[Serusers] Crash in SER

Maxim Sobolev sobomax at portaone.com
Fri Feb 21 14:54:39 CET 2003


Hi,

We've observed the following crash in ser. Do you have any ideas what
the cause could be?

I'm keeping corefile and binary compiled with debug symbols, so that
don't hesitate to contact me if any additional information is
necessary.

Thank you in advance!

-Maxim
-------------- next part --------------
Script started on Fri Feb 21 05:43:09 2003
bash-2.05a$ gdb ~/sip/ser/work/ser-0.8.10/ser ser.core
GNU gdb 4.18 (FreeBSD)
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-unknown-freebsd"...Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 2627 in elfstab_build_psymtabs
Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 933 in fill_symbuf

Core was generated by `ser'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libc.so.4...done.
Reading symbols from /usr/local/lib/ser/modules/sl.so...done.
Reading symbols from /usr/local/lib/ser/modules/tm.so...done.
Reading symbols from /usr/local/lib/ser/modules/rr.so...done.
Reading symbols from /usr/local/lib/ser/modules/maxfwd.so...done.
Reading symbols from /usr/local/lib/ser/modules/usrloc.so...done.
Reading symbols from /usr/local/lib/ser/modules/registrar.so...done.
Reading symbols from /usr/local/lib/ser/modules/nathelper.so...done.
Reading symbols from /usr/local/lib/ser/modules/textops.so...done.
Reading symbols from /usr/local/lib/ser/modules/radius_auth.so...done.
Reading symbols from /usr/local/lib/libradiusclient.so.0...done.
Reading symbols from /usr/lib/libcrypt.so.2...done.
Reading symbols from /usr/libexec/ld-elf.so.1...done.
#0  0x807bdd3 in qm_status (qm=0x2816d000) at mem/q_malloc.c:447
447					f!=&(qm->free_hash[h].head); f=f->u.nxt_free, i++, j++);
(gdb) bt
#0  0x807bdd3 in qm_status (qm=0x2816d000) at mem/q_malloc.c:447
#1  0x8079a70 in qm_debug_frag (qm=0x2816d000, f=0x282fd0a4) at mem/q_malloc.c:109
#2  0x807ab37 in qm_free (qm=0x2816d000, p=0x282fd0bc, file=0x2a197a2d "t_reply.c", 
    func=0x2a197e28 "t_on_reply", line=826) at mem/q_malloc.c:359
#3  0x2a188000 in t_on_reply (p_msg=0x80dfe30) at t_reply.c:826
#4  0x805933a in forward_reply (msg=0x80dfe30) at forward.c:346
#5  0x806af1c in receive_msg (buf=0x80c3340 "SIP/2.0", len=360, src_su=0x81dafa0) at receive.c:161
#6  0x8077ff0 in udp_rcv_loop () at udp_server.c:336
#7  0x805eaa5 in main_loop () at main.c:618
#8  0x806197d in main (argc=1, argv=0xbfbffc04) at main.c:1383
#9  0x804c5bd in _start ()
(gdb) up
#1  0x8079a70 in qm_debug_frag (qm=0x2816d000, f=0x282fd0a4) at mem/q_malloc.c:109
109			qm_status(qm);
(gdb) l
104		};
105		if ((FRAG_END(f)->check1!=END_CHECK_PATTERN1)||
106			(FRAG_END(f)->check2!=END_CHECK_PATTERN2)){
107			LOG(L_CRIT, "BUG: qm_*: fragm. %p end overwritten(%x, %x)!\n",
108					f, FRAG_END(f)->check1, FRAG_END(f)->check2);
109			qm_status(qm);
110			abort();
111		}
112		if ((f>qm->first_frag)&&
113				((PREV_FRAG_END(f)->check1!=END_CHECK_PATTERN1) ||
(gdb) up
#2  0x807ab37 in qm_free (qm=0x2816d000, p=0x282fd0bc, file=0x2a197a2d "t_reply.c", 
    func=0x2a197e28 "t_on_reply", line=826) at mem/q_malloc.c:359
359		qm_debug_frag(qm, f);
(gdb) l
354			return;
355		}
356		prev=next=0;
357		f=(struct qm_frag*) ((char*)p-sizeof(struct qm_frag));
358	#ifdef DBG_QM_MALLOC
359		qm_debug_frag(qm, f);
360		if (f->u.is_free){
361			LOG(L_CRIT, "BUG: qm_free: freeing already freed pointer,"
362					" first free: %s: %s(%d) - aborting\n",
363					f->file, f->func, f->line);
(gdb) up
#3  0x2a188000 in t_on_reply (p_msg=0x80dfe30) at t_reply.c:826
826				shm_free(ack);
(gdb) l
