<!-- Kamailio Project uses GitHub Issues only for bugs in the code or feature requests. Please use this template only for bug reports. If you have questions about using Kamailio or related to its configuration file, ask on sr-users mailing list: * https://lists.kamailio.org/mailman3/postorius/lists/sr-users.lists.kamailio… If you have questions about developing extensions to Kamailio or its existing C code, ask on sr-dev mailing list: * https://lists.kamailio.org/mailman3/postorius/lists/sr-dev.lists.kamailio.o… Please try to fill this template as much as possible for any issue. It helps the developers to troubleshoot the issue. If there is no content to be filled in a section, the entire section can be removed. You can delete the comments from the template sections when filling. You can delete next line and everything above before submitting (it is a comment). --> ### Description <!-- Explain what you did, what you expected to happen, and what actually happened. --> Hello. I use uac_req_send to send registration to the asterisk pool. If some asterisk did not authorize and re-sent the 401 code, the module causes a kamailio crash ### Troubleshooting ds_select("BACKENDS","0"); while(ds_set_dst()) { xlog("L_DBG",">>> BACKEND du=$du\n"); $uac_req(ruri)="sip:" + $(du{uri.host}); $uac_req(furi)="sip:" + $avp(username) + "@" + $(du{uri.host}); $uac_req(turi)=$uac_req(furi); uac_req_send(); ds_next_dst(); } #### Reproduction <!-- If the issue can be reproduced, describe how it can be done. --> #### Debugging Data <!-- If you got a core dump, use gdb to extract troubleshooting data - full backtrace, local variables and the list of the code at the issue location. gdb /path/to/kamailio /path/to/corefile bt full info locals list If you are familiar with gdb, feel free to attach more of what you consider to be relevant. --> ``` [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/usr/sbin/kamailio -P /run/kamailio/kamailio.pid -f /etc/kamailio/kamailio.cfg'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00005557272803b9 in timer_list_expire (t=1180105352, h=0x7f73b30a3bb8, slow_l=0x7f73b30a73a0, slow_mark=2907) at core/timer.c:846 846 core/timer.c: No such file or directory. (gdb) bt full #0 0x00005557272803b9 in timer_list_expire (t=1180105352, h=0x7f73b30a3bb8, slow_l=0x7f73b30a73a0, slow_mark=2907) at core/timer.c:846 tl = 0x7f73b3a49a88 ret = 0 #1 0x00005557272809cf in timer_handler () at core/timer.c:922 saved_ticks = 1180105352 run_slow_timer = 0 i = 859 __func__ = "timer_handler" #2 0x0000555727280f53 in timer_main () at core/timer.c:961 No locals. #3 0x0000555726f77736 in main_loop () at /build/kamailio-5.6.4+ubuntu22.04/src/main.c:1831 i = 6 pid = 0 si = 0x0 si_desc = "udp receiver child=5 sock=10.153.5.40:5060\000\000\020\000\000\000\003\000\000\000!\000\000\000\000\262\270\224RE&\035(\247K'WU\000\000WqA'WU\000\000\000\000\000\000\000\000\000\000c\367@'WU\000\000!\000\000\000\000\000\000\000\260\325\022\371s\177\000\000 \236.