[CRASH] opensips crashes when executing tls_reload multiple times #3272
Description
OpenSIPS version you are running
version: opensips 3.1.2 (x86_64/linux)
flags: STATS: On, DISABLE_NAGLE, USE_MCAST, SHM_MMAP, PKG_MALLOC, Q_MALLOC, DBG_MALLOC, FAST_LOCK-ADAPTIVE_WAIT
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535
poll method support: poll, epoll, sigio_rt, select.
main.c compiled on 20:25:10 Dec 12 2023 with gcc 9
Crash Core Dump
(gdb) bt full
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
set = {__val = {0, 139959558197472, 94854307780944, 15993087814041578752, 140724476969472, 21, 94854275307328, 1, 140724476969472, 2, 94854307780944, 139959557340881, 94854308455584,
47244640339, 140724476969664, 1702375089}}
pid =
tid =
ret =
#1 0x00007f4adfa36859 in __GI_abort () at abort.c:79
save_stage = 1
act = {__sigaction_handler = {sa_handler = 0x5644fb6c0410 <log_level>, sa_sigaction = 0x5644fb6c0410 <log_level>}, sa_mask = {__val = {94854275310384, 94854275269091, 139958227831744,
139959498923648, 139955804307594, 139958234649744, 139957572838740, 94854307781456, 15993087814041578752, 139958245218888, 18, 1024, 0, 736, 139959299538408, 94854275925008}},
sa_flags = -541932701, sa_restorer = 0x3000000028}
sigs = {__val = {32, 0 <repeats 15 times>}}
#2 0x00005644fb4da299 in fm_free (fm=, p=p@entry=0x7f4a90740bc0, file=file@entry=0x7f4a69761a0c "../crypto/err/err.c", func=func@entry=0x7f4adc375e80 <FUNCTION.28879> "os_free",
line=line@entry=450) at mem/f_malloc_dyn.h:262
f =
n =
FUNCTION = "fm_free"
#3 0x00007f4adc366c40 in _shm_free (line=450, function=, file=0x7f4a69761a0c "../crypto/err/err.c", ptr=0x7f4a90740bc0) at ../../mem/shm_mem.h:448
No locals.
#4 os_free (ptr=0x7f4a90740bc0, file=0x7f4a69761a0c "../crypto/err/err.c", line=450) at tls.h:123
FUNCTION = "os_free"
#5 0x00007f4a6967bdd4 in ERR_clear_error () from /lib/x86_64-linux-gnu/libcrypto.so.1.1
No symbol table info available.
#6 0x00007f4a68a6b832 in tls_write (tls_api=0x7f4a68a75f20 <tls_mgm_api>, fd=, poll_events=0x7ffcf8760424, len=736, buf=0x7f4ad054fde8, c=0x7f4a90dc12e8)
at ../tls_mgm/tls_conn_server.h:628
ret =
err =
ssl = 0x7f4a90dc1490
ret =
err =
ssl =
--Type for more, q to quit, c to continue without paging--
FUNCTION = "tls_write"
#7 tls_blocking_write (c=0x7f4a90dc12e8, fd=,
buf=buf@entry=0x7f4ad054fde8 "NOTIFY sip:1000@1.fircommercial1.yxxxxx.com:5061;transport=TLS SIP/2.0\r\nVia: SIP/2.0/TLS 120.78.172.20:5061;branch=z9hG4bKPje0afeaec-87df-4618-aa15-0e51ed6042fe\r\nFrom: <sip:1000@1.fircommercial1.yeas"..., len=len@entry=736, handshake_timeout=2000, send_timeout=300, t_dst=0x0, tls_api=0x7f4a68a75f20 <tls_mgm_api>) at ../tls_mgm/tls_conn_server.h:731
written = 0
n = 0
timeout =
retries = 0
pf = {fd = 18, events = 0, revents = 0}
FUNCTION = "tls_blocking_write"
#8 0x00007f4a68a6e93d in proto_tls_send (send_sock=0x7f4ad0013750,
buf=0x7f4ad054fde8 "NOTIFY sip:1000@1.fircommercial1.yxxxxx.com:5061;transport=TLS SIP/2.0\r\nVia: SIP/2.0/TLS 120.78.172.20:5061;branch=z9hG4bKPje0afeaec-87df-4618-aa15-0e51ed6042fe\r\nFrom: <sip:1000@1.fircommercial1.yeas"..., len=736, to=, id=) at proto_tls.c:505
c = 0x7f4a90dc12e8
dom =
