Module: kamailio
Branch: master
Commit: 6cdbaa1815bdcadc467f36109c6e3a7d00c344f5
URL: https://github.com/kamailio/kamailio/commit/6cdbaa1815bdcadc467f36109c6e3a7…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2025-02-24T12:30:26+01:00
ims_dialog: right timer function prototype for print_all_dlgs()
---
Modified: src/modules/ims_dialog/dlg_handlers.c
Modified: src/modules/ims_dialog/dlg_handlers.h
---
Diff: https://github.com/kamailio/kamailio/commit/6cdbaa1815bdcadc467f36109c6e3a7…
Patch: https://github.com/kamailio/kamailio/commit/6cdbaa1815bdcadc467f36109c6e3a7…
---
diff --git a/src/modules/ims_dialog/dlg_handlers.c b/src/modules/ims_dialog/dlg_handlers.c
index 3487d7f4c2a..4acc5c3ad45 100644
--- a/src/modules/ims_dialog/dlg_handlers.c
+++ b/src/modules/ims_dialog/dlg_handlers.c
@@ -2048,7 +2048,7 @@ void internal_print_all_dlg(struct dlg_cell *dlg)
* \return void
*/
-void print_all_dlgs()
+void print_all_dlgs(unsigned int ticks, void *param)
{
//print all dialog information - this is just for testing and is set to happen every 10 seconds
diff --git a/src/modules/ims_dialog/dlg_handlers.h b/src/modules/ims_dialog/dlg_handlers.h
index fd8ef143352..5aafb054b18 100644
--- a/src/modules/ims_dialog/dlg_handlers.h
+++ b/src/modules/ims_dialog/dlg_handlers.h
@@ -196,7 +196,7 @@ void dlg_tmcb_dummy(struct cell *t, int type, struct tmcb_params *param);
* \return void
*/
-void print_all_dlgs();
+void print_all_dlgs(unsigned int ticks, void *param);
/*!
* \brief Helper function that prints all the properties of a dialog including all the dlg_out's
### Description
There're `1xx_replies` metric in `sl` module. But the metric doesn't work.
### Troubleshooting
There're no handle in `void update_sl_stats(int code)`.
https://github.com/kamailio/kamailio/blob/f37940b9a113ab79611f851334af7f8fb…
### Proposal
Remove `1xx_replies` from `sl` module. Or add the handling.
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/4144
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/4144(a)github.com>
Fixes for SEGV in dialog module.
<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [ ] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [ ] PR should be backported to stable branches
- [ ] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
Hi !
The problem - periodically, 2-3 times in а month, kamailio dumps core with SEGV.
Different OS versions (Ubuntu 18,20,22), different kamailio versions from 5.7.1 up to 5.8.4,
high call load, python kemi, actively used dialog module.
Analyzing core files shows more or less the same picture - SEGV happends in dialog mododule
around the dialog vars, can be in rpc call (dlg.list), in destroy dlg, in accessing dlg variable.
Backtrace can look like:
```
Core was generated by `/usr/sbin/kamailio -P /run/kamailio/kamailio.pid -f /etc/kamailio/kamailio.cfg'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 get_dlg_variable_unsafe (dlg=dlg@entry=0x7fa2818849b8, key=key@entry=0x7ffe67990d68) at dlg_var.c:236
236 dlg_var.c: No such file or directory.