821		/* acknowledge negative INVITE replies */	
822		if (t->is_invite && (msg_status>=300 || (t->local && msg_status>=200))) {
823			ack = build_ack( p_msg, t, branch , &ack_len);
824			if (ack) {
825				SEND_PR_BUFFER( &uac->request, ack, ack_len );
826				shm_free(ack);
827			}
828		} /* ack-ing negative INVITE replies */
829	
830		/* clean-up the transaction when transaction completed */
(gdb) up
#4  0x805933a in forward_reply (msg=0x80dfe30) at forward.c:346
346				if (mod->exports->response_f(msg)==0) goto skip;
(gdb) l
341		/* quick hack, slower for mutliple modules*/
342		for (mod=modules;mod;mod=mod->next){
343			if ((mod->exports) && (mod->exports->response_f)){
344				DBG("forward_reply: found module %s, passing reply to it\n",
345						mod->exports->name);
346				if (mod->exports->response_f(msg)==0) goto skip;
347			}
348		}
349	
350		/* we have to forward the reply stateless, so we need second via -bogdan*/
(gdb) print msg
$1 = (struct sip_msg *) 0x80dfe30
(gdb) print msg [1@*
$2 = {id = 1104, first_line = {type = 2, u = {request = {method = {s = 0x80c3340 "SIP/2.0", 
          len = 7}, uri = {s = 0x80c3348 "488", len = 3}, version = {
          s = 0x80c334c "Not Acceptable Here", len = 19}, method_value = 488}, reply = {version = {
          s = 0x80c3340 "SIP/2.0", len = 7}, status = {s = 0x80c3348 "488", len = 3}, reason = {
          s = 0x80c334c "Not Acceptable Here", len = 19}, statuscode = 488}}}, via1 = 0x80e27fc, 
  via2 = 0x80e2d1c, headers = 0x80e620c, last_header = 0x80e0b08, parsed_flag = 63, 
  h_via1 = 0x80e620c, h_via2 = 0x80e0b98, callid = 0x80e0008, to = 0x80e10ac, cseq = 0x80e0b08, 
  from = 0x80e0f2c, contact = 0x0, maxforwards = 0x0, route = 0x0, record_route = 0x0, 
  content_type = 0x0, content_length = 0x0, authorization = 0x0, expires = 0x0, proxy_auth = 0x0, 
  www_auth = 0x0, supported = 0x0, require = 0x0, proxy_require = 0x0, unsupported = 0x0, 
  allow = 0x0, event = 0x0, eoh = 0x0, unparsed = 0x80c3493 "Content-Length: 0\r\n\r\n", src_ip = {
    af = 2, len = 4, u = {addr32 = {1214690368, 0, 0, 0}, addr16 = {46144, 18534, 0, 0, 0, 0, 0, 
        0}, addr = "@╢fH", '\000' <repeats 11 times>}}, src_port_no = 5061, dst_ip = {af = 2, 
    len = 4, u = {addr32 = {1214690368, 0, 0, 0}, addr16 = {46144, 18534, 0, 0, 0, 0, 0, 0}, 
      addr = "@╢fH", '\000' <repeats 11 times>}}, 
  orig = 0x80e2a48 "SIP/2.0 488 Not Acceptable Here\r\nVia: SIP/2.0/UDP 64.180.102.72:5060;branch=z9hG4bKfa9f.17ad3774445fef6b70f18b74de26e0b2.0\r\nVia: SIP/2.0/UDP 172.17.1.127:5060;rport=5060\r\nTo: <sip:151 at 64.180.102.72;us"..., buf = 0x80c3340 "SIP/2.0", len = 360, new_uri = {s = 0x0, 
    len = 0}, parsed_uri_ok = 0, parsed_uri = {user = {s = 0x0, len = 0}, passwd = {s = 0x0, 
      len = 0}, host = {s = 0x0, len = 0}, port = {s = 0x0, len = 0}, params = {s = 0x0, len = 0}, 
    headers = {s = 0x0, len = 0}, port_no = 0}, add_rm = 0x0, repl_add_rm = 0x80e0514, 
  reply_lump = 0x0, add_to_branch_s = '\000' <repeats 54 times>, add_to_branch_len = 0, 
  hash_index = 0, flags = 0}
(gdb) up
#5  0x806af1c in receive_msg (buf=0x80c3340 "SIP/2.0", len=360, src_su=0x81dafa0) at receive.c:161
161			forward_reply(msg);
(gdb) l
156			gettimeofday( & tvb, &tz );
157			STATS_RX_RESPONSE ( msg->first_line.u.reply.statuscode / 100 );
158	#endif
159			
160			/* send the msg */
161			forward_reply(msg);
162	
163	#ifdef STATS
164			gettimeofday( & tve, &tz );
165			diff = (tve.tv_sec-tvb.tv_sec)*1000000+(tve.tv_usec-tvb.tv_usec);
(gdb) q
bash-2.05a$ exit

Script done on Fri Feb 21 05:44:36 2003


More information about the sr-users mailing list