[SR-Users] kamailio tls.reload core dump

[Ding Ma]

Hi, all

This is related to the previous tls.reload not safe email chain. Now we
have a detailed gdb output that shows the stack trace of the core dump.
Please take a look. This looks like a bug. Please let me know if you have
any insights on how to fix this. Thanks,

Ding
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sip-router.org/pipermail/sr-users/attachments/20131023/79efe133/attachment.html>
-------------- next part --------------
#0  0x00007f0a6126a2b2 in lh_free (lh=0x7f0a3c210c10) at lhash.c:167
        i = <value optimized out>
        n = <value optimized out>
        nn = <value optimized out>
#1  0x00007f0a61583e4c in SSL_CTX_free (a=0x7f0a3c1f9fa0) at ssl_lib.c:1764
        i = <value optimized out>
#2  0x00007f0a3a77be44 in tls_free_domain (d=0x7f0a3be888e0) at tls_domain.c:87
        i = <value optimized out>
        procs_no = 18
#3  0x00007f0a3a77c645 in tls_free_cfg (cfg=0x7f0a3bdfa4a0) at tls_domain.c:118
        p = <value optimized out>
#4  0x00007f0a3a79698e in collect_garbage () at tls_util.c:93
        prev = <value optimized out>
        cur = 0x7f0a3bdfa4a0
#5  0x00007f0a3a787b4e in tls_reload (rpc=0x7f0a5ba5bb80, ctx=0x7fff32720e60)
    at tls_rpc.c:62
        cfg = <value optimized out>
        tls_domains_cfg_file = {s = 0x7f0a3b8d6d50 "/etc/kamailio/tls.cfg", 
          len = 21}
        __FUNCTION__ = "tls_reload"
#6  0x00007f0a5b83febb in process_rpc_req (buf=<value optimized out>, 
    size=<value optimized out>, bytes_needed=0x7fff3272111c, 
    sh=<value optimized out>, saved_state=<value optimized out>)
    at binrpc_run.c:681
        err = 0
        val = {name = {s = 0x7c000000db <Address 0x7c000000db out of bounds>, 
            len = 121}, type = 1, u = {strval = {s = 0x1d6e60d "tls.reload", 
              len = 10}, fval = 1.5247267506030937e-316, intval = 30860813, 
            end = 30860813}}
        rpc_e = <value optimized out>
        f_ctx = {in = {ctx = {tlen = 13, cookie = 705752749, type = 0, 
              flags = 1, offset = 13, in_struct = 0, in_array = 0}, 
            s = 0x1d6e618 "", end = 0x1d6e618 "", record_no = 0, 
            in_struct = 0}, out = {pkt = {body = 0x1d671e0 "\210Uzb\n\177", 
              end = 0x1d681e0 "", crt = 0x1d671e0 "\210Uzb\n\177"}, structs = {
              next = 0x7fff32720eb0, prev = 0x7fff32720eb0}}, 
          send_h = 0x7fff32721020, method = 0x1d6e60d "tls.reload", gc = 0x0, 
          replied = 0, err_code = 0, err_phrase = {s = 0x0, len = 0}}
        ctx = 0x7fff32720e60
        __FUNCTION__ = "process_rpc_req"
#7  0x00007f0a5b85090a in handle_stream_read (fm=<value optimized out>, 
    events=<value optimized out>, idx=-1) at io_listener.c:522
        bytes_free = <value optimized out>
        bytes_read = 846336032
        bytes_needed = 2
        bytes_processed = <value optimized out>
        r = 0x1d6e5f0
        sh = {fd = 11, type = 0, from = {sa_in = {s = {sa_family = 171, 
                sa_data = "\000\000\000\000\000\000 at t\326\001\000\000\000"}, 
              sin = {sin_family = 171, sin_port = 0, sin_addr = {s_addr = 0}, 
                sin_zero = "@t\326\001\000\000\000"}, sin6 = {
                sin6_family = 171, sin6_port = 0, sin6_flowinfo = 0, 
                sin6_addr = {__in6_u = {
                    __u6_addr8 = "@t\326\001\000\000\000\000\315\331gR\000\000\000", __u6_addr16 = {29760, 470, 0, 0, 55757, 21095, 0, 0}, __u6_addr32 = {
                      30831680, 0, 1382537677, 0}}}, sin6_scope_id = 33024}}, 
            sa_un = {sun_family = 171, 
              sun_path = "\000\000\000\000\000\000 at t\326\001\000\000\000\000\315\331gR\000\000\000\000\000\201\000\000\000\000\000\000`\016\326\001\000\000\000\000\002\000\000\000\000\000\000\000pE\203\000\000\000\000\000\f\242\205[\n\177\000\000\003", '\000' <repeats 15 times>, "\020\262Ob\n\177\000\000\060\000\000\000\060\000\000\000\207\357\204[\n\177\000\000\005\000\000\000\377\177"}}, 
          from_len = 0}
#8  handle_io (fm=<value optimized out>, events=<value optimized out>, idx=-1)
    at io_listener.c:717
        ret = <value optimized out>
        __FUNCTION__ = "handle_io"
#9  0x00007f0a5b853cd2 in io_wait_loop_epoll (fd_no=<value optimized out>, 
    cs_lst=<value optimized out>) at ../../io_wait.h:1092
        revents = <value optimized out>
        n = 1
        r = <value optimized out>
        fm = <value optimized out>
#10 io_listen_loop (fd_no=<value optimized out>, cs_lst=<value optimized out>)
    at io_listener.c:292
        max_fd_no = <value optimized out>
        poll_err = <value optimized out>
        poll_method = <value optimized out>
        cs = <value optimized out>
        type = <value optimized out>
        __FUNCTION__ = "io_listen_loop"
#11 0x00007f0a5b8411d9 in mod_child (rank=0) at ctl.c:327
        pid = <value optimized out>
        cs = <value optimized out>
        rpc_handler = 1
        __FUNCTION__ = "mod_child"
#12 0x00000000004e83cc in ?? ()
No symbol table info available.
#13 0x00007f0a5b855cb2 in ?? () from /usr/lib64/kamailio/modules/ctl.so
No symbol table info available.
#14 0x00007fff32721450 in ?? ()
No symbol table info available.
#15 0x0000003000000018 in ?? ()
No symbol table info available.
#16 0x00007fff327215f0 in ?? ()
No symbol table info available.
#17 0x00007fff32721530 in ?? ()
No symbol table info available.
#18 0x00007fff327215a0 in ?? ()
No symbol table info available.
#19 0x00007f0a62032400 in ?? ()
No symbol table info available.
#20 0x0000000000000000 in ?? ()
No symbol table info available.