I tracked down the path, which is confirmed by this trace. From the logs can be seen that it is just next chunk in memory.

Can you send the output from gdb of:

frame 2
p *f

Daniel

On 20/10/14 12:16, 张顺通 wrote:
4.2.0  have a core

#0  0x00007ffff7488265 in raise () from /lib64/libc.so.6
No symbol table info available.
#1  0x00007ffff7489d10 in abort () from /lib64/libc.so.6
No symbol table info available.
#2  0x0000000000615b74 in qm_debug_frag (qm=0x7ffff6c55010, f=0x7ffff6cdcf08) at mem/q_malloc.c:161
        __FUNCTION__ = "qm_debug_frag"
#3  0x0000000000616d87 in qm_malloc (qm=0x7ffff6c55010, size=56, file=0x7ffff5fedef8 "<core>: db_res.c", func=0x7ffff5fee288 "db_new_result", line=112)
    at mem/q_malloc.c:388
        f = 0x7ffff6cdcf08
        hash = 2057
        list_cntr = 1
        __FUNCTION__ = "qm_malloc"
#4  0x00007ffff5fdaa2f in db_new_result () at db_res.c:112
        r = 0x0
        __FUNCTION__ = "db_new_result"
#5  0x00007ffff6a386d6 in db_mysql_new_result () at km_res.c:235
        obj = 0x0
        __FUNCTION__ = "db_mysql_new_result"
#6  0x00007ffff6a29c7a in db_mysql_store_result (_h=0x7ffff6cb4e78, _r=0x7fffffffdf38) at km_dbase.c:227
        code = -165731152
        __FUNCTION__ = "db_mysql_store_result"
#7  0x00007ffff5fd3516 in db_do_query_internal (_h=0x7ffff6cb4e78, _k=0x7fffffffdf70, _op=0x0, _v=0x7fffffffdf40, _c=0x7fffffffdf60, _n=1, _nc=1, _o=0x0,
    _r=0x7fffffffdf38, val2str=0x7ffff6a39374 <db_mysql_val2str>, submit_query=0x7ffff6a2825c <db_mysql_submit_query>,
    store_result=0x7ffff6a2998c <db_mysql_store_result>, _l=0) at db_query.c:137
        tmp = 32767
        off = 63
        ret = 23
        __FUNCTION__ = "db_do_query_internal"
#8  0x00007ffff5fd3fbd in db_do_query (_h=0x7ffff6cb4e78, _k=0x7fffffffdf70, _op=0x0, _v=0x7fffffffdf40, _c=0x7fffffffdf60, _n=1, _nc=1, _o=0x0, _r=0x7fffffffdf38,
    val2str=0x7ffff6a39374 <db_mysql_val2str>, submit_query=0x7ffff6a2825c <db_mysql_submit_query>, store_result=0x7ffff6a2998c <db_mysql_store_result>)
    at db_query.c:156
No locals.
#9  0x00007ffff6a2b04e in db_mysql_query (_h=0x7ffff6cb4e78, _k=0x7fffffffdf70, _op=0x0, _v=0x7fffffffdf40, _c=0x7fffffffdf60, _n=1, _nc=1, _o=0x0, _r=0x7fffffffdf38)
    at km_dbase.c:323
No locals.
#10 0x00007ffff5fcd6e9 in db_table_version (dbf=0x7ffff2d1e3c0, connection=0x7ffff6cb4e78, table=0x7ffff2d1d990) at db.c:400
        key = {0x7fffffffdf20}
        col = {0x7fffffffdf10}
        val = {{type = DB1_STR, nul = 0, free = -167987365, val = {int_val = -223246127, ll_val = 140737265109201, double_val = 6.9533447780108125e-310,
              time_val = 140737265109201, string_val = 0x7ffff2b188d1 "dispatcher", str_val = {s = 0x7ffff2b188d1 "dispatcher", len = 10}, blob_val = {s = 0x7ffff2b188d1 "dispatcher", len = 10}, bitmap_val = 4071721169}}}
        res = 0x0
        ver = 0x0
        version = 0x9c7be0
        tmp1 = {s = 0x7ffff5feb0e1 "table_name", len = 10}
        tmp2 = {s = 0x7ffff5feb0ec "table_version", len = 13}
        ret = 8
        __FUNCTION__ = "db_table_version"
#11 0x00007ffff2aeab2f in init_ds_db () at dispatch.c:666
        ret = 297
        __FUNCTION__ = "init_ds_db"
#12 0x00007ffff2b04434 in mod_init () at dispatcher.c:317
        avp_spec = {type = 48, getf = 0x7fffffffe190, setf = 0x7fffffffe0d0, pvp = {pvn = {type = 16, nfree = 0x3000000028, u = {isname = {type = -7760, name = {
                    n = 7292328, s = {s = 0x6f45a8 "DEBUG", len = 7555677}, re = 0x6f45a8}}, dname = 0x3ffffe1b0}}, pvi = {type = 7555621, u = {ival = -223246127,
                dval = 0x7ffff2b188d1}}}, trans = 0x0}
        __FUNCTION__ = "mod_init"
#13 0x000000000058f59d in init_mod (m=0x7ffff6cb3740) at sr_module.c:966
        __FUNCTION__ = "init_mod"
#14 0x000000000058f8a2 in init_modules () at sr_module.c:995
        t = 0x7ffff77ac500
        i = 1187628493
        __FUNCTION__ = "init_modules"
#15 0x00000000004aa2b0 in main (argc=5, argv=0x7fffffffe528) at main.c:2501
        cfg_stream = 0xa94020
        c = -1
        r = 32767
        tmp = 0x7ffff7ffd000 ""
        tmp_len = 32767
        port = -7008
        proto = 32767
        options = 0x7023e0 ":f:cm:M:dVIhEeb:l:L:n:vKrRDTN:W:w:t:u:g:P:G:SQ:O:a:A:"
        ret = -1
        seed = 39348307
        rfd = 8
        debug_save = 0
        debug_flag = 0
        dont_fork_cnt = 0
        n_lst = 0xf0b2ff
        p = 0xbf <Address 0xbf out of bounds>
        __FUNCTION__ = "main"

