From bugtracker@sip-router.org Thu Sep 12 07:29:05 2013
From: sip-router <bugtracker@sip-router.org>
To: sr-dev@lists.kamailio.org
Subject: [sr-dev] [tracker] Task opened: Kamailio 4.0.x crash with	pua_reginfo
 : reginfo_handle_notify
Date: Thu, 12 Sep 2013 05:29:02 +0000
Message-ID: <1378963742.5231511e3a470@sip-router.org>
In-Reply-To: <FS338@sip-router.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1465987348=="

--===============1465987348==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.

A new Flyspray task has been opened.  Details are below.=20

User who did this - Wonbin Cho (wbcho)=20

Attached to Project - sip-router
Summary - Kamailio 4.0.x crash with pua_reginfo : reginfo_handle_notify
Task Type - Bug Report
Category - Module
Status - Unconfirmed
Assigned To -=20
Operating System - Linux
Severity - Critical
Priority - Normal
Reported Version - 4.0
Due in Version - Undecided
Due Date - Undecided
Details - Kamailio would crash when called the reginfo_handle_notify function=
 of the PUA_REGINFO module.
Following is the log with debug level 9.

daemon.info /usr/sbin/kamailio[14933]: INFO: <script>: New Message: NOTIFY: s=
ip:reginfo(a)10.49.80.48 (<null> 10.49.80.40:5060) -> sip:reginfo(a)10.49.80.=
48 (<null> 10.49.80.48:5060)
daemon.debug /usr/sbin/kamailio[14933]: DEBUG: <core> [select.c:425]: Calling=
 SELECT 0x7e0cc81d2400
daemon.debug /usr/sbin/kamailio[14932]: DEBUG: pua [hash.c:397]: core_hash=3D=
 397
daemon.debug /usr/sbin/kamailio[14933]: DEBUG: tm [t_lookup.c:1395]: DEBUG: t=
_newtran: msg id=3D1 , global msg id=3D0 , T on entrance=3D0xffffffffffffffff
daemon.debug /usr/sbin/kamailio[14932]: DEBUG: pua [hash.c:406]: pres_uri=3D =
sip:6000(a)phs3.kor.jwm2.net   watcher_uri=3Dsip:reginfo(a)10.49.80.48   call=
id=3D 7464330662d7a359-14926(a)127.0.0.1   from_tag=3D 533cb9e91f4b999cf76861=
cbb9ed54ed-2088
daemon.debug /usr/sbin/kamailio[14932]: DEBUG: pua [hash.c:413]: FOUND tempor=
ary dialog
daemon.debug /usr/sbin/kamailio[14932]: DEBUG: tm [t_reply.c:1547]: DEBUG: cl=
eanup_uac_timers: RETR/FR timers reset
daemon.debug /usr/sbin/kamailio[14932]: DEBUG: <core> [usr_avp.c:644]: DEBUG:=
destroy_avp_list: destroying list (nil)
daemon.debug /usr/sbin/kamailio[14932]: DEBUG: <core> [usr_avp.c:644]: DEBUG:=
destroy_avp_list: destroying list (nil)
daemon.debug /usr/sbin/kamailio[14932]: DEBUG: <core> [usr_avp.c:644]: DEBUG:=
destroy_avp_list: destroying list (nil)
daemon.debug /usr/sbin/kamailio[14932]: DEBUG: <core> [usr_avp.c:644]: DEBUG:=
destroy_avp_list: destroying list (nil)
daemon.debug /usr/sbin/kamailio[14932]: DEBUG: <core> [usr_avp.c:644]: DEBUG:=
destroy_avp_list: destroying list (nil)
daemon.debug /usr/sbin/kamailio[14933]: DEBUG: <core> [parser/msg_parser.c:10=
6]: found end of header
daemon.debug /usr/sbin/kamailio[14932]: DEBUG: <core> [usr_avp.c:644]: DEBUG:=
destroy_avp_list: destroying list (nil)
daemon.debug /usr/sbin/kamailio[14932]: DEBUG: <core> [xavp.c:447]: destroyin=
g xavp list (nil)
