[OpenSIPS-Devel] Bug on shm_free - signal 6

[Daniel Zanutti]

Hi guys

My opensips 3.2.8 solution is crashing. I have a few coredumps, it's
related to the shm_free function. Could anyone take a look?

Program terminated with signal 6, Aborted.
#0  0x00007fd6de917387 in __GI_raise (sig=sig at entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:55
55        return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
(gdb) bt full
#0  0x00007fd6de917387 in __GI_raise (sig=sig at entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:55
        resultvar = 0
        pid = 8414
        selftid = 8414
#1  0x00007fd6de918a78 in __GI_abort () at abort.c:90
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x4500000041,
sa_sigaction = 0x4500000041}, sa_mask = {__val = {330712481865, 0, 0,
6788878094023649657, 0, 140724443393488, 140548035702611, 41343914,
7230172963329716224, 41518752,
              5618321, 336, 41528840, 6750717, 0, 2}}, sa_flags = 0,
sa_restorer = 0x9fb240 <shm_use_global_lock>}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x000000000055bcbe in fm_free (fm=<optimized out>, p=<optimized out>,
file=<optimized out>, func=<optimized out>, line=<optimized out>) at
mem/f_malloc_dyn.h:237
        f = <optimized out>
        n = <optimized out>
        __FUNCTION__ = "fm_free"
#3  0x00007fd3e050ec28 in _shm_free (file=<optimized out>,
function=<optimized out>, line=<optimized out>, ptr=<optimized out>) at
../../evi/../mem/shm_mem.h:448
No locals.
#4  free_dlg_dlg (dlg=dlg at entry=0x7fd3edef3c08) at dlg_hash.c:193
        i = 13
        __FUNCTION__ = "free_dlg_dlg"
#5  0x00007fd3e0512573 in destroy_dlg (dlg=dlg at entry=0x7fd3edef3c08) at
dlg_hash.c:257
        ret = <optimized out>
        __FUNCTION__ = "destroy_dlg"
#6  0x00007fd3e051ea96 in _unref_dlg (dlg=dlg at entry=0x7fd3edef3c08, cnt=1)
at dlg_hash.c:1008
        d_entry = 0x7fd3e4641330
#7  0x00007fd3e052da96 in dlg_onreply (t=t at entry=0x0, type=type at entry=4096,
param=param at entry=0x7ffcf675b170) at dlg_handlers.c:706
        rpl = 0x0
        req = 0x0
        dlg = 0x7fd3edef3c08
        new_state = 5
        old_state = 5
        unref = 1
        event = 1
        mangled_from = {s = 0x0, len = 0}
        mangled_to = {s = 0x0, len = 0}
        req_out_buff = <optimized out>
        __FUNCTION__ = "dlg_onreply"
#8  0x00007fd3e052edf2 in unreference_dialog_create (dialog=<optimized
out>) at dlg_handlers.c:1136
        params = {req = 0x0, rpl = 0x0, code = 0, param = 0x7ffcf675b168,
extra1 = 0x0, extra2 = 0x0}
#9  0x00007fd3e10341d6 in empty_tmcb_list (head=head at entry=0x7fd3f4ee3f50)
at t_hooks.c:53
        cbp = 0x0
        cbp_tmp = 0x7fd3f3c96fd0
        __FUNCTION__ = "empty_tmcb_list"
#10 0x00007fd3e0ff41e4 in free_cell (dead_cell=dead_cell at entry=0x7fd3f4ee3ee0)
at h_table.c:127
        b = <optimized out>
        i = <optimized out>
        rpl = <optimized out>
        tt = <optimized out>
        foo = <optimized out>
        p = <optimized out>
        __FUNCTION__ = "free_cell"
#11 0x00007fd3e1045b5f in delete_cell (p_cell=p_cell at entry=0x7fd3f4ee3ee0,
unlock=unlock at entry=1) at timer.c:239
        __FUNCTION__ = "delete_cell"
#12 0x00007fd3e1046886 in wait_handler (wait_tl=0x7fd3f4ee3f60) at
timer.c:458
        p_cell = 0x7fd3f4ee3ee0
#13 timer_routine (ticks=<optimized out>, set=<optimized out>) at
timer.c:1091
        tl = 0x7fd3f4ee3f60
        tmp_tl = 0x7fd4145cef88
        id = 2
        __FUNCTION__ = "timer_routine"
#14 0x00000000004cbcf3 in handle_timer_job () at timer.c:857
        t = 0x7fd3e46321b8
        l = <optimized out>
        __FUNCTION__ = "handle_timer_job"
---Type <return> to continue, or q <return> to quit---
#15 0x0000000000627bec in handle_io (idx=<optimized out>,
event_type=<optimized out>, fm=<optimized out>) at net/net_udp.c:282
        n = <optimized out>
        read = 32725
#16 io_wait_loop_epoll (repeat=<optimized out>, t=<optimized out>,
h=<optimized out>) at net/../io_wait_loop.h:311
        ret = 1
        n = 1
        r = 3
        i = <optimized out>
        e = 0x7fd5de957528
        ep_event = {events = 3832188584, data = {ptr = 0x9f9ff000007fd3, fd
= 32723, u32 = 32723, u64 = 44930374437994451}}
        fd = <optimized out>
        curr_time = 4741
#17 0x000000000062b1cc in udp_start_processes (chd_rank=chd_rank at entry=0x9f9ff0
<chd_rank.13389>, startup_done=startup_done at entry=0x7fd3e46a8ea8) at
net/net_udp.c:503
        si = <optimized out>
        p_id = <optimized out>
        i = <optimized out>
        __FUNCTION__ = "udp_start_processes"
#18 0x000000000041dec4 in main_loop () at main.c:227
        startup_done = 0x7fd3e46a8ea8
        chd_rank = 13
        last_check = 0
        rc = <optimized out>
#19 main (argc=<optimized out>, argv=<optimized out>) at main.c:916
        c = <optimized out>
        r = 0
        tmp = 0x7ffcf675bf30 ""
        tmp_len = <optimized out>
        port = <optimized out>
        proto = <optimized out>
        protos_no = <optimized out>
        options = 0x683980
"f:cCm:M:b:l:n:N:rRvdDFEVhw:t:u:g:p:P:G:W:o:a:k:s:"
        ret = -1
        seed = 2401723640
        rfd = <optimized out>
        __FUNCTION__ = "main"
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensips.org/pipermail/devel/attachments/20221013/30e31711/attachment-0001.html>