[Asterisk-bugs] [Asterisk 0010163]: Manhattan MII-794 class 2 usb/bluetooth adapter: asterisk crashes when call is bridged.

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=10163 
====================================================================== 
Reported By:                murf
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   10163
Category:                   Addons/chan_mobile
Reproducibility:            always
Severity:                   crash
Priority:                   high
Status:                     new
Asterisk Version:            SVN 
SVN Branch (only for SVN checkouts, not tarball releases):  trunk 
SVN Revision (number only!):  
Disclaimer on File?:        Yes 
Request Review:              
====================================================================== 
Date Submitted:             07-09-2007 17:03 CDT
Last Modified:              07-12-2007 06:10 CDT
====================================================================== 
Summary:                    Manhattan MII-794 class 2 usb/bluetooth adapter:
asterisk crashes when call is bridged.
Description: 
(gdb) where
http://bugs.digium.com/view.php?id=0  0x08081186 in __ast_read (chan=0x8259d30,
dropaudio=0) at
channel.c:2201
http://bugs.digium.com/view.php?id=1  0x080824cd in ast_read (chan=0x8259d30) at
channel.c:2457
http://bugs.digium.com/view.php?id=2  0x08086e03 in ast_generic_bridge
(c0=0x82588e8, c1=0x8259d30,
config=0xb5675574, fo=0xb5674ad0, rc=0xb5674acc, bridge_end={tv_sec = 0,
tv_usec = 0}) at channel.c:3883
http://bugs.digium.com/view.php?id=3  0x080881c6 in ast_channel_bridge
(c0=0x82588e8, c1=0x8259d30,
config=0xb5675574, fo=0xb5674ad0, rc=0xb5674acc) at channel.c:4195
http://bugs.digium.com/view.php?id=4  0xb771b7fe in ast_bridge_call
(chan=0x82588e8, peer=0x8259d30,
config=0xb5675574) at res_features.c:1679
http://bugs.digium.com/view.php?id=5  0xb6c195e3 in dial_exec_full
(chan=0x82588e8, data=0xb5677a28,
peerflags=0xb5675884, continue_exec=0x0) at app_dial.c:1779
http://bugs.digium.com/view.php?id=6  0xb6c19877 in dial_exec (chan=0x82588e8,
data=0xb5677a28) at
app_dial.c:1825
http://bugs.digium.com/view.php?id=7  0x080bd13c in pbx_exec (c=0x82588e8,
app=0x823f9f8, data=0xb5677a28)
at pbx.c:565
http://bugs.digium.com/view.php?id=8  0x080c01ce in pbx_extension_helper
(c=0x82588e8, con=0x0,
context=0x8258a70 "extension", exten=0x8258ac0 "844", priority=1,
label=0x0, callerid=0x82554f8 "152", action=E_SPAWN)
    at pbx.c:1788
http://bugs.digium.com/view.php?id=9  0x080c1462 in ast_spawn_extension
(c=0x82588e8, context=0x8258a70
"extension", exten=0x8258ac0 "844", priority=1, callerid=0x82554f8
"152") at pbx.c:2279
http://bugs.digium.com/view.php?id=10 0x080c194d in __ast_pbx_run (c=0x82588e8)
at pbx.c:2379
http://bugs.digium.com/view.php?id=11 0x080c2874 in ast_pbx_run (c=0x82588e8) at
pbx.c:2643
http://bugs.digium.com/view.php?id=12 0xb6e650df in ss_thread (data=0x82588e8)
at chan_zap.c:6133
http://bugs.digium.com/view.php?id=13 0x080ffd02 in dummy_start (data=0x81904f0)
at utils.c:546
http://bugs.digium.com/view.php?id=14 0xb7de3341 in start_thread ()
from /lib/tls/i686/cmov/libpthread.so.0
http://bugs.digium.com/view.php?id=15 0xb7c224ee in clone () from
/lib/tls/i686/cmov/libc.so.6

======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
related to          0009694 Chan local with /n cause core dump
====================================================================== 

---------------------------------------------------------------------- 
 spblinux - 07-12-07 06:10  
---------------------------------------------------------------------- 
Have seen this invalid memory address in readq.first as well.

Does anybody know if it is correct to set chan->readq.first=NULL after the
channel has been allocated witch ast_channel_alloc? (in
chan_cellphone/mobile line 659.

Ugly workaround for a given machine is to patch channel.c and check the
absolute size of the memory address stored in readq.first (which is what I
did on an embedded mipsel system,
http://spblinux.de/fbox/openwrt/chan_cellphone/channel.c.bug/).

spblinux 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
07-12-07 06:10  spblinux       Note Added: 0067296                          
======================================================================