\220\375\177\000\000ݕ\024'WU\000" nrprocs = 6 woneinit = 1 __func__ = "main_loop" #4 0x0000555726f83d11 in main (argc=12, argv=0x7ffd902ea398) at /build/kamailio-5.6.4+ubuntu22.04/src/main.c:3078 cfg_stream = 0x555727e12380 c = -1 r = 0 tmp = 0x7ffd902ebe36 "" tmp_len = 0 port = 0 proto = 0 ahost = 0x0 aport = 0 options = 0x55572744e898 ":f:cm:M:dVIhEeb:l:L:n:vKrRDTN:W:w:t:u:g:P:G:SQ:O:a:A:x:X:Y:" ret = -1 seed = 4270110361 rfd = 4 debug_save = 0 debug_flag = 0 dont_fork_cnt = 0 n_lst = 0x7ffd902ea398 p = 0x7ffd902ea310 "" st = {st_dev = 25, st_ino = 5514, st_nlink = 2, st_mode = 16888, st_uid = 0, st_gid = 0, __pad0 = 0, st_rdev = 0, st_size = 40, st_blksize = 4096, st_blocks = 0, st_atim = {tv_sec = 1690276408, tv_nsec = 971865637}, st_mtim = {tv_sec = 1690276408, tv_nsec = 971865637}, st_ctim = {tv_sec = 1690276408, tv_nsec = 971865637}, __glibc_reserved = {0, 0, 0}} tbuf = '\000' <repeats 80 times>, "\377\000\000\000\377\000\000\000\000\377\000\000\000\000\000\000", '/' <repeats 16 times>, "\230\r", '\000' <repeats 14 times>, "`", '\000' <repeats 15 times>, "\001", '\000' <repeats 144 times>... option_index = 12 long_options = {{name = 0x55572740a2e9 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x55572740b84a "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x55572740f6e4 "alias", has_arg = 1, flag = 0x0, val = 1024}, {name = 0x55572740a2ee "subst", has_arg = 1, flag = 0x0, val = 1025}, {name = 0x55572740a2f4 "substdef", has_arg = 1, flag = 0x0, val = 1026}, {name = 0x55572740a2fd "substdefs", has_arg = 1, flag = 0x0, val = 1027}, {name = 0x55572740a307 "server-id", has_arg = 1, flag = 0x0, val = 1028}, {name = 0x55572740a311 "loadmodule", has_arg = 1, flag = 0x0, val = 1029}, {name = 0x55572740a31c "modparam", has_arg = 1, flag = 0x0, val = 1030}, {name = 0x55572740a325 "log-engine", has_arg = 1, flag = 0x0, val = 1031}, {name = 0x55572740b967 "debug", has_arg = 1, flag = 0x0, val = 1032}, {name = 0x55572740a330 "cfg-print", has_arg = 0, flag = 0x0, val = 1033}, {name = 0x55572740a33a "atexit", has_arg = 1, flag = 0x0, val = 1034}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} __func__ = "main" (gdb) info locals tl = 0x7f73b3a49a88 ret = 0 (gdb) list 841 in core/timer.c (gdb) ``` ``` [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/usr/sbin/kamailio -P /run/kamailio/kamailio.pid -f /etc/kamailio/kamailio.cfg'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f73f575d4d0 in free_hash_table () at /build/kamailio-5.6.4+ubuntu22.04/src/modules/tm/h_table.c:464 464 /build/kamailio-5.6.4+ubuntu22.04/src/modules/tm/h_table.c: No such file or directory. (gdb) bt full #0 0x00007f73f575d4d0 in free_hash_table () at /build/kamailio-5.6.4+ubuntu22.04/src/modules/tm/h_table.c:464 p_cell = 0x0 tmp_cell = 0x0 i = 64459 __func__ = "free_hash_table" #1 0x00007f73f5793e46 in tm_shutdown () at /build/kamailio-5.6.4+ubuntu22.04/src/modules/tm/t_funcs.c:88 __func__ = "tm_shutdown" #2 0x00005557271db17b in destroy_modules () at core/sr_module.c:842 t = 0x7f73f68a65a0 foo = 0x7f73f68a59e0 __func__ = "destroy_modules" #3 0x0000555726f64029 in cleanup (show_status=1) at /build/kamailio-5.6.4+ubuntu22.04/src/main.c:561 memlog = 0 __func__ = "cleanup" #4 0x0000555726f66044 in shutdown_children (sig=15, show_status=1) at /build/kamailio-5.6.4+ubuntu22.04/src/main.c:704 __func__ = "shutdown_children" #5 0x0000555726f697dc in handle_sigs () at /build/kamailio-5.6.4+ubuntu22.04/src/main.c:802 chld = 0 chld_status = 139 any_chld_stopped = 1 memlog = 0 __func__ = "handle_sigs" #6 0x0000555726f78f42 in main_loop () at /build/kamailio-5.6.4+ubuntu22.04/src/main.c:1900 i = 6 pid = 37846 si = 0x0 si_desc = "udp receiver child=5 sock=10.153.5.40:5060\000\000\020\000\000\000\003\000\000\000!\000\000\000\000\262\270\224RE&\035(\247K'WU\000\000WqA'WU\000\000\000\000\000\000\000\000\000\000c\367@'WU\000\000!