i didn's set any global parameter, just the defaults.

yes, i can reproduce it consistently, i just send an INVITE and CANCEL while kamailio is trying the destinations. (serial forks to non-existent IP)

after i send the CANCEL, kamailio will crash.

below is the MEMDBG=1 syslog:

Dec 9 11:12:14 kelvin /usr/local/sbin/kamailio[22191]: WARNING: tm [t_lookup.c:1564]: t_unref(): WARNING: script writer didn't release transaction

Dec 9 11:12:14 kelvin /usr/local/sbin/kamailio[22189]: : <core> [mem/q_malloc.c:468]: qm_free(): BUG: qm_free: freeing already freed pointer (0x7f35a60e01e0), called from tm: h_table.c: free_cell(157), first free tm: h_table.c: free_cell(157) - aborting

Dec 9 11:12:14 kelvin /usr/local/sbin/kamailio[22209]: : <core> [pass_fd.c:293]: receive_fd(): ERROR: receive_fd: EOF on 13

Dec 9 11:12:14 kelvin /usr/local/sbin/kamailio[22186]: ALERT: <core> [main.c:788]: handle_sigs(): child process 22189 exited by a signal 6

Dec 9 11:12:14 kelvin /usr/local/sbin/kamailio[22186]: ALERT: <core> [main.c:791]: handle_sigs(): core was generated

Dec 9 11:12:14 kelvin /usr/local/sbin/kamailio[22186]: ERROR: ctl [ctl.c:379]: mod_destroy(): ERROR: ctl: could not delete unix socket /tmp/kamailio_ctl: Operation not permitted (1)

Dec 9 11:12:14 kelvin /usr/local/sbin/kamailio[22186]: : <core> [mem/q_malloc.c:468]: qm_free(): BUG: qm_free: freeing already freed pointer (0x7f35a60e01e0), called from tm: h_table.c: free_cell(157), first free tm: h_table.c: free_cell(157)

Kelvin Chua

On Mon, Dec 9, 2013 at 11:54 PM, Daniel-Constantin Mierla <miconda@gmail.com> wrote:

Can you compile with MEMDBG=1 in Makefile.defs and try again? Might be a memory overwritten issues somewhere. Look in the syslog for memory related message.

Few more details needed ... do you have memjoin global parameter set? Is the situation reproducible, or it happens sporadically?

Cheers,
Daniel
On 09/12/13 16:45, Kelvin Chua wrote:
tried latest branch 4.0, also segfault
similar backtrace
Kelvin Chua
On Mon, Dec 9, 2013 at 7:13 PM, Daniel-Constantin Mierla <miconda@gmail.com> wrote:
Hello,

can you try latest branch 4.0? There were some fixes for similar case. Soon will be a 4.0.5 release.

Cheers,
Daniel

On 09/12/13 10:35, Kelvin Chua wrote:
following is backtrace:

#0 qm_detach_free (frag=0x7f91a4656170, qm=<optimized out>) at mem/q_malloc.c:269

prev = 0x7f91a4656170

next = 0x0

#1 qm_malloc (qm=0x7f91a429b000, size=3840) at mem/q_malloc.c:386

f = 0x7f91a4656170

hash = -1536859792

#2 0x000000000050977f in shm_malloc (size=3832) at parser/../mem/shm_mem.h:262

p = <optimized out>

#3 sip_msg_shm_clone (org_msg=0x7f91ae9d7630, sip_msg_len=0x7fff56a2dde0, clone_lumps=0) at sip_msg_clone.c:502

len = 3832

hdr = <optimized out>

new_hdr = <optimized out>

last_hdr = <optimized out>

via = <optimized out>

prm = <optimized out>

to_prm = <optimized out>

new_to_prm = <optimized out>

new_msg = <optimized out>

p = <optimized out>

__FUNCTION__ = "sip_msg_shm_clone"

#4 0x00007f91ac989062 in build_cell (p_msg=0x7f91ae9d7630) at h_table.c:372

new_cell = 0x7f91a4656180

sip_msg_len = <optimized out>

old = <optimized out>

cbs = <optimized out>

cbs_tmp = <optimized out>

xold = <optimized out>

#5 0x00007f91ac9b5fc6 in new_t (p_msg=0x7f91ae9d7630) at t_lookup.c:1357

new_cell = <optimized out>

#6 t_newtran (p_msg=0x7f91ae9d7630) at t_lookup.c:1497

lret = <optimized out>

my_err = <optimized out>

canceled = <optimized out>

__FUNCTION__ = "t_newtran"

#7 0x00007f91ac9a99e0 in t_forward_cancel (p_msg=0x7f91ae9d7630, proxy=0x0, proto=0, tran=0x7fff56a2e2c0) at t_fwd.c:1607

t_invite = <optimized out>

t = 0x0

ret = <optimized out>

new_tran = <optimized out>

dst = {send_sock = 0x63371f, to = {s = {sa_family = 54224, sa_data = "\003\255\221\177\000\000\020\300\220\256\221\177\000"}, sin = {sin_family = 54224,

sin_port = 44291, sin_addr = {s_addr = 32657}, sin_zero = "\020\300\220\256\221\177\000"}, sin6 = {sin6_family = 54224, sin6_port = 44291,

sin6_flowinfo = 32657, sin6_addr = {__in6_u = {__u6_addr8 = "\020\300\220\256\221\177\000\000\070\261W\000\000\000\000", __u6_addr16 = {49168, 44688,

32657, 0, 45368, 87, 0, 0}, __u6_addr32 = {2928721936, 32657, 5747000, 0}}}, sin6_scope_id = 0}}, id = 0, proto = 96 '`', send_flags = {

f = 225 '\341', blst_imask = 162 '\242'}}

host = {s = 0x0, len = 0}

port = <optimized out>

__FUNCTION__ = "t_forward_cancel"

#8 0x00007f91ac99ae15 in t_relay_to (p_msg=0x7f91ae9d7630, proxy=0x0, proto=0, replicate=0) at t_funcs.c:264

ret = 0

new_tran = <optimized out>

t = <optimized out>

dst = {send_sock = 0x0, to = {s = {sa_family = 0, sa_data = '\000' <repeats 13 times>}, sin = {sin_family = 0, sin_port = 0, sin_addr = {s_addr = 0},

sin_zero = "\000\000\000\000\000\000\000"}, sin6 = {sin6_family = 0, sin6_port = 0, sin6_flowinfo = 0, sin6_addr = {__in6_u = {

__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, sin6_scope_id = 0}}, id = 0,

proto = 64 '@', send_flags = {f = 243 '\363', blst_imask = 162 '\242'}}

port = <optimized out>

host = {s = 0x7fff56a2eab8 "0[*\244\221\177", len = -1398876638}

__FUNCTION__ = "t_relay_to"

Kelvin Chua
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users@lists.sip-router.org
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
-- Daniel-Constantin Mierla - http://www.asipto.com http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users@lists.sip-router.org
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
-- 
Daniel-Constantin Mierla - http://www.asipto.com
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda