Error about zigbee-jip-daemon: free()

[jshpy]

Hello, everyone,

I have some troubles and would like to ask everyone for help.

I try to deploy the application on my development board according to the steps described in JN-AN-1194-ZigBee-IoT-Gateway-Host.pdf,

    * The ZigBee Control Bridge used by the development board is based on the JN5169 reference JN-AN-1216-Zigbee-3-0-IoT-ControlBridge;

    * The operating system of the development board is Ubuntu 17.04;

    * The architecture of the CPU is ARMv7 Processor rev 10 (v7l)

Things seem to be going very well. I successfully deployed and ran JIP Web Interfaces and were able to exchange information with the Control Bridge.

But when i try to add a ZigBee node to the coordinator network where the Control Bridge is located, zigbee-jip-daemon unexpectedly crashes and exits:

    *** Error in `zigbee-jip-daemon': free(): invalid next size (fast): 0xb22005b8 ***

I located the location of the error, located at

JN-AN-1194.zip\ZigbeeNodeControlBridge\Source\Host\zigbee-jip-daemon-1v4.tar.gz\zigbee-jip-daemon.tar\zigbee-jip-daemon\ZCB\Source\ZigbeeControlBridge.c

line 792, the log collected is attached to error_log.txt

Can you give some advice?

Related documents and source code can be found in below:

JN-AN-1194.zip(ZigbeeNodeControlBridge)

JN-AN-1216.zip(Zigbee-3-0-IoT-ControlBridge)

Thank you for your help.

