Hi!

For me, on two different 5.3-stable machines a simple ikectl reload
triggers a loop in the 'iked: ikev2' process. Aborting 'iked: ikev2' a
few times, it usually gets the signal in event_queue_remove() in
event_del().

To reproduce, basically I just start iked (no matter with that
parameters), invoke `ikectl reload`, then after ~2 seconds ikev2 starts
spinning. It doesn't even need an iked.conf, it is just an empty file.

In more detail: I started /sbin/iked -dvv, executed ikectl reload,
waited until "config_getcompile: compilation done" showed up in iked's
terminal, then saw iked's processor use rise up in top(1), then pkill
-ABRT -f ikev2. Now I saved these coredumps under different names:
iked.core-[0-9]+ , then executed gdb in a loop from a shell and got the
bt from every (currently six) coredump [1].

I also recompiled libevent with -DUSE_DEBUG (then recompiled sbin/iked),
and saved iked -dvv's (and libevent's) output on the terminal [2].

Anyone got any idea what could be going on?


[1]:
============= iked.core-1 =============
Core was generated by `iked'.
Program terminated with signal 6, Aborted.
#0  event_queue_insert (base=0x7feddc00, ev=0x7d10a48c, queue=8) at 
/usr/src/lib/libevent/event.c:1000
1000            switch (queue) {
#0  event_queue_insert (base=0x7feddc00, ev=0x7d10a48c, queue=8) at 
/usr/src/lib/libevent/event.c:1000
#1  0x1c032a7d in event_base_loop (base=0x7feddc00, flags=0) at 
/usr/src/lib/libevent/event.c:952
#2  0x1c032b3a in event_loop (flags=0) at /usr/src/lib/libevent/event.c:478
#3  0x1c032b52 in event_dispatch () at /usr/src/lib/libevent/event.c:416
#4  0x1c028184 in proc_run (ps=0x7d10a4e0, p=0x3c03e47c, procs=0x3c03e520, 
nproc=3, init=0, arg=0x0) at /usr/src/sbin/iked/proc.c:276
#5  0x1c00a69c in ikev2 (ps=0x7d10a4e0, p=0x3c03e47c) at 
/usr/src/sbin/iked/ikev2.c:114
#6  0x1c02797a in proc_init (ps=0x7d10a4e0, p=0x3c03e47c, nproc=3) at 
/usr/src/sbin/iked/proc.c:61
#7  0x1c00955a in main (argc=2, argv=0xcfbc8ad8) at 
/usr/src/sbin/iked/iked.c:157

============= iked.core-2 =============
Core was generated by `iked'.
Program terminated with signal 6, Aborted.
#0  event_base_loop (base=0x8b986000, flags=0) at min_heap.h:65
65      struct event* min_heap_top(min_heap_t* s) { return s->n ? *s->p : 0; }
#0  event_base_loop (base=0x8b986000, flags=0) at min_heap.h:65
#1  0x1c032b3a in event_loop (flags=0) at /usr/src/lib/libevent/event.c:478
#2  0x1c032b52 in event_dispatch () at /usr/src/lib/libevent/event.c:416
#3  0x1c028184 in proc_run (ps=0x8b6074e0, p=0x3c03e47c, procs=0x3c03e520, 
nproc=3, init=0, arg=0x0) at /usr/src/sbin/iked/proc.c:276
#4  0x1c00a69c in ikev2 (ps=0x8b6074e0, p=0x3c03e47c) at 
/usr/src/sbin/iked/ikev2.c:114
#5  0x1c02797a in proc_init (ps=0x8b6074e0, p=0x3c03e47c, nproc=3) at 
/usr/src/sbin/iked/proc.c:61
#6  0x1c00955a in main (argc=2, argv=0xcfbecc8c) at 
/usr/src/sbin/iked/iked.c:157

============= iked.core-3 =============
Core was generated by `iked'.
Program terminated with signal 6, Aborted.
#0  event_queue_insert (base=0x7f44fc00, ev=0x8a86848c, queue=8) at 
/usr/src/lib/libevent/event.c:1016
1016    }
#0  event_queue_insert (base=0x7f44fc00, ev=0x8a86848c, queue=8) at 
/usr/src/lib/libevent/event.c:1016
#1  0x1c032a7d in event_base_loop (base=0x7f44fc00, flags=0) at 
/usr/src/lib/libevent/event.c:952
#2  0x1c032b3a in event_loop (flags=0) at /usr/src/lib/libevent/event.c:478
#3  0x1c032b52 in event_dispatch () at /usr/src/lib/libevent/event.c:416
#4  0x1c028184 in proc_run (ps=0x8a8684e0, p=0x3c03e47c, procs=0x3c03e520, 
nproc=3, init=0, arg=0x0) at /usr/src/sbin/iked/proc.c:276
#5  0x1c00a69c in ikev2 (ps=0x8a8684e0, p=0x3c03e47c) at 
/usr/src/sbin/iked/ikev2.c:114
#6  0x1c02797a in proc_init (ps=0x8a8684e0, p=0x3c03e47c, nproc=3) at 
/usr/src/sbin/iked/proc.c:61
#7  0x1c00955a in main (argc=2, argv=0xcfbdef30) at 
/usr/src/sbin/iked/iked.c:157

