[OpenSIPS-Users] Intermittent failures with unreferenced dialog

[Richard Sievers]

Hi,

We have seen opensips 3.5.5 crash a number of times with the following error:

CRITICAL:dialog:_unref_dlg: bogus ref -1 with cnt 1 for dlg 0xffff88d91ed0 [3876:1041983204] with clid '308825373_133567631 at 10.10.13.149' and tags 'gK081ffb55' '9eccf1cd-5bd0-4a37-af30-8518660904a1'

Each instance appears to be associated with a CANCEL race condition while proxying a siprec dialog.

10.10.13.149 = SRC/SBC
10.108.17.140 = Opensips proxy that is failing
10.10.13.149 = Destination proxy

Time                     Source                                Dest                                     Message
0.000000           10.10.13.149                  10.108.17.140               Request: INVITE sip:10.108.17.140:5060 |
0.001208           10.108.17.140               10.10.13.149                  Status: 100 Giving it a try |
0.001806           172.16.2.225                  172.16.2.208                  Request: INVITE sip:10.108.17.140:5060 |
0.003601           172.16.2.208                  172.16.2.225                  Status: 100 Giving it a try |
0.018433           172.16.2.208                  172.16.2.225                  Status: 200 OK (INVITE) |
0.022528           10.10.13.149                  10.108.17.140               Request: CANCEL sip:10.108.17.140:5060 |
0.022767           10.108.17.140               10.10.13.149                  Status: 200 canceling (CANCEL) |
0.023232           172.16.2.225                  172.16.2.208                  Request: CANCEL sip:10.108.17.140:5060 |
0.023742           10.108.17.140               10.10.13.149                  Status: 200 OK (INVITE) |
0.024327           172.16.2.208                  172.16.2.225                  Status: 200 canceling (CANCEL) |
0.036620           10.10.13.149                  10.108.17.140               Request: ACK sip:10.108.17.140;did=42f.4e66b1e3 |
0.036621           10.10.13.149                  10.108.17.140               Request: BYE sip:10.108.17.140:5060;did=42f.4e66b1e3 |
0.037180           172.16.2.225                  172.16.2.208                  Request: ACK sip:172.16.2.208;transport=tcp |
0.037558           172.16.2.225                  172.16.2.208                  Request: BYE sip:172.16.2.208;transport=tcp |
0.085901           172.16.2.208                  172.16.2.225                  Status: 200 OK (BYE) |
0.087097           10.108.17.140               10.10.13.149                  Status: 200 OK (BYE) |

The error occurs 5s after the call completes – fr_timeout is set to 5s

I have been unable to reproduce the error in a test environment, so cannot provide detailed logs. The only thing I’ve noticed is that for test calls when the CANCEL is received after the 200OK from the destination, the ACK is always forwarded prior to the BYE being received.

Any idea what may be causing this? Is it likely to be a bug in opensips or the script.

--
Richard Sievers
Senior Software Engineer – Telecommunications
Dubber
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensips.org/pipermail/users/attachments/20251017/336bcfec/attachment-0001.html>