[asterisk-bugs] [Asterisk 0011174]: Crash related to ast_module_user_remove

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=11174 
====================================================================== 
Reported By:                lvl
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   11174
Category:                   Core-General
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     feedback
Asterisk Version:            SVN 
SVN Branch (only for SVN checkouts, not tarball releases):  1.4  
SVN Revision (number only!): 89046 
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             11-06-2007 15:04 CST
Last Modified:              11-06-2007 20:44 CST
====================================================================== 
Summary:                    Crash related to ast_module_user_remove
Description: 
Asterisk randomly crashes after this sequence of events:

== Manager 'call' logged on from 127.0.0.1
-- Executing [s at callee:3] Hangup("Local/s at callee-c93d,2", "") in new
stack
== Spawn extension (callee, s, 3) exited non-zero on
'Local/s at callee-c93d,2'
*** glibc detected *** asterisk: free(): invalid pointer: 0x081b8f79 ***

======= Backtrace: =========
/lib/i686/cmov/libc.so.6[0xb7de9cf5]
/lib/i686/cmov/libc.so.6(cfree+0x90)[0b7ded790]
asterisk(__ast_module_user_remove+0x11c)[0x80b7cf0]
/usr/lib/asterisk/modules/chan_local.so[0xb6f247df]
asterisk(ast_hangup+0x372)[0x8085854]
asterisk[0x80cf76f]
asterisk[0x80cf9bf]
asterisk[0x8110eee]
/lib/i686/cmov/libpthread.so.0[0xb7f3646b]
/lib/i686/cmov/libc.so.6(clone+0x5e)[0xb7e534de]
====================================================================== 

---------------------------------------------------------------------- 
 lvl - 11-06-07 20:44  
---------------------------------------------------------------------- 
I haven't been able to reproduce the crash yet while asterisk is running in
valgrind - probably because it appears to slow everything down quite a bit
(our testing box isn't very fast to begin with).

Recompiling with MALLOC_DEBUG did yield some very interesting information
though, the key points being:

== Spawn extension (callee, s, 3) exited non-zero on
'Local/s at callee-4c57,2'
WARNING: Freeing unused memory at 0x824bde9, in __ast_module_user_remove
of loader.c, line 204
== Spawn extension (test2, s, 2) exited non-zero on
'Local/s at callee-4c57,1'
Segmentation fault (core dumped)

and

Program terminated with signal 11, Segmentation fault.
http://bugs.digium.com/view.php?id=0  0x080bb646 in __ast_module_user_remove
(mod=0x82236b8, u=0x824a9e0) at
loader.c:201
201             AST_LIST_REMOVE(&mod->users, u, entry);

I'm attaching the complete backtrace as new_bt.txt. 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
11-06-07 20:44  lvl            Note Added: 0073277                          
======================================================================