[asterisk-bugs] [Zaptel 0010593]: Zaptel crashes kernel - zt_init_tone_state

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=10593 
====================================================================== 
Reported By:                jmhunter
Assigned To:                mattf
====================================================================== 
Project:                    Zaptel
Issue ID:                   10593
Category:                   zaptel (the module)
Reproducibility:            sometimes
Severity:                   crash
Priority:                   normal
Status:                     assigned
Zaptel Version:             1.4.5.1  
SVN Branch (only for SVN checkouts, not tarball releases): N/A  
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             08-29-2007 13:02 CDT
Last Modified:              10-17-2007 17:35 CDT
====================================================================== 
Summary:                    Zaptel crashes kernel - zt_init_tone_state
Description: 
When zaptel is compiled and installed on my system, any use of my TDM400P
card will eventually lead to a kernel crash - see attached trace.

The problem is reproducible by simply picking up a Zap channel handset. It
won't always crash straight away, though. Sometimes it takes longer to
crash, sometimes it's quicker - and I also get some really strange
"dialtones" varying from complete silence, through loud single tones, right
up to weird multiple tones similar to a fax or modem.

I don't believe this to be a hardware issue, as this system has been rock
solid under an older version of zaptel. The older zaptel versions no longer
compile cleanly under current kernels, however, so it's time for me to bite
the bullet and try to track down the cause of the crash.

Any suggestions gratefully received - where do I start?!
====================================================================== 

---------------------------------------------------------------------- 
 sim - 10-17-07 17:35  
---------------------------------------------------------------------- 
While the bug we experienced seems to be the same line in the same end
function, it seems our entry path may have actually been through a pseudo
channel instead of a PRI channel after all.  This may explain why I have
been unable to reproduce the crash by simulating thousands of calls over a
PRI crossover.  The only other thing I can find that uses this code are
Meetme() conferences.

I tracked down the instruction pointer offset the first function on the
stack of our backtrace, zt_chanandpseudo_ioctl+0x572/0x1250, to this
particular call:

                                chans[i]->span->dacs(chans[i], NULL);

...under the ZT_SETCONF ioctl switch section.  Again, it is not clear to
me whether this stack data is sane or not.

I will try to load test Meetme() conference creation and leave/joining, to
see if I can reproduce the race here. 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
10-17-07 17:35  sim            Note Added: 0072207                          
======================================================================