daemon.debug /usr/sbin/kamailio[14933]: DEBUG: tm [t_lookup.c:534]: t_lookup_=
request: start searching: hash=3D33078, isACK=3D0
daemon.debug /usr/sbin/kamailio[14932]: DEBUG: <core> [receive.c:293]: receiv=
e_msg: cleaning up
daemon.debug /usr/sbin/kamailio[14933]: DEBUG: tm [t_lookup.c:492]: DEBUG: RF=
C3261 transaction matching failed
daemon.debug /usr/sbin/kamailio[14933]: DEBUG: tm [t_lookup.c:716]: DEBUG: t_=
lookup_request: no transaction found
daemon.debug /usr/sbin/kamailio[14933]: DEBUG: tm [t_hooks.c:374]: DBG: trans=
=3D0x7e0cc631d5b0, callback type 1, id 0 entered
daemon.debug /usr/sbin/kamailio[14933]: DEBUG: pua [hash.c:558]: 'To' header =
ALREADY PARSED: <sip:reginfo(a)10.49.80.48>
daemon.debug /usr/sbin/kamailio[14933]: DEBUG: pua [hash.c:361]: core_hash=3D=
 397
daemon.err /usr/sbin/kamailio[14933]: ERROR: pua [hash.c:607]: no record for =
the dialog found in hash table
daemon.debug /usr/sbin/kamailio[14933]: DEBUG: pua_reginfo [notify.c:409]: Bo=
dy is <?xml version=3D"1.0"?> <reginfo xmlns=3D"urn:ietf:params:xml:ns:reginf=
o" version=3D"0" state=3D"full">   <registration aor=3D"sip:6000(a)phs3.kor.j=
wm2.net" id=3D"0x692a484bf5f0"
kern.info kernel: [1824899.083979] kamailio[14933]: segfault at 0 ip 00007e0c=
c4edcd77 sp 00007ef57b8d3de0 error 4 in usrloc.so[7e0cc4ec6000+1c000]
kern.alert kernel: [1824899.084043] grsec: From 10.49.8.78: Segmentation faul=
t occurred at            (nil) in /usr/sbin/kamailio[kamailio:14933] uid/euid=
:1000/1000 gid/egid:1000/1000, parent /usr/sbin/kamailio[kamailio:14902] uid/=
euid:1000/1000 g
daemon.crit /usr/sbin/kamailio[14962]: : <core> [pass_fd.c:293]: ERROR: recei=
ve_fd: EOF on 18
daemon.debug /usr/sbin/kamailio[14962]: DEBUG: <core> [tcp_main.c:3605]: DBG:=
 handle_ser_child: dead child 8, pid 14933 (shutting down?)
daemon.debug /usr/sbin/kamailio[14962]: DEBUG: <core> [io_wait.h:617]: DBG: i=
o_watch_del (0xb9762d347b0, 18, -1, 0x0) fd_no=3D21 called
daemon.alert /usr/sbin/kamailio[14902]: ALERT: <core> [main.c:788]: child pro=
cess 14933 exited by a signal 11
daemon.alert /usr/sbin/kamailio[14902]: ALERT: <core> [main.c:791]: core was =
not generated
daemon.info /usr/sbin/kamailio[14902]: INFO: <core> [main.c:803]: INFO: termi=
nating due to SIGCHLD
daemon.info /usr/sbin/kamailio[14959]: INFO: <core> [main.c:854]: INFO: signa=
l 15 received


A simple fix for this might be:
"kamailio-4.0.1/modules/pua_reginfo/notify.c" Line 374

next_registration:
		// if (ul_record) ul.release_urecord(ul_record);	=09
		/* Unlock the domain for this AOR: */
		if(aor.len > 0) {
			ul.unlock_udomain(domain, &aor);
		}

		registrations =3D registrations->next;
	}



More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=3Ddetails&task_id=3D338

You are receiving this message because you have requested it from the Flyspra=
y bugtracking system.  If you did not expect this message or don't want to re=
ceive mails in future, you can change your notification settings at the URL s=
hown above.


--===============1465987348==--