esp_websocket_client: Crash in websocket client task due to access resource after destroyed (IDFGH-17044) #984
Description
Answers checklist.
- I have read the documentation for esp-protocols components and the issue is not addressed there.
- I have updated my esp-protocols branch (master or release) to the latest version and checked that the issue is present there.
- I have searched the issue tracker for a similar issue and not found a similar issue.
General issue report
Crash log like below:
I (3537) websocket_client: Started
E (3587) esp-tls: couldn't get hostname for :XXXX: getaddrinfo() returns 202, addrinfo=0x0
E (3587) transport_base: Failed to open a new connection: 32769
E (3597) transport_ws: Error connecting to host XXXX:8888
E (3597) websocket_client: esp_transport_connect() failed with -1, transport_error=ESP_ERR_ESP_TLS_CANNOT_RESOLVE_HOSTNAME, tls_error_code=0, tls_flags=0, esp_ws_handshake_status_code=0, errno=0
E (3607) KWS_SIG: WEBSOCKET_EVENT_ERROR
I (3617) websocket_client: Reconnect after 60000 ms
I (3617) webrtc: PeerConnectionState: 1
I (3617) AGENT: agent disconnected done
esp>
esp> stop
I (5747) KMS_WEBRTC: Start to close webrtc 0x3c2c508c
E (5757) KWS_SIG: WebSocket not connected
Start to stop websocket
esp> wifi End to stop websocket
End to destroy websocket
Guru Meditation Error: Core 0 panic'ed (LoadProhibited). Exception was unhandled.
Core 0 register dump:
PC : 0x421ee290 PS : 0x00060230 A0 : 0x82019db5 A1 : 0x3fce5cd0
--- 0x421ee290: esp_event_loop_delete at /home/tempo/esp/idf_v55/esp-idf/components/esp_event/esp_event.c:744
A2 : 0xa5a5a5a5 A3 : 0x82000001 A4 : 0x00000000 A5 : 0x00060f23
A6 : 0x00000000 A7 : 0x3fce832c A8 : 0x80390811 A9 : 0x3fce5cd0
A10 : 0x00060f23 A11 : 0x00000000 A12 : 0x00060f20 A13 : 0x00060f23
A14 : 0x00000007 A15 : 0x0000cdcd SAR : 0x00000019 EXCCAUSE: 0x0000001c
EXCVADDR: 0xa5a5a5b5 LBEG : 0x400570e8 LEND : 0x400570f3 LCOUNT : 0x00000000
--- 0x400570e8: memset in ROM
--- 0x400570f3: memset in ROM
Backtrace: 0x421ee28d:0x3fce5cd0 0x42019db2:0x3fce5d00 0x4201a51a:0x3fce5d20 0x40390491:0x3fce5d60
--- 0x421ee28d: esp_event_loop_delete at /home/tempo/esp/idf_v55/esp-idf/components/esp_event/esp_event.c:740
--- 0x42019db2: destroy_and_free_resources at /home/tempo/ttt/release_webrtc/esp-webrtc-solution/solutions/kms_demo/build/../managed_components/espressif__esp_websocket_client/esp_websocket_client.c:432
--- 0x4201a51a: esp_websocket_client_task at /home/tempo/ttt/release_webrtc/esp-webrtc-solution/solutions/kms_demo/build/../managed_components/espressif__esp_websocket_client/esp_websocket_client.c:1142
--- 0x40390491: vPortTaskWrapper at /home/tempo/esp/idf_v55/esp-idf/components/freertos/FreeRTOS-Kernel/portable/xtensa/port.c:139
ELF file SHA256: 38d329705
Entering gdb stub now.
$T0b#e6GNU gdb (esp-gdb) 16.3_20250913
Copyright (C) 2024 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "--host=x86_64-linux-gnu --target=xtensa-esp-elf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /home/tempo/ttt/release_webrtc/esp-webrtc-solution/solutions/kms_demo/build/kms_demo.elf...
Remote debugging using /dev/ttyUSB0
esp_event_loop_delete (event_loop=0xa5a5a5a5) at /home/tempo/esp/idf_v55/esp-idf/components/esp_event/esp_event.c:744
744 SemaphoreHandle_t loop_mutex = loop->mutex;
add symbol table from file "/home/tempo/ttt/release_webrtc/esp-webrtc-solution/solutions/kms_demo/build/bootloader/bootloader.elf"
(y or n) y
Reading symbols from /home/tempo/ttt/release_webrtc/esp-webrtc-solution/solutions/kms_demo/build/bootloader/bootloader.elf...
(gdb) bt
#0 esp_event_loop_delete (event_loop=0xa5a5a5a5) at /home/tempo/esp/idf_v55/esp-idf/components/esp_event/esp_event.c:744
#1 0x42019db5 in destroy_and_free_resources (client=0x3fce491c) at ../managed_components/espressif__esp_websocket_client/esp_websocket_client.c:432
#2 0x4201a51d in esp_websocket_client_task (pv=0x3fce491c) at ../managed_components/espressif__esp_websocket_client/esp_websocket_client.c:1142
#3 0x40390494 in vPortTaskWrapper (pxCode=0x4201a0e8 <esp_websocket_client_task>, pvParameters=0x3fce491c)
at /home/tempo/esp/idf_v55/esp-idf/components/freertos/FreeRTOS-Kernel/portable/xtensa/port.c:139
(gdb) f 2
#2 0x4201a51d in esp_websocket_client_task (pv=0x3fce491c) at ../managed_components/espressif__esp_websocket_client/esp_websocket_client.c:1142
1142 destroy_and_free_resources(client);
The issue is caused in code
xEventGroupSetBits(client->status_bits, STOPPED_BIT);
client->state = WEBSOCKET_STATE_UNKNOW;
if (client->selected_for_destroying == true) {
destroy_and_free_resources(client);
}If use call stop and destroy soon, destroy will destroy all resources it may happen destroyed finished then destroy_and_free_resources run which cause the issue.
printf("Start to stop websocket\n");
if (kws->ws) {
esp_websocket_client_stop(kws->ws);
printf("End to stop websocket\n");
esp_websocket_client_destroy(kws->ws);
kws->ws = NULL;
}
printf("End to destroy websocket\n");The right code should be never access any resource after set stopped bit
client->state = WEBSOCKET_STATE_UNKNOW;
if (client->selected_for_destroying == true) {
destroy_and_free_resources(client);
}
xEventGroupSetBits(client->status_bits, STOPPED_BIT);