2014-10-20 18:11 GMT+08:00 Daniel-Constantin Mierla <miconda@gmail.com>:
What are the differences between the server that works and the one that doesn't? I mean hardware and operating system details?

Checking quickly the source code and comparing with logs, it doesn't reveal any problem -- it is about allocation of the next fragment, which was not used at all before, after the one allocated previously. The only reason I can think of it right now is corrupted memory or faulty OS.

Daniel


On 20/10/14 11:56, 张顺通 wrote:
4.2 have the same problem.
at begin i use 4.1, i think this is a bug in 4.1;  then i use 4.2 to check to see if the problem is solved. problems still in.

see ka_4_2_0.log

2014-10-20 17:48 GMT+08:00 张顺通 <shuntongzhang@gmail.com>:
ka.log is genrate by kamailio 4.1.6.

2014-10-20 17:44 GMT+08:00 Daniel-Constantin Mierla <miconda@gmail.com>:
Are you using 4.1 or 4.2?

Because the subject mentioned 4.2 but the version of kamailio is 4.1

Daniel

On 20/10/14 11:39, 张顺通 wrote:
> -M 12 can not help. all config is same.
>
> see ka.log in attachment, kamailio version is 4.1.6
>
> version: kamailio 4.1.6 (x86_64/linux) 010d57
>
> flags: STATS: Off, USE_TCP, USE_TLS, TLS_HOOKS, USE_RAW_SOCKS,
> DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC,
> DBG_QM_MALLOC, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE,
> USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES
>
> ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16,
> MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 4MB
>
> poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
>
> id: 010d57
>
> compiled on 16:48:03 Oct 20 2014 with gcc 4.1.2
>
>




-- 
Daniel-Constantin Mierla
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda


-- 
Daniel-Constantin Mierla
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda