backup router segfault after primary router went down

[Stuart Henderson]

the primary router went down at 04:00, came back up at 04:41 and
both primary and backup routers died again soon afterwards (I'm
not sure which died first). these are from the backup router.

[Logging] [Error] Could not connect to xxx.xx.xx.x:706: Connection refused
04:40:59 silc_server_connection_free:1293: Free connection 0x46651f80
04:40:59 silc_server_config_destroy:1601: Unreferencing config [0x442f2c00] refcnt 105->104
04:41:04 silc_server_create_connection:1324: Created connection 0x46651f80
[Logging] [Info] Connecting to the router xxx.xx.xx.x on port 706
04:41:04 silc_server_config_ref:1580: Referencing config [0x442f2c00] refcnt 104->105
[Logging] [Error] Could not connect to xxx.xx.xx.x:706: Connection refused
04:41:04 silc_server_connection_free:1293: Free connection 0x46651f80
04:41:04 silc_server_config_destroy:1601: Unreferencing config [0x442f2c00] refcnt 105->104
04:41:06 silc_server_purge_expired_clients:1260: Expire timeout
04:41:09 silc_server_create_connection:1324: Created connection 0x46651f80
[Logging] [Info] Connecting to the router xxx.xx.xx.x on port 706
04:41:09 silc_server_config_ref:1580: Referencing config [0x442f2c00] refcnt 104->105
[Logging] [Error] Could not connect to xxx.xx.xx.x:706: Connection refused
04:41:09 silc_server_connection_free:1293: Free connection 0x46651f80
04:41:09 silc_server_config_destroy:1601: Unreferencing config [0x442f2c00] refcnt 105->104
04:41:14 silc_server_create_connection:1324: Created connection 0x46651f80
[Logging] [Info] Connecting to the router xxx.xx.xx.x on port 706
04:41:14 silc_server_config_ref:1580: Referencing config [0x442f2c00] refcnt 104->105
[Logging] [Error] Could not connect to xxx.xx.xx.x:706: Connection refused
04:41:14 silc_server_connection_free:1293: Free connection 0x46651f80
04:41:14 silc_server_config_destroy:1601: Unreferencing config [0x442f2c00] refcnt 105->104
=== Window terminated (Mon Apr 28 04:41:19 2008) ===

GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "sparc64-unknown-openbsd4.3"...

Core was generated by `silcd'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/local/lib/libiconv.so.4.0...done.
Loaded symbols for /usr/local/lib/libiconv.so.4.0
Reading symbols from /usr/lib/libpthread.so.9.0...done.
Loaded symbols for /usr/lib/libpthread.so.9.0
Reading symbols from /usr/lib/libc.so.43.0...done.
Loaded symbols for /usr/lib/libc.so.43.0
Reading symbols from /usr/libexec/ld.so...done.
Loaded symbols for /usr/libexec/ld.so
#0  pthread_mutex_lock (mutex=0x20500000000)
    at /usr/src/lib/libpthread/uthread/uthread_mutex.c:674
674     /usr/src/lib/libpthread/uthread/uthread_mutex.c: No such file or directory.
        in /usr/src/lib/libpthread/uthread/uthread_mutex.c
(gdb) bt full
#0  pthread_mutex_lock (mutex=0x20500000000)
    at /usr/src/lib/libpthread/uthread/uthread_mutex.c:674
        ret = 22
#1  0x000000000018b87c in silc_mutex_free (mutex=0x20500000000)
    at silcunixthread.c:141
No locals.
#2  0x00000000001771cc in silc_packet_set_context (stream=0x4b0c4b00, 
    stream_context=0x0) at silcpacket.c:1187
No locals.
#3  0x000000000011f960 in silc_server_do_rekey (schedule=0x465aa700, 
    app_context=0x442f2400, type=SILC_TASK_EXPIRE, fd=0, context=0x4b0c4b00)
    at server.c:2775
        server = 0x442f2400
        sock = 0x4b0c4b00
        idata = 0x455f0800
        ske = 0x474688
#4  0x0000000000199128 in silc_schedule_dispatch_timeout (schedule=0x465aa700, 
    dispatch_all=0 '\0') at silcschedule.c:114
        t = 0x4d7e2d00
        task = 0x4d7e2d00
        curtime = {tv_sec = 1209354078, tv_usec = 928790}
        count = 0
#5  0x00000000001995d0 in silc_schedule_iterate (schedule=0x465aa700, 
    timeout_usecs=-1) at silcschedule.c:448
        timeout = {tv_sec = -1842391401067494152, tv_usec = 1300112704}
        ret = 0
#6  0x000000000019695c in silc_schedule (schedule=0x465aa700)
    at silcschedule.c:498
No locals.
#7  0x000000000011d648 in silc_server_run (server=0x442f2400) at server.c:1190
No locals.
#8  0x000000000010dc74 in main (argc=3, argv=0xfffffffffffe2158) at silcd.c:753
        ret = 1
        opt = -1
        option_index = 1060104
        foreground = 1 '\001'
        opt_create_keypair = 0 '\0'
        silcd_config_file = 0x4e5de020 "/etc/silcd/silcd.conf"
        sa = {__sigaction_u = {__sa_handler = 0x1, __sa_sigaction = 0x1}, 
  sa_mask = 0, sa_flags = 0}
(gdb) frame 2
#2  0x00000000001771cc in silc_packet_set_context (stream=0x4b0c4b00, 
    stream_context=0x0) at silcpacket.c:1187
1187      silc_mutex_unlock(stream->lock);
(gdb) print *stream
$1 = {next = 0x0, sc = 0x4cdbc000, stream = 0x450ca7a0, lock = 0x20500000000, 
  process = 0x0, remote_udp = 0x4b0c4b20, stream_context = 0x0, outbuf = {
    head = 0x4b0c4b30 "", data = 0x0, tail = 0x0, end = 0x0}, inbuf = 0x0, 
  send_key = {0x0, 0x0}, send_hmac = {0x0, 0x455f1040}, receive_key = {0x1, 
    0x28000000}, receive_hmac = {0x50000002, 0x60000004}, 
  src_id = 0x70000001 <Address 0x70000001 out of bounds>, 
  dst_id = 0x20000000 <Address 0x20000000 out of bounds>, send_psn = 0, 
  receive_psn = 134217728, refcnt = {lock = 0x0, value = 0 '\0'}, sid = 0 '\0', 
  src_id_len = 0, src_id_type = 0, dst_id_len = 0, dst_id_type = 0, 
  is_router = 0, destroyed = 0, iv_included = 0, udp = 0}
(gdb) frame 3
#3  0x000000000011f960 in silc_server_do_rekey (schedule=0x465aa700,
    app_context=0x442f2400, type=SILC_TASK_EXPIRE, fd=0, context=0x4b0c4b00)
    at server.c:2775
2775      SilcIDListData idata = silc_packet_get_context(sock);
(gdb) print *sock
$2 = {next = 0x0, sc = 0x4cdbc000, stream = 0x450ca7a0, lock = 0x20500000000,
  process = 0x0, remote_udp = 0x4b0c4b20, stream_context = 0x0, outbuf = {
    head = 0x4b0c4b30 "", data = 0x0, tail = 0x0, end = 0x0}, inbuf = 0x0,
  send_key = {0x0, 0x0}, send_hmac = {0x0, 0x455f1040}, receive_key = {0x1,
    0x28000000}, receive_hmac = {0x50000002, 0x60000004},
  src_id = 0x70000001 <Address 0x70000001 out of bounds>,
  dst_id = 0x20000000 <Address 0x20000000 out of bounds>, send_psn = 0,
  receive_psn = 134217728, refcnt = {lock = 0x0, value = 0 '\0'}, sid = 0 '\0',
  src_id_len = 0, src_id_type = 0, dst_id_len = 0, dst_id_type = 0,
  is_router = 0, destroyed = 0, iv_included = 0, udp = 0}
(gdb) print *server
$3 = {schedule = 0x465aa700, listeners = 0x4d7e2180,
  packet_engine = 0x4b321e80, conns = 0x4d7e21c0, repository = 0x4e5de0a0,
  public_key = 0x4f77a560, private_key = 0x4f77a140,
  expired_clients = 0x4d7e2200, httpd = 0x4b338300,
  server_name = 0x4e5de7c0 "bootes.spacehopper.org", id_entry = 0x465ab000,
  id = 0x4e5deea0, id_string = "Ã_»\222Â\002\000ÿ", '\0' <repeats 23 times>,
  id_string_len = 8, starttime = 1209047643, router = 0x0, router_connect = 0,
  router_conn = 0x0, backup = 0x43b34b20, cmd_ident = 2545,
  local_list = 0x4e5de060, global_list = 0x4e5de080, watcher_list = 0x4b321d80,
  watcher_list_pk = 0x4b321e00, md5hash = 0x4f77a250, sha1hash = 0x4f77a1d0,
  config = 0x442f2c00, config_ref = {config = 0x442f2c00,
    ref_ptr = 0x442f2c00}, config_file = 0x4e5de020 "/etc/silcd/silcd.conf",
  rng = 0x4048c800, stat = {my_clients = 0, my_servers = 4, my_routers = 0,
    my_channels = 0, my_chanclients = 3, my_aways = 0, my_detached = 0,
    my_server_ops = 0, my_router_ops = 0, cell_clients = 40, cell_servers = 7,
    cell_channels = 18, cell_chanclients = 4294967253, clients = 40,
    servers = 8, routers = 0, channels = 15, chanclients = 4294967250,
    aways = 0, detached = 0, server_ops = 0, router_ops = 0,
---Type <return> to continue, or q <return> to quit---
    conn_attempts = 126, conn_failures = 0, auth_attempts = 63,
    auth_failures = 51, packets_sent = 0, packets_received = 0, conn_num = 4,
    commands_sent = 2644, commands_received = 2642},
  pending_commands = 0x4d7e2140, server_type = 1, standalone = 1,
  listenning = 1, background = 0, backup_router = 1, backup_primary = 0,
  backup_noswitch = 0, backup_closed = 0, wait_backup = 0, server_shutdown = 0,
  no_reconnect = 0, no_conf = 0}
(gdb) print *idata
$4 = {conn_type = SILC_CONN_UNKNOWN, sconn = 0x16a8f8, rekey = 0x0,
  hash = 0xc000000000000000, public_key = 0x4815475f,
  fingerprint = "\000\000\000\000\000\f3ð00\000ta len 43",
  last_receive = 7020097486314563683, last_sent = 8083169919906951733,
  created = 3471483879920840760, status = 51 '3'}