freeradius2.1.10 crash @ request_stats_final
Hi, I am using freeradius 2.1.10 and it has crashed @ the following line (debug via gdb) of request_stats_final where in the macro is called for #define INC_ACCT(_x) radius_acct_stats._x++;request->listener->stats._x++;if (request->client && request->client->acct) request->client->acct->_x++ #0 0x0041fdc8 in request_stats_final (request=0x1907d10) at stats.c:122 #1 0x0042656c in ev_request_free (prequest=0x7ffa5ae8) at event.c:182 #2 0x00426b74 in wait_a_bit (ctx=<value optimized out>) at event.c:1310 #3 0x0042a594 in no_response_to_proxied_request (ctx=0x1907d10) at event.c:1086 #4 0x2aaf3938 in fr_event_run (el=0x18f2920, when=<value optimized out>) at event.c:220 #5 0x2aaf3c7c in fr_event_loop (el=0x18f2920) at event.c:399 #6 0x0041f7b8 in main (argc=2, argv=0x7ffa5f14) at radiusd.c:410 I have also merged the latest code changes present @ https://github.com/alandekok/freeradius-server/blob/master/src/main/stats.c and added few null checks (attached stats.c). though the crash has reoccurred. Please let me know if there is anything I am missing out as a fix for the crash. Also, Is there any specific reason why the /src/main/event.c file has been moved in the master dir ? Regards, Winson -- View this message in context: http://freeradius.1045715.n5.nabble.com/freeradius2-1-10-crash-request-stats... Sent from the FreeRadius - Dev mailing list archive at Nabble.com.
winson wrote:
Hi, I am using freeradius 2.1.10 and it has crashed @ the following line (debug via gdb) of request_stats_final where in the macro is called for #define INC_ACCT(_x) radius_acct_stats._x++;request->listener->stats._x++;if (request->client && request->client->acct) request->client->acct->_x++
Well, what are the values of those pointers? It's hard to know which one is causing the problem if you don't say what the values are.
I have also merged the latest code changes present @ https://github.com/alandekok/freeradius-server/blob/master/src/main/stats.c and added few null checks (attached stats.c). though the crash has reoccurred.
Nothing attached, sorry.
Also, Is there any specific reason why the /src/main/event.c file has been moved in the master dir ?
It's been replaced by process.c. Much, much, better code. Alan DeKok.
Hi Alan, the detailed core dump and stats.c file attached : (gdb) frame 0 #0 0x0041fdc8 in request_stats_final (request=0x1907d10) at stats.c:122 122 INC_ACCT(total_packets_dropped); (gdb) info args request = (REQUEST *) 0x1907d10 (gdb) info locals No locals. (gdb) p *(REQUEST*)0x1907d10 $15 = {packet = 0x19094a8, proxy = 0x19017b8, reply = 0x19095c8, proxy_reply = 0x0, config_items = 0x1901318, username = 0x1909670, password = 0x0, root = 0x4549c0, data = 0x0, client = 0x548aa0, child_pid = 0, timestamp = 1306390379, number = 167, listener = 0x18f6468, proxy_listener = 0x18f72a8, simul_max = 7, simul_count = 0, simul_mpp = 0, options = 2, module = 0x437dd8 "", component = 0x43c958 "<core>", received = {tv_sec = 1306390379, tv_usec = 650024}, when = {tv_sec = 1306390393, tv_usec = 650363}, delay = 1000000, master_state = 1, child_state = 2, priority = RAD_LISTEN_AUTH, ev = 0x0, next_when = {tv_sec = 1306390393, tv_usec = 650363}, next_callback = 0, in_request_hash = 0, in_proxy_hash = 0, home_server = 0x45e558, home_pool = 0x45ec20, proxy_when = {tv_sec = 1306390379, tv_usec = 650363}, num_proxied_requests = 1, num_proxied_responses = 0, server = 0x0, parent = 0x0, radlog = 0, coa = 0x0, num_coa_requests = 0} (gdb) p *((REQUEST*)0x1907d10)->client $16 = {ipaddr = {af = 838482724, ipaddr = {ip4addr = {s_addr = 33541119}, ip6addr = {in6_u = { u6_addr8 = "\001ÿËÿ\000\000\000)\000T\212Ì\000\000\000", u6_addr16 = {511, 52223, 0, 41, 84, 35532, 0, 0}, u6_addr32 = {33541119, 41, 5540556, 0}}}}, scope = 0}, prefix = 5540524, longname = 0x19168c4 "\001\221hä", secret = 0x38fa3b24 <Address 0x38fa3b24 out of bounds>, shortname = 0x1ffcbff <Address 0x1ffcbff out of bounds>, message_authenticator = 42, nastype = 0x548aec "", login = 0x548a8c "", password = 0x548aac "", server = 0x548a8c "", number = 26306756, cs = 0x7ffa3c1c, auth = 0x10fa0cf0, acct = 0x29, lifetime = 5540716, dynamic = 5540460, created = 5540556, last_new_client = 5540588, client_server = 0x19168c4 "\001\221hä", rate_limit = 0, coa_name = 0xafa0c00 <Address 0xafa0c00 out of bounds>, coa_server = 0x2b, coa_pool = 0x548b4c} (gdb) p *((REQUEST*)0x1907d10)->client->acct Cannot access memory at address 0x29. http://freeradius.1045715.n5.nabble.com/file/n4428429/stats.c stats.c -- View this message in context: http://freeradius.1045715.n5.nabble.com/freeradius2-1-10-crash-request-stats... Sent from the FreeRadius - Dev mailing list archive at Nabble.com.
participants (2)
-
Alan DeKok -
winson