Bug ID 426574: SIP message could self reference itself in ingressQ leading to crash

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP None(all modules)

Known Affected Versions:
11.0.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4, 11.6.0 HF5, 11.6.0 HF6, 11.6.0 HF7, 11.6.0 HF8, 11.5.1 HF1, 11.6.1 HF1, 11.5.1 HF2, 11.6.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.1 HF10, 11.5.1 HF11, 11.5.2 HF1, 11.6.2 HF1, 11.5.3 HF1, 11.5.3 HF2, 11.5.4 HF1, 11.5.4 HF2, 11.5.4 HF3, 11.5.4 HF4, 11.2.0, 11.3.0

Opened: Jul 30, 2013

Severity: 3-Major

Symptoms

TMM Crash experienced by the customer.

Impact

tmm crash

Conditions

sip_machine() --> calls sip_post_ingress, which could return ERR_INPROGRESS in two scenarios. One) A TCL rule is in progress. Two) When MBLB is connecting -- in other words message not placed in its egress Q In case two, SIP filter needs to requeue it, as the message was removed before being propagated to mblb proxy. So the code checks for ERR_INPROGRESS to requeue. This accidentally requeues in case 1 too, leading to re-inserting same message, resulting in self-referencing message in sip->ingressQ, which in turn leads to this crash.

Workaround

none

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips