[BUG] rtp_relay crash

[twocolors]

OpenSIPS version you are running

version: opensips 3.4.17 (x86_64/linux)
flags: STATS: On, DISABLE_NAGLE, USE_MCAST, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, HP_MALLOC, DBG_MALLOC, FAST_LOCK-ADAPTIVE_WAIT
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535
poll method support: poll, epoll, sigio_rt, select.
git revision: 3e7ad039d
main.c compiled on  with gcc 12

Describe the bug

Stack trace of thread 533866:
#0  0x00007f32d4badc1a n/a (rtp_relay.so + 0x9c1a)
#1  0x00007f32d4bbc9e7 rtp_relay_copy_delete (rtp_relay.so + 0x189e7)
#2  0x00007f32d45edabe n/a (siprec.so + 0xdabe)
#3  0x00007f32d4ab18e0 run_dlg_callbacks (dialog.so + 0x168e0)
#4  0x00007f32d4acd9f9 dlg_onroute (dialog.so + 0x329f9)
#5  0x00007f32d4c4b105 run_rr_callbacks (rr.so + 0x9105)
#6  0x00007f32d4c45645 n/a (rr.so + 0x3645)
#7  0x000056215926036d do_action (opensips + 0x2636d)
#8  0x00005621592620a0 run_action_list (opensips + 0x280a0)
#9  0x00005621592d693d eval_expr (opensips + 0x9c93d)
#10 0x000056215925f5df do_action (opensips + 0x255df)
#11 0x00005621592620a0 run_action_list (opensips + 0x280a0)
#12 0x0000562159260fb1 do_action (opensips + 0x26fb1)
#13 0x00005621592620a0 run_action_list (opensips + 0x280a0)
#14 0x00005621592625a4 run_top_route (opensips + 0x285a4)
#15 0x00005621592c8b78 receive_msg (opensips + 0x8eb78)
#16 0x00005621593f4427 n/a (opensips + 0x1ba427)
#17 0x00005621593e0a4f n/a (opensips + 0x1a6a4f)
#18 0x00005621593e1ab1 n/a (opensips + 0x1a7ab1)
#19 0x00005621593e7815 udp_start_processes (opensips + 0x1ad815)
#20 0x000056215925c991 main (opensips + 0x22991)
#21 0x00007f33e4d1224a __libc_start_call_main (libc.so.6 + 0x2724a)
#22 0x00007f33e4d12305 __libc_start_main_impl (libc.so.6 + 0x27305)
#23 0x000056215925d071 _start (opensips + 0x23071)
ELF object binary architecture: AMD x86-64

To Reproduce

Expected behavior

Relevant System Logs

OS/environment information

• Operating System: Debian GNU/Linux 12 (bookworm)
• OpenSIPS installation: debs
• other relevant information:

Additional context

[razvancrainea]

Please install opensips-dbg package and run again the backtrace.

[twocolors]