ip = {af = 2, len = 4, u = {addrl = {2720288878, 139959299080976}, addr32 = {2720288878, 0, 3494773520, 32586}, addr16 = {20590, 41508, 0, 0, 784, 53326, 32586, 0},
addr = "nP$\242\000\000\000\000\020\003N\320J\177\000"}}
port =
fd = 18
n =
FUNCTION = "proto_tls_send"
#9 0x00005644fb422504 in msg_send (send_sock=0x7f4ad0013750, proto=3, to=0x7ffcf8760690, id=0,
buf=0x7f4ad054fde8 "NOTIFY sip:1000@1.fircommercial1.yxxxxx.com:5061;transport=TLS SIP/2.0\r\nVia: SIP/2.0/TLS 120.78.172.20:5061;branch=z9hG4bKPje0afeaec-87df-4618-aa15-0e51ed6042fe\r\nFrom: <sip:1000@1.fircommercial1.yeas"..., len=, msg=0x7f4ad04e0310) at forward.h:123
out_buff = {
s = 0x7f4ad054fde8 "NOTIFY sip:1000@1.fircommercial1.yxxxxx.com:5061;transport=TLS SIP/2.0\r\nVia: SIP/2.0/TLS 120.78.172.20:5061;branch=z9hG4bKPje0afeaec-87df-4618-aa15-0e51ed6042fe\r\nFrom: <sip:1000@1.fircommercial1.yeas"..., len = 736}
port =
ip =
FUNCTION = "msg_send"
#10 0x00005644fb423d3b in forward_request (msg=msg@entry=0x7f4ad04e0310, p=p@entry=0x7f4ad076ab88) at forward.c:382
--Type for more, q to quit, c to continue without paging--
to = {s = {sa_family = 2, sa_data = "ڽnP$\242\000\000\000\000\000\000\000"}, sin = {sin_family = 2, sin_port = 48602, sin_addr = {s_addr = 2720288878},
sin_zero = "\000\000\000\000\000\000\000"}, sin6 = {sin6_family = 2, sin6_port = 48602, sin6_flowinfo = 2720288878, sin6_addr = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>,
__u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, sin6_scope_id = 0}}
buf = {
s = 0x7f4ad054fde8 "NOTIFY sip:1000@1.fircommercial1.yxxxxx.com:5061;transport=TLS SIP/2.0\r\nVia: SIP/2.0/TLS 120.78.172.20:5061;branch=z9hG4bKPje0afeaec-87df-4618-aa15-0e51ed6042fe\r\nFrom: <sip:1000@1.fircommercial1.yeas"..., len = 736}
send_sock = 0x7f4ad0013750
last_sock = 0x7f4ad0013750
FUNCTION = "forward_request"
#11 0x00005644fb3f92b6 in w_forward (msg=0x7f4ad04e0310, dest=) at core_cmds.c:648
next_hop = {user = {s = 0x7ffcf8760880 " ", len = 21}, passwd = {s = 0x5644fb6111e8 "DBG:core:%s: doing DNS lookup...\n", len = 1}, host = {s = 0x7ffcf8760880 " ", len = 2}, port = {
s = 0x5644fd521950 "", len = -1047286528}, params = {s = 0x564400000000 <error: Cannot access memory at address 0x564400000000>, len = -805310448}, headers = {
s = 0x8 <error: Cannot access memory at address 0x8>, len = -800181832}, port_no = 7, proto = 0, type = ERROR_URI_T, transport = {s = 0x4 <error: Cannot access memory at address 0x4>,
len = 0}, ttl = {s = 0x7f4adfb2c363 <__syslog_chk+163> "H\213D$\030dH3\004%(", len = 48}, user_param = {s = 0x7ffcf8760890 "X\023a\373DV", len = -126482480}, maddr = {
s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>, len = -44960224}, method = {s = 0x7f4acffff010 "\377Ca\373DV", len = 64}, lr = {s = 0x5644fb6143ff "pkg",
len = 8}, r2 = {s = 0x7f4ad04e31b8 "nP$\242\070\060.36.162", len = -126481568}, gr = {s = 0x7f4adfb2c363 <__syslog_chk+163> "H\213D$\030dH3\004%(", len = 48}, pn_provider = {
s = 0x7ffcf87608f0 "", len = -126482384}, pn_prid = {s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>, len = 48}, pn_param = {
s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>, len = -126482352}, pn_purr = {s = 0x7ffcf87609d0 "\374\327\254\220J\177", len = 55997}, transport_val = {