\000\000\000\000\000\000\000\260\325\022\371s\177\000\000 \236.\220\375\177\000\000ݕ\024'WU\000" nrprocs = 6 woneinit = 1 __func__ = "main_loop" #7 0x0000555726f83d11 in main (argc=12, argv=0x7ffd902ea398) at /build/kamailio-5.6.4+ubuntu22.04/src/main.c:3078 cfg_stream = 0x555727e12380 c = -1 r = 0 tmp = 0x7ffd902ebe36 "" tmp_len = 0 port = 0 proto = 0 ahost = 0x0 aport = 0 options = 0x55572744e898 ":f:cm:M:dVIhEeb:l:L:n:vKrRDTN:W:w:t:u:g:P:G:SQ:O:a:A:x:X:Y:" ret = -1 seed = 4270110361 rfd = 4 debug_save = 0 debug_flag = 0 dont_fork_cnt = 0 n_lst = 0x7ffd902ea398 p = 0x7ffd902ea310 "" st = {st_dev = 25, st_ino = 5514, st_nlink = 2, st_mode = 16888, st_uid = 0, st_gid = 0, __pad0 = 0, st_rdev = 0, st_size = 40, st_blksize = 4096, st_blocks = 0, st_atim = {tv_sec = 1690276408, tv_nsec = 971865637}, st_mtim = {tv_sec = 1690276408, tv_nsec = 971865637}, st_ctim = {tv_sec = 1690276408, tv_nsec = 971865637}, __glibc_reserved = {0, 0, 0}} tbuf = '\000' <repeats 80 times>, "\377\000\000\000\377\000\000\000\000\377\000\000\000\000\000\000", '/' <repeats 16 times>, "\230\r", '\000' <repeats 14 times>, "`", '\000' <repeats 15 times>, "\001", '\000' <repeats 144 times>... option_index = 12 long_options = {{name = 0x55572740a2e9 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x55572740b84a "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x55572740f6e4 "alias", has_arg = 1, flag = 0x0, val = 1024}, {name = 0x55572740a2ee "subst", has_arg = 1, flag = 0x0, val = 1025}, {name = 0x55572740a2f4 "substdef", has_arg = 1, flag = 0x0, val = 1026}, {name = 0x55572740a2fd "substdefs", has_arg = 1, flag = 0x0, val = 1027}, {name = 0x55572740a307 "server-id", has_arg = 1, flag = 0x0, val = 1028}, {name = 0x55572740a311 "loadmodule", has_arg = 1, flag = 0x0, val = 1029}, {name = 0x55572740a31c "modparam", has_arg = 1, flag = 0x0, val = 1030}, {name = 0x55572740a325 "log-engine", has_arg = 1, flag = 0x0, val = 1031}, {name = 0x55572740b967 "debug", has_arg = 1, flag = 0x0, val = 1032}, {name = 0x55572740a330 "cfg-print", has_arg = 0, flag = 0x0, val = 1033}, {name = 0x55572740a33a "atexit", has_arg = 1, flag = 0x0, val = 1034}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} __func__ = "main" (gdb) info locals p_cell = 0x0 tmp_cell = 0x0 i = 64459 __func__ = "free_hash_table" (gdb) list 459 in /build/kamailio-5.6.4+ubuntu22.04/src/modules/tm/h_table.c ``` #### Log Messages <!-- Check the syslog file and if there are relevant log messages printed by Kamailio, add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site). --> ``` CRITICAL: <core> [core/mem/q_malloc.c:519]: qm_free(): BUG: freeing already freed pointer (0x7f8a6c440050), called from uac: uac_send.c: uac_send_tm_callback(860), first free uac: uac_send.c: uac_send_info_clone(110) - ignoring CRITICAL: <core> [core/mem/q_malloc.c:123]: qm_debug_check_frag(): BUG: qm: fragm. 0x7f74379f46b0 (address 0x7f74379f46e8) beginning overwritten (0)! Memory allocator was called from uac: uac_send.c:860. Fragment marked by (null):0. Exec from core/mem/q_malloc.c:511. ``` #### SIP Traffic <!-- If the issue is exposed by processing specific SIP messages, grab them with ngrep or save in a pcap file, then add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site). --> ``` proto:UDP 2023-07-25T10:00:44.452898Z 10.153.5.40:5060 ---> 192.168.50.107:5060 REGISTER sip:192.168.50.107 SIP/2.0 Via: SIP/2.0/UDP 10.153.5.40;branch=z9hG4bK6a0b.834627a6000000000000000000000000.0 To: <sip:3408@192.168.50.107> From: <sip:3408@192.168.50.107>;tag=b2f228866a24b161d346cfb256d45132-a0527658 CSeq: 10 REGISTER Call-ID: 2332840947916a3e-39417(a)10.153.5.40 Max-Forwards: 70 Content-Length: 0 Contact: <sip:3408@10.153.5.40:5060> Expires: 150 User-Agent: PortSIP UC Client Android - v11.8.1 proto:UDP 2023-07-25T10:00:44.464436Z 192.168.50.107:5060 ---> 10.153.5.40:5060 SIP/2.0 401 Unauthorized Via: SIP/2.0/UDP 10.153.5.40;rport=5060;received=10.153.5.40;branch=z9hG4bK6a0b.834627a6000000000000000000000000.0 Call-ID: 2332840947916a3e-39417(a)10.153.5.40 From: <sip:3408@192.168.50.107>;tag=b2f228866a24b161d346cfb256d45132-a0527658 To: <sip:3408@192.168.50.107>;tag=z9hG4bK6a0b.834627a6000000000000000000000000.0 CSeq: 10 REGISTER WWW-Authenticate: Digest realm="vpp",nonce="1690279244/67fc12dbaf6a76fa34181a4bd504de00",opaque="1680d45809efac86",algorithm=md5,qop="auth" Server: Asterisk Content-Length: 0 proto:UDP 2023-07-25T10:00:44.466447Z 10.153.5.40:5060 ---> 192.168.50.107:5060 REGISTER sip:192.168.50.107 SIP/2.0 Via: SIP/2.0/UDP 10.153.5.40;branch=z9hG4bK7a0b.5673b4d4000000000000000000000000.0 To: <sip:3408@192.168.50.107> From: <sip:3408@192.168.50.107>;tag=b2f228866a24b161d346cfb256d45132-a0527658 CSeq: 11 REGISTER Call-ID: 2332840947916a3e-39417(a)10.153.5.40 Max-Forwards: 70 Content-Length: 0 Contact: <sip:3408@10.153.5.40:5060> Expires: 150 Authorization: Digest username="3408", realm="vpp", nonce="1690279244/67fc12dbaf6a76fa34181a4bd504de00", uri="sip:192.168.50.107", opaque="1680d45809efac86", qop=auth, nc=00000001, cnonce="1935694403", response="38bc75e831e1267ce943bcc50f76390a", algorithm=MD5 User-Agent: PortSIP UC Client Android - v11.8.1 proto:UDP 2023-07-25T10:00:44.477675Z 192.168.50.107:5060 ---> 10.153.5.40:5060 SIP/2.0 401 Unauthorized Via: SIP/2.0/UDP 10.153.5.40;rport=5060;received=10.153.5.40;branch=z9hG4bK7a0b.5673b4d4000000000000000000000000.0 Call-ID: 2332840947916a3e-39417(a)10.153.5.40 From: <sip:3408@192.168.50.107>;tag=b2f228866a24b161d346cfb256d45132-a0527658 To: <sip:3408@192.168.50.107>;tag=z9hG4bK7a0b.5673b4d4000000000000000000000000.0 CSeq: 11 REGISTER WWW-Authenticate: Digest realm="vpp",nonce="1690279244/67fc12dbaf6a76fa34181a4bd504de00",opaque="5adc30b867f02d18",algorithm=md5,qop="auth" Server: Asterisk Content-Length: 0 ``` ### Possible Solutions <!-- If you found a solution or workaround for the issue, describe it. Ideally, provide a pull request with a fix. --> ### Additional Information * **Kamailio Version** - output of `kamailio -v` ``` version: kamailio 5.6.4 (x86_64/linux) flags: USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLOCKLIST, HAVE_RESOLV_RES, TLS_PTHREAD_MUTEX_SHARED ADAPTIVE_WAIT_LOOPS 1024, MAX_RECV_BUFFER_SIZE 262144, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB poll method support: poll, epoll_lt, epoll_et, sigio_rt, select. id: unknown compiled with gcc 11.3.0 ``` * **Operating System**: <!-- Details about the operating system, the type: Linux (e.g.,: Debian 8.4, Ubuntu 16.04, CentOS 7.1, ...), MacOS, xBSD, Solaris, ...; Kernel details (output of `lsb_release -a` and `uname -a`) --> ``` 5.15.0-76-generic #83-Ubuntu SMP Thu Jun 15 19:16:32 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux ``` -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/3522 You are receiving this because you are subscribed to this thread. Message ID: &lt;kamailio/kamailio/issues/3522(a)github.com&gt;