【error_log】

---------------------------------------------------------
zigbee-jip-daemon -s /dev/ttyS3 -m coordinator -f
---------------------------------------------------------
root@rd:~# zigbee-jip-daemon -s /dev/ttyS3 -m coordinator -f
Opening serial device '/dev/ttyS3' at baud rate 1000000bps
Opened tun device: zb0
eBR_Init: Starting JIP
eBR_Init: Loading JIP Definitions
eBR_Init: Adding IPv6 address fd04:bd3:80e8:10::1 to interface
eBR_Init: Empty network table initialised
Starting avahi client.
Message 0x8010 was not handled
Adding hostname 'BR_zb0.local'
Adding service 'JIP Border Router'
Registering Service 'JIP Border Router' on host 'BR_zb0'.
Message 0x8010 was not handled
Connected to control bridge version 0x12345678
eZCB_EstablishComms: Reset control bridge
Module: ** Control Bridge Reset**
ZCB_HandleNodeClusterList: Cluster list for endpoint 1, profile ID 0x 104
ZCB_HandleNodeClusterList: Cluster list for endpoint 1, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0000, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0000, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0003, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0003, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0004, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0004, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0005, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0005, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0006, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0006, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0008, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0008, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0300, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0300, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0201, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0201, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0405, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0405, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0001, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0001, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0400, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0400, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0402, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0402, profile ID 0x 104
ZCB_HandleNodeClusterAttributeList: Cluster attribute list for endpoint 1, cluster 0x0702, profile ID 0x 104
ZCB_HandleNodeCommandIDList: Command ID list for endpoint 1, cluster 0x0702, profile ID 0x 104
Network formed on channel 15. Control bridge address 0x0000 (0x00158D00017CF7BA)
ZCB_HandleNetworkJoined: Node Joined 0x0000 (0x00158D00017CF7BA)
Control bridge restarted, status 2 (NFN_START)
Service 'JIP Border Router' successfully established on host 'BR_zb0'.
main: Got event 0
psBR_FindJIPNode: Find JIP node matching IEEE Address 0x00158D00017CF7BA, fd04:bd3:80e8:10:15:8d00:17c:f7ba
psBR_FindJIPNode: JIP Node not found
Zigbee node 0x0000 (0x00158D00017CF7BA) device ID 0x0840 joined network
eBR_NodeJoined: Found JIP device type 0x08010010 for ZB Device type 0x0840
Commissioning server listening on port 1880
Create JIP device ID 0x08010010 at address fd04:bd3:80e8:10:15:8d00:17c:f7ba.
main: Network started
eBR_CheckDeviceComms: Comms test node index 2 / 2 nodes in network
psBR_FindZigbeeNode: Find Zigbee node matching IPv6 Address fd04:bd3:80e8:10:15:8d00:17c:f7ba
eZCB_NeighbourTableRequest: Send management LQI request to 0x0000 for entries starting at 0
Module: Management Lqi Request
eZCB_NeighbourTableRequest: Received management LQI response. Table size: 1, Entry count: 1, start index: 0
eZCB_NeighbourTableRequest: Entry 00: Short Address 0x1899, PAN ID: 0x1234567812345678, IEEE Address: 0x00158D00027567C3
eZCB_NeighbourTableRequest: Type: 1, Permit Joining: 2, Relationship: 1, RxOnWhenIdle: 1
eZCB_NeighbourTableRequest: Depth: 1, LQI: 255
eZCB_NeighbourTableRequest: New Node 0x1899 in neighbour table
eZCB_NeighbourTableRequest: Device join queued
eZCB_NeighbourTableRequest: ---- befor free: line 792 ----
eZCB_NeighbourTableRequest: ---- after free: line 792 ----
eBR_CheckDeviceComms: Node is the control bridge
main: Got event 2
main: New device 0x1899
eZCB_MatchDescriptorRequest: Send Match Desciptor request for profile ID 0x0104 to 0x1899
eZCB_MatchDescriptorRequest: Input Cluster List:
eZCB_MatchDescriptorRequest: 0x0006
eZCB_MatchDescriptorRequest: 0x0201
eZCB_MatchDescriptorRequest: Output Cluster List:
eZCB_MatchDescriptorRequest: Send Match Desciptor request for profile ID 0xC05E to 0x1899
eZCB_MatchDescriptorRequest: Input Cluster List:
eZCB_MatchDescriptorRequest: 0x0006
eZCB_MatchDescriptorRequest: 0x0201