s = 0x0, len = -797530280}, ttl_val = {s = 0x5644fb4889eb <sip_resolvehost+980> "A\213\a\211\005\034\306\064", len = -126481568}, user_param_val = {
s = 0x7f4adfb2c363 <__syslog_chk+163> "H\213D$\030dH3\004%(", len = 32}, maddr_val = {s = 0x5644fb4d94b1 <fm_malloc+984> "H\213D$(dH3\004%(", len = -77524136}, method_val = {
s = 0xddf2dca100000092 <error: Cannot access memory at address 0xddf2dca100000092>, len = 56}, lr_val = {s = 0x2dca1c193ad00 <error: Cannot access memory at address 0x2dca1c193ad00>,
len = 0}, r2_val = {s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>, len = -1867720708}, gr_val = {s = 0x7f4ad076a770 "\270\266M\320J\177",
len = -75673600}, pn_provider_val = {s = 0x5644fb611358 <FUNCTION.7250> "hostent_cpy", len = 0}, pn_prid_val = {s = 0x7f4ad04dda40 "\270\061N\320J\177", len = 0}, pn_param_val = {
s = 0x5644fb405e14 <hostent_cpy+1586> "I\211\006H\213s\030N\213\004>M\205\300\017\204\371\003", len = -800193776}, pn_purr_val = {s = 0x0, len = -77449184}, u_name = {{
s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>, len = 23}, {s = 0x7ffcf87609d0 "\374\327\254\220J\177", len = 55997}, {
s = 0x5644fb7d5130 <p_addr> " Q}\373DV", len = -797530280}, {s = 0x3 <error: Cannot access memory at address 0x3>, len = -126481568}, {
s = 0x5644fb4067d9 <mk_proxy+447> "\205\300\017\205\210\003", len = 45}, {s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>, len = -804080984}, {
s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>, len = -804080984}, {s = 0x7ffcf8760b60 "X\247v\320J\177", len = -126481968}, {s = 0x0,
len = -804078672}, {s = 0x1 <error: Cannot access memory at address 0x1>, len = -126481568}}, u_val = {{s = 0x5644fb3fc7af <fixup_forward_dest+132> "H\211\003H\205\300\017\204\230\001",
len = 3}, {s = 0x12 <error: Cannot access memory at address 0x12>, len = -1867720708}, {s = 0xddf2dca10000000d <error: Cannot access memory at address 0xddf2dca10000000d>, len = 24}, {
s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>, len = 24}, {s = 0x0, len = -76807056}, {
--Type for more, q to quit, c to continue without paging--
s = 0x5644fb430171 <get_cmd_fixups+848> "\205\300L\213D$\020\017\211P\376\377\377L\213=\213\002)", len = -800193776}, {s = 0x7ffcf8760a38 "", len = -126481504}, {
s = 0x7ffcf8760ba0 "\001", len = 0}, {s = 0x0, len = 0}, {s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>, len = 5}}, u_params_no = 48040}
u =
p = 0x7f4ad076ab88
ret =
FUNCTION = "w_forward"
#12 0x00005644fb3edf91 in do_action (a=0x7f4ad012bba8, msg=0x7f4ad04e0310) at action.c:973
ret =
v =
i =
len =
cmatch =
aitem =
adefault =
spec =
val = {rs = {s = 0x1 <error: Cannot access memory at address 0x1>, len = -1047286528}, ri = -126481528, flags = 32764}
start = {tv_sec = 1702375089, tv_usec = 940779}
end_time =
cmd = 0x5644fb6c0460 <core_cmds>
acmd =
cmdp = {0x7f4ad076a758, 0x0, 0x65782eb1, 0xe398e, 0x0, 0x7f4ad04dc335, 0x2d, 0x400000000}
tmp_vals = {{rs = {s = 0x1 <error: Cannot access memory at address 0x1>, len = 20}, ri = -76740886, flags = 22084}, {rs = {s = 0x7f4a90acd7f8 "TLS:110.80.36.162:55997", len = 23}, ri = 0,
flags = 4}, {rs = {s = 0x5644fb6d06ea <int2str_buf+42> "1", len = 1}, ri = 1, flags = 28}, {rs = {s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>,
