[sr-dev] Kamailio segfaults on shutdown since commit 7b3a6ec

[Alex Hermann]

Hello Andrei, all,


On my git master installations, Kamailio segfaults on logging "Thanks
for flying Kamailio" on shutdown (backtrace below). A bisection on
the repository pointed to the following commit as the culprit:



commit 7b3a6eca7bb6dd1ca2a1395ca1e5821808ec85cd
Author: Andrei Pelinescu-Onciul <andrei at iptel.org>
Date:   Tue Apr 12 21:54:07 2011 +0200

    core: pkg mem size configurable form the cmd line
    
    The pkg mem size used can be configured by using the "-M"
    parameter on the command line, e.g.:
    ser -M 8  -f test.cfg # start ser with 8mb of pkg memory
    The default remains 4Mb.



The following patch works around the issue, but maybe someone more
knowledgable in this part of the code can create a real fix.



commit 73cbfbba811b964b6a8db1096d97b4af503c030a
Author: Alex Hermann <alex at speakup.nl>
Date:   Thu Sep 1 14:07:59 2011 +0200

    core: disable logging on shutdown after killing children, causing segfault

diff --git a/main.c b/main.c
index 45f0a6a..28adbe0 100644
--- a/main.c
+++ b/main.c
@@ -701,7 +701,6 @@ void handle_sigs()
                                DBG("SIGTERM received, program terminates\n");
                        /* shutdown/kill all the children */
                        shutdown_children(SIGTERM, 1);
-                       LOG(L_NOTICE, "Thank you for flying " NAME "\n");
                        exit(0);
                        break;
 

Backtrace:

Core was generated by `/usr/sbin/kamailio -f /home/alex/balancer/kamailio.cfg -m 64 -M 6 -u'.
Program terminated with signal 11, Segmentation fault.
#0  __strlen_sse2 () at ../sysdeps/x86_64/multiarch/../strlen.S:31
31      ../sysdeps/x86_64/multiarch/../strlen.S: No such file or directory.
        in ../sysdeps/x86_64/multiarch/../strlen.S
(gdb) bt full
#0  __strlen_sse2 () at ../sysdeps/x86_64/multiarch/../strlen.S:31
No locals.
#1  0x00007f7cdd820aee in *__GI_fputs_unlocked (str=0x7f7cdd1fc480 <Address 0x7f7cdd1fc480 out of bounds>, fp=0x1dcf2d0) at iofputs_u.c:37
        result = <value optimized out>
#2  0x00007f7cdd8831eb in *__GI___vsyslog_chk (pri=<value optimized out>, flag=-1, fmt=<value optimized out>, ap=0x7fffb73d9bb0) at ../misc/syslog.c:207
        now_tm = {tm_sec = 44, tm_min = 54, tm_hour = 10, tm_mday = 1, tm_mon = 8, tm_year = 111, tm_wday = 4, tm_yday = 243, tm_isdst = 1, tm_gmtoff = 7200, tm_zone = 0x1d3fde0 
"CEST"}
        now = 1314867284
        fd = <value optimized out>
        f = <value optimized out>
        buf = 0x0
        bufsize = 0
        msgoff = <value optimized out>
        saved_errno = 10
        failbuf = "\000\000\000\000\000\000\000\000\377\377\377\377\000\000\000\000\340\241~\335|\177\000\000\r\241~\335|"
        clarg = {buf = 0x1, oldaction = 0x2000}
#3  0x00007f7cdd8837d0 in __syslog (pri=-585120640, fmt=0x15 <Address 0x15 out of bounds>) at ../misc/syslog.c:119
        ap = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fffb73d9c90, reg_save_area = 0x7fffb73d9bd0}}
#4  0x0000000000460744 in handle_sigs () at main.c:704
        chld = <value optimized out>
        chld_status = <value optimized out>
        memlog = <value optimized out>
#5  0x0000000000462736 in main_loop () at main.c:1709
        i = 8
        pid = <value optimized out>
        si = 0x0
        si_desc = "udp receiver child=7 sock=xxx.xxx.xxx.xxx:8060\000\000\030E#\335|\177\000\000\005\000\000\000\002\000\000\000\003", '\000' <repeats 15 times>"\240, =\214", 
'\000' <repeats 29 times>"\240, \277=\267\377\177\000\000GNJ\000\000\000\000"
#6  0x0000000000463dd3 in main (argc=1, argv=0x7fffb73d9f18) at main.c:2471
        cfg_stream = <value optimized out>
        c = <value optimized out>
        r = <value optimized out>
        tmp = 0x7fffb73dbf8b ""
        tmp_len = 0
        port = <value optimized out>
        proto = <value optimized out>
        ret = <value optimized out>
        seed = 1436424957
        rfd = <value optimized out>
        debug_save = 0
        debug_flag = 0
        dont_fork_cnt = 0
        n_lst = 0x0
        p = <value optimized out>

-- 
Greetings,

Alex Hermann