Summary: | ASTERISK-25395: Crash when establishing subscription with pjsip | ||
Reporter: | Mark Michelson (mmichelson) | Labels: | |
Date Opened: | 2015-09-16 17:48:56 | Date Closed: | 2017-03-03 06:28:20.000-0600 |
Priority: | Major | Regression? | No |
Status: | Closed/Complete | Components: | Resources/res_pjsip |
Versions: | 13.5.0 | Frequency of Occurrence | Occasional |
Related Issues: | |||
Environment: | Attachments: | ||
Description: | Sometimes when establishing a subscription on a busy system, a crash can be seen to occur. This is due to a race condition that occurs when an initial NOTIFY and a state change NOTIFY compete over the same memory.
A sample backtrace from when this occurs looks like: {noformat} #0 0x009de424 in __kernel_vsyscall () No symbol table info available. #1 0x0064b871 in raise () from /lib/libc.so.6 No symbol table info available. #2 0x0064d14a in abort () from /lib/libc.so.6 No symbol table info available. #3 0x0068b735 in __libc_message () from /lib/libc.so.6 No symbol table info available. #4 0x00691b91 in malloc_printerr () from /lib/libc.so.6 No symbol table info available. #5 0x006942f8 in _int_free () from /lib/libc.so.6 No symbol table info available. #6 0x00696da9 in _int_realloc () from /lib/libc.so.6 No symbol table info available. #7 0x00696ffc in realloc () from /lib/libc.so.6 No symbol table info available. #8 0x08206179 in _ast_realloc (p=0x1aec0218, len=268, file=0x82fce30 "/home/fourloop/6_0_prem/base/asterisk/asterisk/src/include/asterisk/strings.h", lineno=814, func=0x82fd4fb "ast_str_make_space") at /home/fourloop/6_0_prem/base/asterisk/asterisk/src/include/asterisk/utils.h:596 newp = 0xef34c5 __PRETTY_FUNCTION__ = "_ast_realloc" #9 0x08206708 in ast_str_make_space (buf=0x1b58b6b4, new_len=256) at /home/fourloop/6_0_prem/base/asterisk/asterisk/src/include/asterisk/strings.h:792 old_buf = 0x1aec0218 __PRETTY_FUNCTION__ = "ast_str_make_space" #10 0x074feea4 in pidf_to_string (body=0xbfdc7a4, str=0x1b58b6b4) at res_pjsip_pidf_body_generator.c:94 pres = 0xbfdc7a4 growths = 0 size = 39 __PRETTY_FUNCTION__ = "pidf_to_string" #11 0x04c1a2bb in ast_sip_pubsub_generate_body_content (type=0x74ff0d9 "application", subtype=0x74ff0e5 "pidf+xml", data=0xb6f3f0f4, str=0x1b58b6b4) at res_pjsip_pubsub.c:3142 supplement = 0x0 generator = 0x7500660 res = 0 body = 0xbfdc7a4 __PRETTY_FUNCTION__ = "ast_sip_pubsub_generate_body_content" #12 0x04c16d4c in ast_sip_subscription_notify (sub=0x1b58b698, notify_data=0xb6f3f0f4, terminate=0) at res_pjsip_pubsub.c:2203 res = 79785520 #13 0x01027651 in notify_task (obj=0x1ad14d2c) at res_pjsip_exten_state.c:259 task_data = 0x1ad14d2c data = {body_type = 0x102800e "ast_sip_exten_state_data", body_data = 0x1ad14d2c} #14 0x081f5574 in ast_taskprocessor_execute (tps=0x1a154644) at taskprocessor.c:769 local = {local_data = 0x82f99eb, data = 0x2fc} t = 0x1680a028 size = 137338661 __PRETTY_FUNCTION__ = "ast_taskprocessor_execute" #15 0x081fd5f5 in execute_tasks (data=0x1a154644) at threadpool.c:1157 tps = 0x1a154644 #16 0x081f5574 in ast_taskprocessor_execute (tps=0x889b79c) at taskprocessor.c:769 local = {local_data = 0x889cc28, data = 0x889cc28} t = 0x174b38b0 size = 0 __PRETTY_FUNCTION__ = "ast_taskprocessor_execute" #17 0x081fbee1 in threadpool_execute (pool=0x889cc5c) at threadpool.c:351 __PRETTY_FUNCTION__ = "threadpool_execute" #18 0x081fd318 in worker_active (worker=0xb50fe0fc) at threadpool.c:1075 alive = 0 #19 0x081fd0d8 in worker_start (arg=0xb50fe0fc) at threadpool.c:995 worker = 0xb50fe0fc __PRETTY_FUNCTION__ = "worker_start" #20 0x08207714 in dummy_start (data=0xb759fa88) at utils.c:1232 __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {3649524, 0, 4001536, -1225526584, -1404079342, 189168239}, __mask_was_saved = 0}}, __pad = {0xb6f3f394, 0x0, 0xffffffff, 0x1adaf900}} __cancel_routine = 0x808c82d <ast_unregister_thread> __cancel_arg = 0xb6f3fb70 not_first_call = 0 ret = 0x76309e a = {start_routine = 0x81fd04e <worker_start>, data = 0xb50fe0fc, name = 0xb7539820 "worker_start started at [ 1049] threadpool.c worker_thread_start()"} #21 0x00369b39 in start_thread () from /lib/libpthread.so.0 No symbol table info available. #22 0x00703c2e in clone () from /lib/libc.so.6 {noformat} | ||
Comments: |