[asterisk-bugs] [Asterisk 0010886]: Crash in local_queue_frame trying to trylock a corrupted p->owner lock

[noreply at bugs.digium.com]

The following issue has been ASSIGNED. 
====================================================================== 
http://bugs.digium.com/view.php?id=10886 
====================================================================== 
Reported By:                ChaseVenters
Assigned To:                russell
====================================================================== 
Project:                    Asterisk
Issue ID:                   10886
Category:                   Addons/General
Reproducibility:            random
Severity:                   crash
Priority:                   normal
Status:                     assigned
Asterisk Version:           1.4.11  
SVN Branch (only for SVN checkouts, not tarball releases): N/A  
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             10-04-2007 13:02 CDT
Last Modified:              10-16-2007 16:53 CDT
====================================================================== 
Summary:                    Crash in local_queue_frame trying to trylock a
corrupted p->owner lock
Description: 
It appears that local_queue_frame() is trying to lock a mutex that has been
destroyed (or is otherwise corrupt). The reentrancy value is 7903722 and
the pthread struct contains a value __m_owner = 0xbad, which is probably a
magic cookie for a mutex that has been destroyed.

In frame 1, isoutbound is 1, making other p->owner, making the corrupted
lock &p->owner->lock.
======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
duplicate of        0010571 SIP hairpin invokes Local within app_di...
====================================================================== 

---------------------------------------------------------------------- 
 svnbot - 10-16-07 16:53  
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 85994

U   branches/1.4/include/asterisk/lock.h

------------------------------------------------------------------------
r85994 | russell | 2007-10-16 16:53:52 -0500 (Tue, 16 Oct 2007) | 16 lines

Some locking errors exposed the fact that the lock debugging code itself
was
not thread safe.  How ironic!  Anyway, these changes ensure that the code
that
is accessing the lock debugging data is thread-safe.  

Many thanks to Ivan for finding and fixing the core issue here, and also 
thanks to those that tested the patch and provided test results.

(closes issue http://bugs.digium.com/view.php?id=10571)
(closes issue http://bugs.digium.com/view.php?id=10886)
(closes issue http://bugs.digium.com/view.php?id=10875)
(might close some others, as well ...)

Patches: (from issue http://bugs.digium.com/view.php?id=10571)
      ivan_ast_1_4_12_rel_patch_lock.h.diff uploaded by Ivan (license 229)
       - a few small changes by me

------------------------------------------------------------------------ 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
10-16-07 16:53  svnbot         Checkin                                      
10-16-07 16:53  svnbot         Note Added: 0072119                          
10-16-07 16:53  svnbot         Status                   new => assigned     
10-16-07 16:53  svnbot         Assigned To               => russell         
======================================================================