<div dir="ltr"><div><div>Hi,<br><br></div>I experienced some crashes when using strongswan 5.0.4.<br></div>The problem seems to be pretty straightforward, and based on the code, it could also affect update_sa.<br><div><div>
<div><div><br><br></div><div>The call trace is as follows:<br></div><div>...<br>Core was generated by `/usr/lib64/ipsec/charon --use-syslog'.<br>Program terminated with signal 6, Aborted.<br><br>(gdb) bt<br>#0 0x00007f203fb62b35 in raise () from /lib64/libc.so.6<br>
#1 0x00007f203fb64111 in abort () from /lib64/libc.so.6<br>#2 0x00000000004014f6 in segv_handler (signal=<optimized out>) at charon.c:183<br>#3 <signal handler called><br>#4 memwipe_inline (n=<optimized out>, ptr=<optimized out>) at utils/utils.h:411<br>
<b>#5 memwipe_noinline (ptr=0x0, n=139776064641392) at utils/utils.c:109</b><br>#6 0x00007f203878635d in memwipe (n=<optimized out>, ptr=<optimized out>) at ../../../../src/libstrongswan/utils/utils.h:432<br>
#7 query_sa (this=0x6394d0, src=<optimized out>, dst=0x673610, spi=305546929, protocol=50 '2', mark=<optimized out>, bytes=0x7f2026ae5ce0, packets=0x7f2026ae5cd8)<br> at kernel_netlink_ipsec.c:1685<br>
#8 0x00007f2040566e6b in update_usebytes (inbound=<optimized out>, this=<optimized out>) at sa/child_sa.c:432<br>#9 get_usestats (this=0x66a080, inbound=true, time=0x7f2026ae5d30, bytes=0x0, packets=0x0) at sa/child_sa.c:530<br>
#10 0x00007f2040567e31 in get_use_time (this=<optimized out>, inbound=true) at sa/ike_sa.c:288<br>#11 0x00007f204056a27d in send_dpd (this=0x66be40) at sa/ike_sa.c:594<br>#12 0x00007f204056466f in execute (this=<optimized out>) at processing/jobs/send_dpd_job.c:57<br>
#13 0x00007f20409e7fab in process_jobs (worker=0x6614a0) at processing/processor.c:219<br>#14 0x00007f20409ea678 in thread_main (this=0x6614d0) at threading/thread.c:309<br>#15 0x00007f20400b27b6 in start_thread () from /lib64/libpthread.so.0<br>
#16 0x00007f203fc09c5d in clone () from /lib64/libc.so.6<br>#17 0x0000000000000000 in ?? ()<br><br><br>(gdb) bt full<br>#0 0x00007f203fb62b35 in raise () from /lib64/libc.so.6<br>No symbol table info available.<br>#1 0x00007f203fb64111 in abort () from /lib64/libc.so.6<br>
No symbol table info available.<br>#2 0x00000000004014f6 in segv_handler (signal=<optimized out>) at charon.c:183<br> backtrace = 0x674e60<br>#3 <signal handler called><br>No symbol table info available.<br>
#4 memwipe_inline (n=<optimized out>, ptr=<optimized out>) at utils/utils.h:411<br> c = 0x66be40 "@\211V@ \177"<br> m = 139776064641384<br> i = 8<br>#5 memwipe_noinline (ptr=0x0, n=139776064641392) at utils/utils.c:109<br>
No locals.<br>#6 0x00007f203878635d in memwipe (n=<optimized out>, ptr=<optimized out>) at ../../../../src/libstrongswan/utils/utils.h:432<br>No locals.<br>#7 query_sa (this=0x6394d0, src=<optimized out>, dst=0x673610, spi=305546929, protocol=50 '2', mark=<optimized out>, bytes=0x7f2026ae5ce0, packets=0x7f2026ae5cd8)<br>
at kernel_netlink_ipsec.c:1685<br> request = "(\000\000\000\022\000\001\000H\002\000\000\342\063\000\000-\352\000\000\000\000\000\000\000\000\000\000\001\002\020\001\022\066F\261\n\000\062", '\000' <repeats 984 times><br>
out = 0x7f2026ae5968<br> hdr = <optimized out><br> sa_id = <optimized out><br> sa = 0x8<br> <b>status = FAILED<br> len = 139776064641392</b><br>#8 0x00007f2040566e6b in update_usebytes (inbound=<optimized out>, this=<optimized out>) at sa/child_sa.c:432<br>
No locals.<br>#9 get_usestats (this=0x66a080, inbound=true, time=0x7f2026ae5d30, bytes=0x0, packets=0x0) at sa/child_sa.c:530<br>No locals.<br>#10 0x00007f2040567e31 in get_use_time (this=<optimized out>, inbound=true) at sa/ike_sa.c:288<br>
enumerator = 0x66e550<br> child_sa = 0x66a080<br> use_time = 2757<br> current = 0<br>#11 0x00007f204056a27d in send_dpd (this=0x66be40) at sa/ike_sa.c:594<br> last_in = <optimized out><br>
diff = <optimized out><br> delay = 30<br> task_queued = false<br>#12 0x00007f204056466f in execute (this=<optimized out>) at processing/jobs/send_dpd_job.c:57<br> ike_sa = <optimized out><br>
#13 0x00007f20409e7fab in process_jobs (worker=0x6614a0) at processing/processor.c:219<br> requeue = {type = JOB_REQUEUE_TYPE_NONE, schedule = JOB_SCHEDULE, time = {rel = 0, abs = {tv_sec = 0, tv_usec = 0}}}<br> i = 1<br>
reserved = 2<br> idle = <optimized out><br> this = 0x60a4f0<br>#14 0x00007f20409ea678 in thread_main (this=0x6614d0) at threading/thread.c:309<br> __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {0, 609407318156031082, 139776490195072, 139776064643072, 140735743592080, 8388608, -705585307852557206,<br>
-705502153799846806}, __mask_was_saved = 0}}, __pad = {0x7f2026ae5f70, 0x0, 0x0, 0x0}}<br> not_first_call = <optimized out><br> res = <optimized out><br>#15 0x00007f20400b27b6 in start_thread () from /lib64/libpthread.so.0<br>
No symbol table info available.<br>#16 0x00007f203fc09c5d in clone () from /lib64/libc.so.6<br></div></div></div></div></div>