eZCB_MatchDescriptorRequest: Output Cluster List:
ZCB_HandleMatchDescriptorResponse: Match descriptor request response from node 0x1899 - 1 matching endpoints.
ZCB_HandleMatchDescriptorResponse: Node rejoined
ZCB_HandleMatchDescriptorResponse: Queue new node event
ZCB_HandleMatchDescriptorResponse: Match descriptor request response from node 0x1899 - 1 matching endpoints.
ZCB_HandleMatchDescriptorResponse: Node rejoined
ZCB_HandleMatchDescriptorResponse: Queue new node event
main: Got event 3
psBR_FindJIPNode: Find JIP node matching IEEE Address 0x00158D00027567C3, fd04:bd3:80e8:10:15:8d00:275:67c3
psBR_FindJIPNode: JIP Node not found
main: New device, short address 0x1899, matching requested clusters
main: Requesting new endpoint simple descriptor
eZCB_SimpleDescriptorRequest: Send Simple Desciptor request for Endpoint 1 to 0x1899
eZCB_AddGroupMembership: Send add group membership 0xF00F request to 0x1899
eZCB_AddGroupMembership: Add group membership 0xF00F on Node 0x1899 status: 138
main: Adding node 0x1899 to border router
Zigbee node 0x1899 (0x00158D00027567C3) device ID 0x0101 joined network
eBR_NodeJoined: Found JIP device type 0x08011175 for ZB Device type 0x0101
eColourLampInitalise: Set up device
ColourLampGetGroupsImpl: Lamp was in 0 groups
eZCB_GetGroupMembership: Send get group membership request to 0x1899
eZCB_GetGroupMembership: Node 0x1899 is in 1/4 groups
eZCB_GetGroupMembership: Group ID 0xF00F
ColourLampGetGroupsImpl: Lamp is now in 1 groups
ColourLampGetGroupsImpl: Add Group: ff15::f00f - 0xF00F
ColourLampGetGroupsImpl: Call libJIP get groups function: 0xb6eab471
Create JIP device ID 0x08011175 at address fd04:bd3:80e8:10:15:8d00:275:67c3.
main: Got event 3
psBR_FindJIPNode: Find JIP node matching IEEE Address 0x00158D00027567C3, fd04:bd3:80e8:10:15:8d00:275:67c3
psBR_FindJIPNode: Found JIP node at 0x45278
main: Node 0x1899 is already in the JIP network
eBR_CheckDeviceComms: Comms test node index 3 / 3 nodes in network
psBR_FindZigbeeNode: Find Zigbee node matching IPv6 Address fd04:bd3:80e8:10:15:8d00:275:67c3
eZCB_NeighbourTableRequest: Send management LQI request to 0x1899 for entries starting at 0
Module: Management Lqi Request
eZCB_NeighbourTableRequest: Received management LQI response. Table size: 1, Entry count: 1, start index: 0
eZCB_NeighbourTableRequest: Entry 00: Short Address 0x0000, PAN ID: 0x1234567812345678, IEEE Address: 0x00158D00017CF7BA
eZCB_NeighbourTableRequest: Type: 0, Permit Joining: 2, Relationship: 0, RxOnWhenIdle: 1
eZCB_NeighbourTableRequest: Depth: 0, LQI: 118
eZCB_NeighbourTableRequest: Device join queued
eZCB_NeighbourTableRequest: ---- befor free: line 792 ----
eZCB_NeighbourTableRequest: ---- after free: line 792 ----
iBR_DeviceTimedOut: Last successful comms with node 0x1899 was 0 seconds ago, sequential failures: 0
main: Got event 2
main: Endpoints of device 0x0000 already known
main: Got event 3
psBR_FindJIPNode: Find JIP node matching IEEE Address 0x00158D00017CF7BA, fd04:bd3:80e8:10:15:8d00:17c:f7ba
psBR_FindJIPNode: Found JIP node at 0x46b78
main: Node 0x0000 is already in the JIP network
eBR_CheckDeviceComms: Comms test node index 2 / 3 nodes in network
psBR_FindZigbeeNode: Find Zigbee node matching IPv6 Address fd04:bd3:80e8:10:15:8d00:17c:f7ba
eZCB_NeighbourTableRequest: Send management LQI request to 0x0000 for entries starting at 1
Module: Management Lqi Request
eZCB_NeighbourTableRequest: Received management LQI response. Table size: 1, Entry count: 1, start index: 0
eZCB_NeighbourTableRequest: Entry 00: Short Address 0x010F, PAN ID: 0xF000000000110000, IEEE Address: 0x00480020B2480020
eZCB_NeighbourTableRequest: Type: 0, Permit Joining: 0, Relationship: 0, RxOnWhenIdle: 0
eZCB_NeighbourTableRequest: Depth: 178, LQI: 16
eZCB_NeighbourTableRequest: New Node 0x010F in neighbour table
eZCB_NeighbourTableRequest: Device join queued
eZCB_NeighbourTableRequest: ---- befor free: line 792 ----
*** Error in `zigbee-jip-daemon': free(): invalid next size (fast): 0xb22005b8 ***
Aborted (core dumped)

[jshpy]

Is anyone here?

[mario_castaneda]

Hi 旭 张

The JN-AN-1194 Application Note is now frozen and has been replaced with JN-AN-1222 and JN-AN-1223.

Could you please try with this application notes?

ZigBee Home Automation

Regards,

Mario

[jshpy]

I did not make changes to the official protocol stack, but instead used the routine JN-AN-1216 (Zigbee-3-0-IoT-ControlBridge).

The difference is that the gateway application i use is located in JN-AN-1194 (ZigbeeNodeControlBridge), and JN-AN-1216 does not provide such a program.
So I am still not sure if it is because the gateway application in JN-AN-1194 does not support the Zigbee-3-0-IoT-ControlBridge in JN-AN-1216.

RHinnen‌