Segfault in "kill calls" thread (at d0) on rtpengine 13.5.1.22

[Ashwin M]

Hi everyone,

I am experiencing intermittent crashes with rtpengine and am hoping someone might recognize this crash signature or point me toward a fix.

Version: 13.5.1.22+0~mr13.5.1.22

I do not have a core dump available at the moment, but the crashes consistently occur in the kill calls thread during teardown/cleanup with a null pointer dereference (segfault at d0).

The machine code for the crash is identical across occurrences (<ff> 90 d0 00 00 00), which maps to callq *0xd0(%rax) with %rax evaluating to 0.

Here are the masked logs from two recent crashes:

Crash 1 - Occurred right after a SIP proxy ping timeout

2026-07-28 20:46:08.822 error ERROR: rtpengine [rtpengine.c:3568]: send_rtpp_command(): can't send command "ping" to RTPEngine <udp:172.30.x.x:2223>
2026-07-28 20:46:08.822 error ERROR: rtpengine [rtpengine.c:3418]: rtpp_test(): proxy did not respond to ping
2026-07-28 20:46:13.115 error kill calls[3776219]: segfault at d0 ip 0000559c58f3ddb3 sp 00007f3f5f3527f0 error 4 in rtpengine[559c58ed4000+10e000] likely on CPU 1 (core 0, socket 0)
2026-07-28 20:46:13.116 Code: 03 00 00 a8 80 0f 85 a4 03 00 00 89 c2 83 e2 0f 83 fa 06 0f 8f 1e 01 00 00 49 8b 46 28 49 8d 7e 20 4c 89 f9 48 89 da 48 89 ee <ff> 90 d0 00 00 00 49 8b 85 f0 02 00 00 f0 48 83 00 01 49 8b 85 f0

Crash 2 - Occurred right after a forced WebSocket/WebRTC closure:

2026-08-01 17:13:44.058 warn WARNING: websocket [ws_frame.c:814]: ws_keepalive(): forcibly closing connection
2026-08-01 17:13:44.058 error ERROR: websocket [ws_conn.c:387]: wsconn_close_now(): getting TCP/TLS connection
2026-08-01 17:13:44.471 error kill calls[953500]: segfault at d0 ip 000055b6631e4db3 sp 00007f2835ff97f0 error 4 in rtpengine[55b66317b000+10e000] likely on CPU 1 (core 0, socket 0)
2026-08-01 17:13:44.477 Code: 03 00 00 a8 80 0f 85 a4 03 00 00 89 c2 83 e2 0f 83 fa 06 0f 8f 1e 01 00 00 49 8b 46 28 49 8d 7e 20 4c 89 f9 48 89 da 48 89 ee <ff> 90 d0 00 00 00 49 8b 85 f0 02 00 00 f0 48 83 00 01 49 8b 85 f0

Has anyone encountered this specific null pointer dereference during teardown on the 13.5 branch? Is this a known issue addressed in a higher maintenance release or the 14.x branch?

Thanks,
Ashwin

[Richard Fuchs]

It's possible that this is from a closed media socket. There have been a few related issues that required patching, and it's possible that it's already fixed in 13.5.1.23+.

Other than upgrading, you really need the proper back trace to get an idea of what happened.

Cheers

Ashwin --
You received this message because you are subscribed to the Google Groups "Sipwise rtpengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rtpengine+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/rtpengine/415e07eb-9a7a-4733-be89-d91e1106d790n%40googlegroups.com.