innd core dump on 2.5.0 (svn r7524)

[Gea-Suan Lin]

Hello,

After install inn 2.5.0 (r7524), innd will core dump about starting up
4 ~ 8 hours.

Envorinment:
FreeBSD 6.1-RELEASE, BerkeleyDB 4.2.2 (installed from ports)

Configure Command:
./configure --prefix=/home/news --with-perl --with-berkeleydb --with-zlib

Some settings:
http://netnews.nctu.edu.tw/~news/inn.conf

GDB with coredump:
netnews [/home/news] -news- gdb bin/innd ~/spool/articles/innd.core
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd"...
Core was generated by `innd'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/local/lib/libdb-4.2.so.2...done.
Loaded symbols for /usr/local/lib/libdb-4.2.so.2
Reading symbols from /lib/libz.so.3...done.
Loaded symbols for /lib/libz.so.3
Reading symbols from /usr/local/lib/perl5/5.8.8/mach/CORE/libperl.so...done.
Loaded symbols for /usr/local/lib/perl5/5.8.8/mach/CORE/libperl.so
Reading symbols from /lib/libm.so.4...done.
Loaded symbols for /lib/libm.so.4
Reading symbols from /lib/libcrypt.so.3...done.
Loaded symbols for /lib/libcrypt.so.3
Reading symbols from /lib/libutil.so.5...done.
Loaded symbols for /lib/libutil.so.5
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /usr/local/lib/perl5/site_perl/5.8.8/mach/auto/Digest/MD5/MD5.so...done.
Loaded symbols for /usr/local/lib/perl5/site_perl/5.8.8/mach/auto/Digest/MD5/MD5.so
Reading symbols from /usr/local/lib/perl5/5.8.8/mach/auto/Data/Dumper/Dumper.so...done.
Loaded symbols for /usr/local/lib/perl5/5.8.8/mach/auto/Data/Dumper/Dumper.so
Reading symbols from /libexec/ld-elf.so.1...done.
Loaded symbols for /libexec/ld-elf.so.1
#0  WIPfree (wp=0x9a3a3c0) at wip.c:84
84              if (wp->Chan->PrecommitWIP[i] == wp) {
(gdb) bt
#0  WIPfree (wp=0x9a3a3c0) at wip.c:84
#1  0x0806cda3 in WIPprecomfree (cp=0x81075d8) at wip.c:61
#2  0x0805a307 in CHANclose (cp=0x81075d8, name=0x8107ca0 "news-peer.nctu.edu.tw:83")
    at chan.c:282
#3  0x080607a5 in NCreader (cp=0x81075d8) at nc.c:1140
#4  0x0805b04f in CHANreadloop () at chan.c:1021
#5  0x0805d418 in main (ac=3, av=0x159cc) at innd.c:663
(gdb) l
663         CHANreadloop();
664
665         /* CHANreadloop should never return. */
666         CleanupAndExit(1, "CHANreadloop returned");
667         return 1;
668     }
(gdb) up
#1  0x0806cda3 in WIPprecomfree (cp=0x81075d8) at wip.c:61
61                  WIPfree(cur);
(gdb) l
56              return;
57
58          for (i = 0 ; i < PRECOMMITCACHESIZE ; i++) {
59              cur = cp->PrecommitWIP[i];
60              if (cur != (WIP *)NULL) {
61                  WIPfree(cur);
62              }
63          }
64      }
65
(gdb) up
#2  0x0805a307 in CHANclose (cp=0x81075d8, name=0x8107ca0 "news-peer.nctu.edu.tw:83")
    at chan.c:282
282         WIPprecomfree(cp);
(gdb) l
277     **  NNTP-specific stuff is moved out of the core channel struct.
278     */
279     static void
280     CHANclose_nntp(CHANNEL *cp, const char *name)
281     {
282         WIPprecomfree(cp);
283         NCclearwip(cp);
284         if (cp->State == CScancel)
285             notice("%s closed seconds %ld cancels %ld", name,
286                    (long)(Now.tv_sec - cp->Started), cp->Received);
(gdb) up
#3  0x080607a5 in NCreader (cp=0x81075d8) at nc.c:1140
1140                CHANclose(cp, CHANname(cp));
(gdb) l
1135                return;
1136            }
1137            if (i == 0 || cp->BadReads++ >= innconf->badiocount) {
1138                if (NCcount > 0)
1139                    NCcount--;
1140                CHANclose(cp, CHANname(cp));
1141            }
1142            return;
1143        }
1144
(gdb) up
#4  0x0805b04f in CHANreadloop () at chan.c:1021
1021        (*cp->Reader)(cp);
(gdb) l
1016            close(cp->fd);
1017            cp->fd = -1;
1018            return;
1019        }
1020        cp->LastActive = Now.tv_sec;
1021        (*cp->Reader)(cp);
1022
1023        /* Check and see if the buffer is grossly overallocated and shrink if
1024           needed. */
1025        if (cp->In.size <= BIG_BUFFER)
(gdb) up
#5  0x0805d418 in main (ac=3, av=0x159cc) at innd.c:663
663         CHANreadloop();
(gdb) l
658             syslog(LOG_NOTICE, "SERVER renumbering");
659             if (!ICDrenumberactive())
660                 die("SERVER cant renumber");
661         }
662         syslog(LOG_NOTICE, "SERVER starting");
663         CHANreadloop();
664
665         /* CHANreadloop should never return. */
666         CleanupAndExit(1, "CHANreadloop returned");
667         return 1;
(gdb) up
Initial frame selected; you cannot go up.
(gdb) quit

-- 
* Gea-Suan Lin  (public key: Using https://keyserver.pgp.com/ to search)
* If you cannot convince them, confuse them.           -- Harry S Truman