<div dir="ltr"><div><div>Hello,<br><br></div>I have a crash with the following scenario:<br>I try to route an INVITE to a remote host, it fails, I route to the second suing the dispatcher module. It fails the second time and I stop the call. It seems that I did not release the transaction in this case<br>
<br>93454 Feb 28 11:39:08 kamailio23 /usr/local/sbin/kamailio[20225]: WARNING: tm [t_lookup.c:1536]: t_unref(): WARNING: script writer didn't release transaction<br><br></div>And then, Kamailio receives BYE of other dialogs and it crashes <br>
<div><br>Here is core bt of 2 kamailio processes (4.1.1)<br><br><span style="color:rgb(255,0,0)">(gdb) bt full</span><br>#0 0x0000000000534e4e in timer_list_expire (t=1283469267, h=0x7ff9219e99b8, slow_l=0x7ff9219e9c88, slow_mark=12) at timer.c:883<br>
tl = 0x7ff921c6b8f0<br> ret = 32767<br>#1 0x00000000005351ba in timer_handler () at timer.c:959<br> saved_ticks = 1283469267<br> run_slow_timer = 0<br> i = 12<br> __FUNCTION__ = "timer_handler"<br>
#2 0x0000000000535453 in timer_main () at timer.c:998<br>No locals.<br>#3 0x000000000046efa2 in main_loop () at main.c:1688<br> i = 8<br> pid = 0<br> si = 0x0<br> si_desc = "udp receiver child=7 sock=<a href="http://91.213.79.31:5060">91.213.79.31:5060</a>\000\001", '\000' <repeats 19 times>, "\020\000\000\000\000\000\000\000\243Mgf\000\000\000\000\260vA\000\000\000\000\000\020\201\351a\377\177", '\000' <repeats 18 times>, "P\177\351a\377\177\000\000\002\266K\000\000\000\000"<br>
nrprocs = 8<br> __FUNCTION__ = "main_loop"<br>#4 0x0000000000471c38 in main (argc=5, argv=0x7fff61e98118) at main.c:2533<br> cfg_stream = 0x1970010<br> c = -1<br> r = 0<br> tmp = 0x7fff61e98148 "\211\236\351a\377\177"<br>
tmp_len = 0<br> port = 5<br> proto = 0<br> options = 0x5de800 ":f:cm:M:dVIhEeb:l:L:n:vKrRDTN:W:w:t:u:g:P:G:SQ:O:a:A:"<br> ret = -1<br> seed = 519948236<br> rfd = 4<br>
debug_save = 0<br> debug_flag = 0<br> dont_fork_cnt = 0<br> n_lst = 0xbf<br> p = 0x416bd9 "H\203\304\b\303" <Address 0x416bde out of bounds><br> __FUNCTION__ = "main"<br>
<br><span style="color:rgb(255,0,0)">(gdb) bt full</span><br>#0 0x00007ff92abf3475 in raise () from /lib/x86_64-linux-gnu/libc.so.6<br>No symbol table info available.<br>#1 0x00007ff92abf66f0 in abort () from /lib/x86_64-linux-gnu/libc.so.6<br>
No symbol table info available.<br>#2 0x0000000000548253 in qm_free (qm=0x7ff921970000, p=0x7ff921c3b940, file=0x7ff92925362d "tm: h_table.c", func=0x7ff9292537d8 "free_cell", line=178) at mem/q_malloc.c:470<br>
f = 0x7ff921c3b910<br> size = 5600<br> next = 0x7fff61e97ac0<br> prev = 0x7ff9291e571e<br> __FUNCTION__ = "qm_free"<br>#3 0x00007ff9291e64a9 in free_cell (dead_cell=0x7ff921c6b870) at h_table.c:178<br>
b = 0x0<br> i = 1<br> rpl = 0x0<br> tt = 0x0<br> foo = 0x5000548a29<br> cbs = 0x0<br> cbs_tmp = 0x7ff921c3b940<br> __FUNCTION__ = "free_cell"<br>#4 0x00007ff9291e7480 in free_hash_table () at h_table.c:441<br>
p_cell = 0x7ff921c6b870<br> tmp_cell = 0x7ff921a159f0<br> i = 37066<br> __FUNCTION__ = "free_hash_table"<br>#5 0x00007ff9291fad35 in tm_shutdown () at t_funcs.c:122<br> __FUNCTION__ = "tm_shutdown"<br>
#6 0x00000000004f8101 in destroy_modules () at sr_module.c:817<br> t = 0x7ff92a807d50<br> foo = 0x7ff92a807588<br> __FUNCTION__ = "destroy_modules"<br>#7 0x00000000004689b2 in cleanup (show_status=1) at main.c:560<br>
memlog = 32761<br> __FUNCTION__ = "cleanup"<br>#8 0x0000000000469aab in shutdown_children (sig=15, show_status=1) at main.c:702<br> __FUNCTION__ = "shutdown_children"<br>#9 0x000000000046b146 in handle_sigs () at main.c:793<br>
chld = 0<br> chld_status = 139<br> memlog = 0<br> __FUNCTION__ = "handle_sigs"<br>#10 0x000000000046f549 in main_loop () at main.c:1746<br> i = 8<br> pid = 20250<br> si = 0x0<br>
si_desc = "udp receiver child=7 sock=<a href="http://91.213.79.31:5060">91.213.79.31:5060</a>\000\001", '\000' <repeats 19 times>, "\020\000\000\000\000\000\000\000\243Mgf\000\000\000\000\260vA\000\000\000\000\000\020\201\351a\377\177", '\000' <repeats 18 times>, "P\177\351a\377\177\000\000\002\266K\000\000\000\000"<br>
nrprocs = 8<br> __FUNCTION__ = "main_loop"<br>#11 0x0000000000471c38 in main (argc=5, argv=0x7fff61e98118) at main.c:2533<br> cfg_stream = 0x1970010<br> c = -1<br> r = 0<br> tmp = 0x7fff61e98148 "\211\236\351a\377\177"<br>
tmp_len = 0<br> port = 5<br> proto = 0<br> options = 0x5de800 ":f:cm:M:dVIhEeb:l:L:n:vKrRDTN:W:w:t:u:g:P:G:SQ:O:a:A:"<br> ret = -1<br> seed = 519948236<br> rfd = 4<br>
debug_save = 0<br> debug_flag = 0<br> dont_fork_cnt = 0<br> n_lst = 0xbf<br> p = 0x416bd9 "H\203\304\b\303" <Address 0x416bde out of bounds><br> __FUNCTION__ = "main"<br>
<br></div><div>Thank you for your help<br></div></div>