len = -805247528}, ri = 0, flags = 0}, {rs = {s = 0x0, len = -77484912}, ri = 20, flags = 0}, {rs = {s = 0x1 <error: Cannot access memory at address 0x1>, len = -126481360},
ri = -1047286528, flags = -571286367}, {rs = {s = 0x7ffcf8760d20 "\300\224}\373DV", len = -1047286528}, ri = -804723976, flags = 32586}, {rs = {s = 0x7f4ad008e5b8 "\a", len = -800193776},
ri = 0, flags = 0}}
sval = {s = 0x7f4ad04e0310 "\350\t", len = 0}
FUNCTION = "do_action"
#13 0x00005644fb3ef8ce in run_action_list (msg=, a=) at action.c:158
ret = -1
t = 0x7f4ad012bba8
--Type for more, q to quit, c to continue without paging--
ret =
t =
#14 run_actions (msg=, a=) at action.c:123
ret =
ret =
FUNCTION = "run_actions"
#15 run_actions (msg=0x7f4ad04e0310, a=) at action.c:104
ret =
ret =
FUNCTION = "run_actions"
#16 do_action (a=0x7f4ad008e8b8, msg=0x7f4ad04e0310) at action.c:729
ret = -5
v =
i =
len =
cmatch =
aitem =
adefault =
spec =
val = {rs = {s = 0x5644fb6d0758 <int2str_buf+152> "0", len = 1}, ri = 0, flags = 0}
start = {tv_sec = 1702375089, tv_usec = 934850}
end_time =
cmd = 0x0
acmd =
cmdp = {0x5644fd521950, 0x7f4ad008ee90, 0x7f4ad008da58, 0x0, 0x5644fb7d94c0 <_oser_err_info>, 0x0, 0x7f4ad04e0310, 0x5644fb44b23c <eval_expr+412>}
tmp_vals = {{rs = {s = 0x5644fd521950 "", len = -804721008}, ri = -804726720, flags = 32586}, {rs = {s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>,
len = -75656000}, ri = -804725648, flags = 32586}, {rs = {s = 0x0, len = -79384076}, ri = -800193776, flags = 32586}, {rs = {s = 0x0, len = 11}, ri = -1047286528, flags = -571286367}, {
rs = {s = 0x564400000000 <error: Cannot access memory at address 0x564400000000>, len = -804725544}, ri = 0, flags = 0}, {rs = {
s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>, len = -800193776}, ri = -804721008, flags = 32586}, {rs = {s = 0x7f4ad008e030 "\002", len = 0},
ri = -75656000, flags = 22084}, {rs = {s = 0x0, len = -800193776}, ri = -79384004, flags = 22084}}
sval = {s = 0x7f4ad04e0310 "\350\t", len = 0}
--Type for more, q to quit, c to continue without paging--
FUNCTION = "do_action"
#17 0x00005644fb3f0b53 in run_action_list (a=, msg=0x7f4ad04e0310) at action.c:158
ret = -1
t = 0x7f4ad008e8b8
#18 0x00005644fb3f010a in do_action (a=0x7f4ad008ee90, msg=0x7f4ad04e0310) at action.c:756
ret = 1
v = 1
i =
len =
cmatch =
aitem =
adefault =
spec =
val = {rs = {s = 0x7f4ad04e0310 "\350\t", len = 0}, ri = -800193776, flags = 32586}
start = {tv_sec = 1702375089, tv_usec = 931995}
end_time =
cmd = 0x0
acmd =
cmdp = {0x0, 0x7f4ad04e0310, 0x14, 0x7f4ad008cff0, 0x0, 0x5644fb44d8e3 <eval_elem+9514>, 0x7ffc00000001, 0x7ffcf8761070}
tmp_vals = {{rs = {s = 0x5644fb6d0716 <int2str_buf+86> "1", len = -1047286528}, ri = 0, flags = 0}, {rs = {s = 0x7f4ad008cce0 "\022", len = -804729736}, ri = -1047286528, flags = -571286367}, {
rs = {s = 0x7f4ad008cb38 "N", len = -804730056}, ri = -76740798, flags = 22084}, {rs = {s = 0x1 <error: Cannot access memory at address 0x1>, len = 0}, ri = 0, flags = 22084}, {rs = {
s = 0x5644fb6d0742 <int2str_buf+130> "0", len = 1}, ri = 0, flags = 28}, {rs = {s = 0x12 <error: Cannot access memory at address 0x12>, len = -800193776}, ri = -79771876, flags = 22084}, {
