[Home]

Summary:ASTERISK-26987: pbx_dundi: Asterisk crashes when unloading module pbx_dundi.so with dundi peers
Reporter:Kirsty Tyerman (ktyerman)Labels:
Date Opened:2017-05-07 22:08:09Date Closed:2018-06-29 15:16:15
Priority:MinorRegression?
Status:Closed/CompleteComponents:PBX/pbx_dundi
Versions:13.9.1 14.4.0 Frequency of
Occurrence
Related
Issues:
Environment:Fedora 25Attachments:( 0) backtrace_dundi_unload.txt
( 1) dundi.conf
Description:I have compiled Asterisk 13.9.1 on a Fedora 25 Workstation.
I have also compiled Asterisk 14.4.0 on a Fedora 25 Workstation and experiencing same issue.

I have configured "dundi.conf" with one dundi peer as follows, using my local ip address as the bindaddr.
{noformat}
[general]
entityid=11:11:11:de:af:1
bindaddr=192.168.122.21
cachetime=5
ttl=32
tos=cs5
autokill=no

[11:11:11:00:a1:1]
model=symmetric
include=all
host=192.168.122.22
permit=all
qualify=30000
{noformat}

When I try to unload the dundi module (module unload pbx_dundi.so), asterisk crashes with a segmentation fault as follows:
{noformat}
*CLI> module unload pbx_dundi.so
Unloading pbx_dundi.so
 == Unregistered custom function DUNDILOOKUP
 == Unregistered custom function DUNDIQUERY
 == Unregistered custom function DUNDIRESULT
[Thread 0x7fff6a33d700 (LWP 27801) exited]
[Thread 0x7fff6a2c1700 (LWP 27802) exited]
[Thread 0x7fff6a245700 (LWP 27803) exited]

Thread 1 "asterisk" received signal SIGSEGV, Segmentation fault.
0x0000000000527362 in ast_heap_size (h=0x0) at heap.c:311
311 return h->cur_len;
(gdb) where
#0  0x0000000000527362 in ast_heap_size (h=0x0) at heap.c:311
#1  0x00000000005bc45e in sched_find (con=0xc9ed90, id=1) at sched.c:582
#2  0x00000000005bc59f in ast_sched_del (con=0xc9ed90, id=1) at sched.c:634
#3  0x00007fff8761123b in destroy_peer (peer=0x12a3150) at pbx_dundi.c:4333
#4  0x00007fff87611426 in prune_peers () at pbx_dundi.c:4354
#5  0x00007fff87614456 in unload_module () at pbx_dundi.c:4987
#6  0x0000000000537a9f in ast_unload_resource (resource_name=0x12ca50e "pbx_dundi.so", force=AST_FORCE_SOFT)
   at loader.c:704
#7  0x00000000004d2392 in handle_unload (e=0x8b3048 <cli_cli+3400>, cmd=-4, a=0x7fffffffb920) at cli.c:769
#8  0x00000000004d87be in ast_cli_command_full (uid=-1, gid=-1, fd=1, s=0xb18a10 "module unload pbx_dundi.so ")
   at cli.c:2757
#9  0x0000000000455301 in consolehandler (s=0xb18a10 "module unload pbx_dundi.so ") at asterisk.c:2328
#10 0x000000000045c132 in asterisk_daemon (isroot=1, runuser=0x0, rungroup=0x0) at asterisk.c:4797
#11 0x000000000045af76 in main (argc=2, argv=0x7fffffffe0b8) at asterisk.c:4289
{noformat}

If i remove qualify from the dundi peer and then load and unload the pbx_dundi.so module asterisk does not crash.

*STEPS TO REPRODUCE*
1. dnf install asterisk-13.9.1
2. use dundi.conf file supplied in attatchments (edit bindaddr to match local ip address)
3. start asterisk
4. connect to the asterisk CLI
5. module unload pbx_dundi.so

*ATTACHMENTS*
dundi.conf: configuration file used when loading module pbx_dundi.so
backtrace_dundi_unload.txt: backtrace of asterisk segmentation fault when 'module unload pbx_dundi.so'
Comments:By: Asterisk Team (asteriskteam) 2017-05-07 22:08:10.821-0500

Thanks for creating a report! The issue has entered the triage process. That means the issue will wait in this status until a Bug Marshal has an opportunity to review the issue. Once the issue has been reviewed you will receive comments regarding the next steps towards resolution.

A good first step is for you to review the [Asterisk Issue Guidelines|https://wiki.asterisk.org/wiki/display/AST/Asterisk+Issue+Guidelines] if you haven't already. The guidelines detail what is expected from an Asterisk issue report.

Then, if you are submitting a patch, please review the [Patch Contribution Process|https://wiki.asterisk.org/wiki/display/AST/Patch+Contribution+Process].
By: Joshua C. Colp (jcolp) 2017-05-09 05:45:39.872-0500

The underlying problem here is that the scheduler is destroyed before all the peers are pruned, causing it to access freed memory.
By: Kirsty Tyerman (ktyerman) 2018-06-25 22:21:40.770-0500

Have submitted patch. Please see here: https://gerrit.asterisk.org/9296
By: Friendly Automation (friendly-automation) 2018-06-29 15:16:16.481-0500

Change 9313 merged by Jenkins2:
pbx_dundi: reordered unloading of module pbx_dundi

[https://gerrit.asterisk.org/9313|https://gerrit.asterisk.org/9313]
By: Friendly Automation (friendly-automation) 2018-06-29 15:23:09.865-0500

Change 9296 merged by Jenkins2:
pbx_dundi: reordered unloading of module pbx_dundi

[https://gerrit.asterisk.org/9296|https://gerrit.asterisk.org/9296]
By: Friendly Automation (friendly-automation) 2018-06-29 15:28:33.971-0500

Change 9312 merged by Jenkins2:
pbx_dundi: reordered unloading of module pbx_dundi

[https://gerrit.asterisk.org/9312|https://gerrit.asterisk.org/9312]