(gdb) bt full
#0 get_dlg_variable_unsafe (dlg=dlg@entry=0x7fa2818849b8, key=key@entry=0x7ffe67990d68) at dlg_var.c:236
var = 0x8
var_list = <optimized out>
#1 0x00007fa2a2ce0397 in get_dlg_varref (dlg=dlg@entry=0x7fa2818849b8, key=key@entry=0x7ffe67990d68) at dlg_var.c:297
var = 0x0
__func__ = "get_dlg_varref"
#2 0x00007fa2a2ccd429 in ki_dlg_var_get_mode (msg=<optimized out>, name=0x7ffe67990d68, rmode=0) at dialog.c:2462
dlg = 0x7fa2818849b8
pval = <optimized out>
#3 0x000055e2d5b87cbb in sr_kemi_exec_func (ket=ket@entry=0x7fa2a2d0c0c0 <sr_kemi_dialog_exports+1728>, msg=msg@entry=0x7fa2a34577c0, pno=pno@entry=1, vps=vps@entry=0x7ffe67990d60) at core/kemiexec.c:82
ret = <optimized out>
__func__ = "sr_kemi_exec_func"
#4 0x00007fa2a2930376 in sr_apy_kemi_exec_func_ex (ket=ket@entry=0x7fa2a2d0c0c0 <sr_kemi_dialog_exports+1728>, self=self@entry=0x7fa280ce2b80, args=args@entry=0x7fa2804ba3a0, idx=idx@entry=485) at apy_kemi.c:327
fname = <optimized out>
i = <optimized out>
ret = <optimized out>
vps = {{vtype = 2, v = {n = -2142122656, l = 140335914274144, s = {s = 0x7fa28051cd60 "rtpe_setid", len = 10}, dict = 0x7fa28051cd60}}, {vtype = 0, v = {n = 0, l = 0, s = {s = 0x0, len = 0}, dict = 0x0}}, {vtype = 0, v = {
n = 0, l = 0, s = {s = 0x0, len = 0}, dict = 0x0}}, {vtype = 0, v = {n = 0, l = 0, s = {s = 0x0, len = 0}, dict = 0x0}}, {vtype = 0, v = {n = 0, l = 0, s = {s = 0x0, len = 0}, dict = 0x0}}, {vtype = 0, v = {n = 0, l = 0,
s = {s = 0x0, len = 0}, dict = 0x0}}}
env_P = <optimized out>
lmsg = 0x7fa2a34577c0
xret = <optimized out>
slen = 10
alen = 1
pobj = <optimized out>
__func__ = "sr_apy_kemi_exec_func_ex"
#5 0x00007fa2a2931f45 in sr_apy_kemi_exec_func (self=0x7fa280ce2b80, args=0x7fa2804ba3a0, idx=485) at apy_kemi.c:356
ket = 0x7fa2a2d0c0c0 <sr_kemi_dialog_exports+1728>
ret = 0x0
pstate = 0x0
pframe = 0x0
tvb = {tv_sec = 0, tv_usec = 0}
tve = {tv_sec = 0, tv_usec = 0}
tz = {tz_minuteswest = 2, tz_dsttime = 0}
tdiff = <optimized out>
__func__ = "sr_apy_kemi_exec_func"
#6 0x00007fa2a266f697 in ?? () from /lib/x86_64-linux-gnu/libpython3.8.so.1.0
```
Inspecting dlg vars, the chain look like this:
```
(gdb) frame 0
#0 get_dlg_variable_unsafe (dlg=dlg@entry=0x7fa2818849b8, key=key@entry=0x7ffe67990d68) at dlg_var.c:236
236 in dlg_var.c
(gdb) p *dlg.vars
$1 = {key = {s = 0x7fa2833ea040 "mos", len = 3}, value = {s = 0x7fa2833ea0b0 "4.3", len = 3}, vflags = 1, next = 0x7fa2825fa3d0}
(gdb) p *$.next
$2 = {key = {s = 0x7fa200332e34 <error: Cannot access memory at address 0x7fa200332e34>, len = -1061109568}, value = {s = 0xabcdefed <error: Cannot access memory at address 0xabcdefed>, len = 49}, vflags = 1, next = 0x8}
(gdb)
```
Additionaly, inspecting logs i found that this is happends in SIP race conditions, f.e. when caller and calle sends BYE at the same time and
kamailio processing two different transactions of same dialog in two different workers, so present some competition from identical scenarios.
Long time i can't reproduce this in lab, until insert an artificial delay into the scenario which process BYE request to increase competition.
This code quickly causes SEGV in race conditions with BYE:
```
#kemi get/set dlg var
while time.time()-start < 0.5:
for i in ('bbb','ccc'):
dlgvar=KSR.dialog.var_get(i)
KSR.dialog.var_sets(i,str(random.randint(1,500000)))
```
SEGV not fire if i change dialog var_get/set to kamscript variant:
```
while time.time()-start < 0.5:
for i in ('bbb','ccc'):
dlgvar=KSR.pv.get(f"$dlg_var({i})")
KSR.pv.sets(f"$dlg_var({i})", str(random.randint(1,500000)))
```
By analyzing source i found some places which are not properly covered by locks, and some dangerous places
where direct pointer to dialog var structure used, which can change in concurrent process,
so in first case i insert the locks, in second - it is better to use the clone of variable in private PV buffer.
Also found some mistakes with dialog flags, which can potentionaly affect DMQ and DB dialog behavior.
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/4151
-- Commit Summary --
* dialog: covering by locks accessing/changing variables in kemi functions
-- File Changes --
M src/modules/dialog/dialog.c (36)
M src/modules/dialog/dlg_hash.h (2)
M src/modules/dialog/dlg_var.c (2)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/4151.patchhttps://github.com/kamailio/kamailio/pull/4151.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/4151
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/4151(a)github.com>