rs = {s = 0xd008bf30 <error: Cannot access memory at address 0xd008bf30>, len = 0}, ri = 0, flags = 0}, {rs = {s = 0x0, len = -800193776}, ri = -1047286528, flags = -571286367}}
sval = {s = 0x14 <error: Cannot access memory at address 0x14>, len = 0}
FUNCTION = "do_action"
#19 0x00005644fb3f0b53 in run_action_list (a=, msg=0x7f4ad04e0310) at action.c:158
ret = -1
t = 0x7f4ad008ee90
#20 0x00005644fb3f021e in do_action (a=0x7f4ad008efb8, msg=0x7f4ad04e0310) at action.c:762
ret = 1
v = 0
--Type for more, q to quit, c to continue without paging--
i =
len =
cmatch =
aitem =
adefault =
spec =
val = {rs = {s = 0x5644fd51f620 "CST", len = -77511681}, ri = 72, flags = 0}
start = {tv_sec = 1702375089, tv_usec = 931931}
end_time =
cmd = 0x0
acmd =
cmdp = {0x7f4ad0145978, 0x15900000002, 0x564400000000, 0x7080, 0x5644fd51f620, 0x5644fb7fbd4f <buf+687>, 0x5644fb7fbd19 <buf+633>, 0x5644fb4d9d47 <fm_free+505>}
tmp_vals = {{rs = {s = 0x5644fb64ce28 <FUNCTION.9571> "parse_headers", len = 331}, ri = 6, flags = 22084}, {rs = {
s = 0x5644fb7fbbf5 <buf+341> "NOTIFY\r\nReal-Destination: 110.80.36.162:55997\r\nReal-Transport: TLS\r\nSubscription-State: terminated\r\nEvent: message-summary\r\nAllow-Events: presence, dialog, message-summary, refer\r\nMax-Forwards: 69\r\nUs"..., len = -75515232}, ri = 331, flags = 22084}, {rs = {s = 0x7f4ad04dd920 "X", len = 315}, ri = -126479696, flags = 32764}, {rs = {
s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>, len = 0}, ri = -1864775096, flags = 32586}, {rs = {s = 0x0, len = 0}, ri = -1864775096, flags = 32586},
{rs = {s = 0x7f4ad04e0310 "\350\t", len = -75515232}, ri = -541932701, flags = 32586}, {rs = {s = 0x3000000020 <error: Cannot access memory at address 0x3000000020>, len = -126479408},
ri = -126479600, flags = 32764}, {rs = {s = 0xddf2dca1c193ad00 <error: Cannot access memory at address 0xddf2dca1c193ad00>, len = -75515091}, ri = 260, flags = 0}}
sval = {s = 0x5644fb610de0 "DBG:core:%s: preparing to run routing scripts...\n", len = 1}
FUNCTION = "do_action"
#21 0x00005644fb3f0d61 in run_action_list (msg=, a=) at action.c:158
ret = -1
t = 0x7f4ad008efb8
#22 run_actions (msg=, a=) at action.c:123
ret =
FUNCTION = "run_actions"
#23 run_actions (msg=0x7f4ad04e0310, a=) at action.c:104
ret =
ret =
FUNCTION = "run_actions"
#24 run_top_route (a=, msg=msg@entry=0x7f4ad04e0310) at action.c:241
--Type for more, q to quit, c to continue without paging--
bk_action_flags = 0
bk_rec_lev = 0
ret =
ctx = 0x0
FUNCTION = "run_top_route"
#25 0x00005644fb404509 in receive_msg (
buf=0x5644fb7fbaa0 "NOTIFY sip:1000@192.168.41.86:5072 SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.41.88:10301;rport;branch=z9hG4bKPje0afeaec-87df-4618-aa15-0e51ed6042fe\r\nFrom: sip:1000@172.19.0.20;tag=e22b9213-2f3c-4ad4-bbfc-e4"..., len=, rcv_info=rcv_info@entry=0x7ffcf87618f0, existing_context=existing_context@entry=0x0, msg_flags=msg_flags@entry=0) at receive.c:250
ctx = 0x7f4ad04db2f0
msg = 0x7f4ad04e0310
start = {tv_sec = 1702375089, tv_usec = 700406}
rc = 3
old_route_type =
tmp =
in_buff = {
s = 0x5644fb7fbaa0 "NOTIFY sip:1000@192.168.41.86:5072 SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.41.88:10301;rport;branch=z9hG4bKPje0afeaec-87df-4618-aa15-0e51ed6042fe\r\nFrom: sip:1000@172.19.0.20;tag=e22b9213-2f3c-4ad4-bbfc-e4"..., len = 687}
