CRITICAL: <core> [core/mem/q_malloc.c:137]:
qm_debug_check_frag(): BUG: qm: fragm. 0x2ae1c93bf558 (address 0x2ae1c93bf590) end
overwritten (2e322f5049532032, ab0a0d30)! Memory allocator was called from tm:
t_msgbuilder.c:518. Fragment marked by tm: t_msgbuilder.c:345. Exec from
core/mem/q_malloc.c:504.

#### SIP Traffic

we use ka listen two port ,and use port 1 send port 2 after port2 send port1,it loop in
kamailio.cfg.its my wrong,but kamailio core....

### Possible Solutions
we see t_msgbuilder.c shm_free(cancel_buf); faild  ...

### Additional Information

version: kamailio 5.2.5 (x86_64/linux) 
flags: STATS: Off, USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE,
USE_MCAST, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, TLSF_MALLOC,
DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER,
USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144 MAX_URI_SIZE 1024, BUF_SIZE 65535,
DEFAULT PKG_SIZE 8MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: unknown 
compiled on 15:28:15 Nov  4 2019 with gcc 4.8.5

* **Operating System**:
CentOS Linux release 7.2.1511 (Core)
Linux localhost.localdomain 3.10.0-327.el7.x86_64 #1 SMP Thu Nov 19 22:10:57 UTC 2015
x86_64 x86_64 x86_64 GNU/Linux

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/2321