[Home]

Summary:ASTERISK-28885: res_rtp_asterisk: Simultaneous termination and ICE complete can cause crash
Reporter:Josep B (icr)Labels:fax webrtc
Date Opened:2020-05-11 09:45:57Date Closed:2020-06-01 11:44:17
Priority:MinorRegression?
Status:Closed/CompleteComponents:Resources/res_rtp_asterisk
Versions:13.32.0 Frequency of
Occurrence		Occasional
Related
Issues:
Environment:Centos 7.5, Asterisk 13.32.0Attachments:( 0) core_SIGABRT_res_rtp_asterisk.zip
( 1) endpoint-config.txt
Description:Hi,

We are using asterisk 13.32.0 with pjsip 2.9 bundled, using webrtc transport with ‘rel100‘ activated.

We get a SIGABRT crash:

#0  0x00007ff76c375337 in raise () from /usr/lib64/libc.so.6
#1  0x00007ff76c376a28 in abort () from /usr/lib64/libc.so.6
#2  0x00007ff76c3b7e87 in __libc_message () from /usr/lib64/libc.so.6
#3  0x00007ff76c3c0679 in _int_free () from /usr/lib64/libc.so.6
#4  0x00007ff69acd67e7 in ast_rtp_remote_address_set (instance=<optimized out>, addr=0x7ff68818e320) at res_rtp_asterisk.c:6159
#5  0x0000000000590655 in rtp_instance_set_incoming_source_address_nolock (address=0x7ff68ce97b80, instance=0x7ff68818e1e8) at rtp_engine.c:549
#6  ast_rtp_instance_set_requested_target_address (instance=instance@entry=0x7ff68818e1e8, address=address@entry=0x7ff68ce97b80) at rtp_engine.c:569
#7  0x00007ff69acdc4fc in ast_rtp_ice_start_media (status=<optimized out>, ice=0x7ff68801e9c8) at res_rtp_asterisk.c:2172
#8  ast_rtp_on_ice_complete (ice=0x7ff68801e9c8, status=<optimized out>) at res_rtp_asterisk.c:2217
#9  0x00007ff76efe9eb5 in on_timer (th=<optimized out>, te=<optimized out>) at ../src/pjnath/ice_session.c:1177
#10 0x00007ff76f065147 in pj_timer_heap_poll (ht=0x4ba32b8, next_delay=next_delay@entry=0x0) at ../src/pj/timer.c:659
#11 0x00007ff69acd5420 in timer_worker_thread (data=<optimized out>) at res_rtp_asterisk.c:2296
#12 0x00007ff76f04e1a0 in thread_main (param=0x5faac00) at ../src/pj/os_core_unix.c:541
#13 0x00007ff76d09be65 in start_thread () from /usr/lib64/libpthread.so.0
#14 0x00007ff76c43d88d in clone () from /usr/lib64/libc.so.6

Related code lines (res_rtp_asterisk.c:6159) is: ast_free(rtp->rtcp->local_addr_str);

Seems like rtp->rtcp->local_addr_str memory was corrupt (released, allocated or wrote) and libc asserts it.

We attach additional information.

¿Does anyone know if it’s a known issue?
We can colaborate testing or getting additional information.
Comments:By: Asterisk Team (asteriskteam) 2020-05-11 09:45:59.117-0500

Thanks for creating a report! The issue has entered the triage process. That means the issue will wait in this status until a Bug Marshal has an opportunity to review the issue. Once the issue has been reviewed you will receive comments regarding the next steps towards resolution.

A good first step is for you to review the [Asterisk Issue Guidelines|https://wiki.asterisk.org/wiki/display/AST/Asterisk+Issue+Guidelines] if you haven't already. The guidelines detail what is expected from an Asterisk issue report.

Then, if you are submitting a patch, please review the [Patch Contribution Process|https://wiki.asterisk.org/wiki/display/AST/Patch+Contribution+Process].

Please note that once your issue enters an open state it has been accepted. As Asterisk is an open source project there is no guarantee or timeframe on when your issue will be looked into. If you need expedient resolution you will need to find and pay a suitable developer. Asking for an update on your issue will not yield any progress on it and will not result in a response. All updates are posted to the issue when they occur.
By: Joshua C. Colp (jcolp) 2020-05-11 11:22:21.045-0500

Thank you for the crash report. However, we need more information to investigate the crash. Please provide:

1. A backtrace generated from a core dump using the instructions provided on the Asterisk wiki [1].
2. Specific steps taken that lead to the crash.
3. All configuration information necesary to reproduce the crash.

Thanks!

[1]: https://wiki.asterisk.org/wiki/display/AST/Getting+a+Backtrace


By: Josep B (icr) 2020-05-11 11:57:10.603-0500

Thanks, and sorry I missed upload backtraces.

Unfortunately we don't know how to reproduce. The crash reproduced 2 times in production environment with 150+ extensions.

We use Asterisk 13.32.0 with PJSIP2.9 bundled. Extensions are configured with  WebRTC and rel100/PRACK.

[Example endpoint configuration|^endpoint-config.txt]
By: Friendly Automation (friendly-automation) 2020-06-01 11:44:17.729-0500

Change 14450 merged by Friendly Automation:
res_rtp_asterisk: Re-order RTP destruction.

[https://gerrit.asterisk.org/c/asterisk/+/14450|https://gerrit.asterisk.org/c/asterisk/+/14450]