#0  0x00007fcbfbf44c1a in __list_del (next=0x100100, prev=0x200200) at ../../lib/list.h:98
#1  list_del (entry=0x7fcbfc8ddb28) at ../../lib/list.h:110
#2  rtp_copy_ctx_free (copy_ctx=0x7fcbfc8ddb08) at ./modules/rtp_relay/rtp_relay_ctx.c:243
#3  0x00007fcbfbf539e7 in rtp_relay_copy_delete (_ctx=0x1, id=0x7fcbfbed1110 <mod_name>, flags=0x7fcbfc481b38) at ./modules/rtp_relay/rtp_relay_ctx.c:2902
#4  0x00007fcbfbebfabe in srec_dlg_end (dlg=<optimized out>, type=<optimized out>, _params=<optimized out>) at ./modules/siprec/siprec_logic.c:149
#5  0x00007fcbfb9768e0 in run_dlg_callbacks (type=type@entry=32, dlg=dlg@entry=0x7fcbfc52b740, msg=msg@entry=0x7fccfcdd27a0, dir=<optimized out>, dst_leg=<optimized out>, 
    dlg_data=dlg_data@entry=0x0, locked=0, is_active=1) at ./modules/dialog/dlg_cb.c:256
#6  0x00007fcbfb9929f9 in dlg_onroute (req=<optimized out>, route_params=<optimized out>, param=<optimized out>) at ./modules/dialog/dlg_handlers.c:2158
#7  0x00007fcbfbfe2105 in run_rr_callbacks (req=req@entry=0x7fccfcdd27a0, rr_params=rr_params@entry=0x7fffd6de6020) at ./modules/rr/rr_cb.c:97
#8  0x00007fcbfbfdc645 in after_loose (_m=0x7fccfcdd27a0, preloaded=0) at ./modules/rr/loose.c:880
#9  0x000055890007236d in do_action (a=a@entry=0x7fccfc091e48, msg=msg@entry=0x7fccfcdd27a0) at ./action.c:1048
#10 0x00005589000740a0 in run_action_list (a=<optimized out>, msg=msg@entry=0x7fccfcdd27a0) at ./action.c:190
#11 0x00005589000e893d in eval_elem (val=0x0, msg=0x7fccfcdd27a0, e=0x7fccfc091f78) at ./route.c:813
#12 eval_expr (e=0x7fccfc091f78, msg=msg@entry=0x7fccfcdd27a0, val=val@entry=0x0) at ./route.c:1137
#13 0x00005589000715df in do_action (a=a@entry=0x7fccfc0923b8, msg=msg@entry=0x7fccfcdd27a0) at ./action.c:812
#14 0x00005589000740a0 in run_action_list (a=<optimized out>, msg=msg@entry=0x7fccfcdd27a0) at ./action.c:190
#15 0x0000558900072fb1 in do_action (a=a@entry=0x7fccfc092800, msg=msg@entry=0x7fccfcdd27a0) at ./action.c:836
#16 0x00005589000740a0 in run_action_list (a=a@entry=0x7fccfc08ee08, msg=msg@entry=0x7fccfcdd27a0) at ./action.c:190
#17 0x00005589000745a4 in run_actions (msg=0x7fccfcdd27a0, a=0x7fccfc08ee08) at ./action.c:136
#18 run_top_route (sr=..., msg=msg@entry=0x7fccfcdd27a0) at ./action.c:250
#19 0x00005589000dab78 in receive_msg (
    buf=0x558900460b80 <buf> "BYE sip:192.168.22.133:5060 SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.22.130:5060;branch=z9hG4bK7441881156527mrrk64f77vvm;Role=3;Dpt=7511_16,SIP/2.0/UDP 192.168.18.10:5060;branch=z9hG4bKtglgl3gqbfa3smirogapqtrs1;X-"..., len=<optimized out>, rcv_info=rcv_info@entry=0x7fffd6de7030, existing_context=existing_context@entry=0x0, msg_flags=msg_flags@entry=0) at ./receive.c:230
#20 0x0000558900206427 in udp_read_req (si=<optimized out>, bytes_read=<optimized out>) at net/proto_udp/proto_udp.c:186
#21 0x00005589001f2a4f in handle_io (fm=0x7fccfc0d0ca8, event_type=event_type@entry=1, idx=0) at net/net_udp.c:295
#22 0x00005589001f3ab1 in io_wait_loop_epoll (repeat=<optimized out>, t=<optimized out>, h=<optimized out>) at net/../io_wait_loop.h:305
#23 0x00005589001f9815 in udp_start_processes (chd_rank=chd_rank@entry=0x55890032f218 <chd_rank>, startup_done=startup_done@entry=0x0) at net/net_udp.c:528
#24 0x000055890006e991 in main_loop () at ./main.c:237
#25 main (argc=<optimized out>, argv=<optimized out>) at ./main.c:966

if you need the full, please let me know

[sahmed-bw]

Hello @twocolors, We are also facing a similar issue. Could you please confirm whether this issue still persists in the latest 3.6.x release?

[twocolors]

Hello @twocolors, We are also facing a similar issue. Could you please confirm whether this issue still persists in the latest 3.6.x release?

not use branch 3.6.x have bug #3811 on siprec (fix if init route add ua_session_server_init())

[sahmed-bw]

having similar crash with 3.6.5 version.

May 14 16:30:17 [27] INFO:[dummy-1] E_SIPREC_STOP fired - callid=B2B.331.8239261.1778776186.1247361854
May 14 16:30:17 [27] INFO:SIPREC stopped: callid=B2B.331.8239261.1778776186.1247361854 group=<null>
May 14 16:30:17 [27] DBG:core:release_dummy_sip_msg: cleaning the static sip msg 0x7ffffe816580
May 14 16:30:17 [27] DBG:core:destroy_avp_list: destroying list (nil)
May 14 16:30:17 [28] DBG:core:release_dummy_sip_msg: cleaning the static sip msg 0x7ffffe818110
May 14 16:30:17 [28] DBG:core:destroy_avp_list: destroying list (nil)
May 14 16:30:17 [28] DBG:dialog:run_dlg_callbacks: dialog=0x7ffffc9c4f08, type=32
May 14 16:30:17 [28] DBG:core:parse_headers_aux: flags=10
May 14 16:30:17 [28] DBG:rtp_relay:rtp_relay_delete: callid=[1-102@172.16.250.42] ftag=[] ttag=[4] ctx-flags=[] delete-flags=[]
May 14 16:30:17 [28] CRITICAL:core:sig_usr: segfault in process pid: 28, id: 4
May 14 16:30:17 [28] DBG:core:restore_segv_handler: restoring SIGSEGV handler...
May 14 16:30:17 [28] DBG:core:restore_segv_handler: successfully restored system SIGSEGV handler
May 14 16:30:17 [24] DBG:core:handle_sigs: OpenSIPS exit status = 139
May 14 16:30:17 [24] INFO:core:handle_sigs: child process 28 exited by a signal 11
May 14 16:30:17 [24] INFO:core:handle_sigs: core was generated
May 14 16:30:17 [24] INFO:core:handle_sigs: terminating due to SIGCHLD