============= iked.core-4 =============
Core was generated by `iked'.
Program terminated with signal 6, Aborted.
#0  event_queue_remove (base=0x8abaf000, ev=0x88a7848c, queue=8) at 
/usr/src/lib/libevent/event.c:958
958     {
#0  event_queue_remove (base=0x8abaf000, ev=0x88a7848c, queue=8) at 
/usr/src/lib/libevent/event.c:958
#1  0x1c0321ee in event_del (ev=0x88a7848c) at /usr/src/lib/libevent/event.c:836
#2  0x1c032a65 in event_base_loop (base=0x8abaf000, flags=0) at 
/usr/src/lib/libevent/event.c:948
#3  0x1c032b3a in event_loop (flags=0) at /usr/src/lib/libevent/event.c:478
#4  0x1c032b52 in event_dispatch () at /usr/src/lib/libevent/event.c:416
#5  0x1c028184 in proc_run (ps=0x88a784e0, p=0x3c03e47c, procs=0x3c03e520, 
nproc=3, init=0, arg=0x0) at /usr/src/sbin/iked/proc.c:276
#6  0x1c00a69c in ikev2 (ps=0x88a784e0, p=0x3c03e47c) at 
/usr/src/sbin/iked/ikev2.c:114
#7  0x1c02797a in proc_init (ps=0x88a784e0, p=0x3c03e47c, nproc=3) at 
/usr/src/sbin/iked/proc.c:61
#8  0x1c00955a in main (argc=2, argv=0xcfbf3c1c) at 
/usr/src/sbin/iked/iked.c:157

============= iked.core-5 =============
Core was generated by `iked'.
Program terminated with signal 6, Aborted.
#0  event_base_loop (base=0x86506800, flags=0) at min_heap.h:65
65      struct event* min_heap_top(min_heap_t* s) { return s->n ? *s->p : 0; }
#0  event_base_loop (base=0x86506800, flags=0) at min_heap.h:65
#1  0x1c032b3a in event_loop (flags=0) at /usr/src/lib/libevent/event.c:478
#2  0x1c032b52 in event_dispatch () at /usr/src/lib/libevent/event.c:416
#3  0x1c028184 in proc_run (ps=0x7f0434e0, p=0x3c03e47c, procs=0x3c03e520, 
nproc=3, init=0, arg=0x0) at /usr/src/sbin/iked/proc.c:276
#4  0x1c00a69c in ikev2 (ps=0x7f0434e0, p=0x3c03e47c) at 
/usr/src/sbin/iked/ikev2.c:114
#5  0x1c02797a in proc_init (ps=0x7f0434e0, p=0x3c03e47c, nproc=3) at 
/usr/src/sbin/iked/proc.c:61
#6  0x1c00955a in main (argc=2, argv=0xcfbd6fe8) at 
/usr/src/sbin/iked/iked.c:157

============= iked.core-6 =============
Core was generated by `iked'.
Program terminated with signal 6, Aborted.
#0  0x1c031db1 in event_queue_remove (base=0x85050800, ev=0x857ef48c, queue=8) 
at /usr/src/lib/libevent/event.c:958
958     {
#0  0x1c031db1 in event_queue_remove (base=0x85050800, ev=0x857ef48c, queue=8) 
at /usr/src/lib/libevent/event.c:958
#1  0x1c0321ee in event_del (ev=0x857ef48c) at /usr/src/lib/libevent/event.c:836
#2  0x1c032a65 in event_base_loop (base=0x85050800, flags=0) at 
/usr/src/lib/libevent/event.c:948
#3  0x1c032b3a in event_loop (flags=0) at /usr/src/lib/libevent/event.c:478
#4  0x1c032b52 in event_dispatch () at /usr/src/lib/libevent/event.c:416
#5  0x1c028184 in proc_run (ps=0x857ef4e0, p=0x3c03e47c, procs=0x3c03e520, 
nproc=3, init=0, arg=0x0) at /usr/src/sbin/iked/proc.c:276
#6  0x1c00a69c in ikev2 (ps=0x857ef4e0, p=0x3c03e47c) at 
/usr/src/sbin/iked/ikev2.c:114
#7  0x1c02797a in proc_init (ps=0x857ef4e0, p=0x3c03e47c, nproc=3) at 
/usr/src/sbin/iked/proc.c:61
#8  0x1c00955a in main (argc=2, argv=0xcfbbd79c) at 
/usr/src/sbin/iked/iked.c:157


[2]:
http://pastebin.com/U8WTVshz
Around line #392 one can notice the loop. I've trimmed most of the
redundant lines.


Daniel

-- 
LÉVAI Dániel
PGP key ID = 0x83B63A8F
Key fingerprint = DBEC C66B A47A DFA2 792D  650C C69B BE4C 83B6 3A8F

Reply via email to