FUNCTION = "receive_msg"
#26 0x00005644fb5e6656 in udp_read_req (si=, bytes_read=) at net/proto_udp/proto_udp.c:188
ri = {src_ip = {af = 2, len = 4, u = {addrl = {5774092480, 139958231569488}, addr32 = {1479125184, 1, 2427262032, 32586}, addr16 = {43200, 22569, 1, 0, 5200, 37037, 32586, 0},
addr = "\300\250)X\001\000\000\000P\024\255\220J\177\000"}}, dst_ip = {af = 2, len = 4, u = {addrl = {0, 0}, addr32 = {0, 0, 0, 0}, addr16 = {0, 0, 0, 0, 0, 0, 0, 0},
addr = '\000' <repeats 15 times>}}, src_port = 10301, dst_port = 5072, proto = 1, proto_reserved1 = 0, proto_reserved2 = 0, src_su = {s = {sa_family = 2,
sa_data = "(=\300\250)X\000\000\000\000\000\000\000"}, sin = {sin_family = 2, sin_port = 15656, sin_addr = {s_addr = 1479125184}, sin_zero = "\000\000\000\000\000\000\000"}, sin6 = {
sin6_family = 2, sin6_port = 15656, sin6_flowinfo = 1479125184, sin6_addr = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0,
0, 0, 0}}}, sin6_scope_id = 1}}, bind_address = 0x7f4ad0013f48}
len =
buf = "NOTIFY sip:1000@192.168.41.86:5072 SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.41.88:10301;rport;branch=z9hG4bKPje0afeaec-87df-4618-aa15-0e51ed6042fe\r\nFrom: sip:1000@172.19.0.20;tag=e22b9213-2f3c-4ad4-bbfc-e4"...
tmp =
fromlen = 16
p =
--Type for more, q to quit, c to continue without paging--
msg = {
s = 0x5644fb7fbaa0 "NOTIFY sip:1000@192.168.41.86:5072 SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.41.88:10301;rport;branch=z9hG4bKPje0afeaec-87df-4618-aa15-0e51ed6042fe\r\nFrom: sip:1000@172.19.0.20;tag=e22b9213-2f3c-4ad4-bbfc-e4"..., len = 687}
FUNCTION = "udp_read_req"
#27 0x00005644fb5b2cae in handle_io (idx=, event_type=, fm=) at net/net_udp.c:272
n =
read = 32586
n =
read =
FUNCTION = "handle_io"
#28 io_wait_loop_epoll (repeat=0, t=1, h=) at net/../io_wait_loop.h:308
ret =
n =
r = 0
i =
e =
ep_event = {events = 2430332552, data = {ptr = 0xd0013f4800007f00, fd = 32512, u32 = 32512, u64 = 14988330613335949056}}
fd =
curr_time = 7385
FUNCTION = "io_wait_loop_epoll"
#29 0x00005644fb5b825f in udp_start_processes (chd_rank=, startup_done=) at net/net_udp.c:497
si =
p_id =
i =
p =
FUNCTION = "udp_start_processes"
#30 0x00005644fb3acafc in main_loop () at main.c:828
startup_done = 0x7f4a90dbee88
last_check = 0
rc =
chd_rank = 7
--Type for more, q to quit, c to continue without paging--
startup_done =
last_check =
rc =
FUNCTION = "main_loop"
#31 main (argc=, argv=) at main.c:1521
c =
r =
tmp = 0x7ffcf876374b ""
tmp_len =
port =
proto =
protos_no =
options = 0x5644fb621040 "f:cCm:M:b:l:n:N:rRvdDFEVhw:t:u:g:p:P:G:W:o:a:k:s:"
seed = 1521088570
rfd =
FUNCTION = "main"
Describe the traffic that generated the bug
- Load the certificate file into the database every 5 seconds and execute opensips-cli -x mi tls_reload
- After using F_MALLOC and turning on DBG_MALLOC, it crashes after about an hour.
- The log prompts Double Free, CRITICAL:core:fm_free: freeing already freed shm pointer (0x7f4a90740bc0), first free: ../crypto/err/err.c: os_free(903) - aborting!
To Reproduce
Relevant System Logs
OS/environment information
- Operating System: Ubuntu 20.04.6 LTS
- OpenSIPS installation: source
- other relevant information:
Additional context