[asterisk-bugs] [Asterisk 0010841]: Random crash in frame.c:328

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=10841 
====================================================================== 
Reported By:                ast_rep
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   10841
Category:                   Core-General
Reproducibility:            unable to reproduce
Severity:                   crash
Priority:                   normal
Status:                     new
Asterisk Version:           1.4.11  
SVN Branch (only for SVN checkouts, not tarball releases): N/A  
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             09-28-2007 06:59 CDT
Last Modified:              09-30-2007 09:22 CDT
====================================================================== 
Summary:                    Random crash in frame.c:328
Description: 
We have been experiencing a series of random crashes on our Asterisk
production systems.

gdb's backtrace looks exactly the same for all of the core dumps we
collected.

Versions used:

asterisk 1.4.11 (with tx and rx fax compiled) 
libpri 1.4.1 
zaptel 1.4.5.1 
spandsp 0.0.3
libtiff-3.7.1-6
fedora core 4

There's some cases where Asterisk won't crash at all for days. Some other
days, it makes up to seven crashes a day.

We are using Asterisk with about 200 SIP Grandstream phones, we also have
two queues with four SIP members, a dual span E1, and one IAX trunk with
another asterisk 1.4.6

Here is the bt output

(gdb) bt
http://bugs.digium.com/view.php?id=0  0x00a0d402 in __kernel_vsyscall ()
http://bugs.digium.com/view.php?id=1  0x00aa71f8 in raise () from /lib/libc.so.6
http://bugs.digium.com/view.php?id=2  0x00aa8948 in abort () from /lib/libc.so.6
http://bugs.digium.com/view.php?id=3  0x00adc52a in __libc_message () from
/lib/libc.so.6
http://bugs.digium.com/view.php?id=4  0x00ae2424 in _int_free () from
/lib/libc.so.6
http://bugs.digium.com/view.php?id=5  0x00ae295f in free () from /lib/libc.so.6
http://bugs.digium.com/view.php?id=6  0x080a87f3 in frame_cache_cleanup
(data=0x98dbce8) at frame.c:328
http://bugs.digium.com/view.php?id=7  0x00bf0b7a in __nptl_deallocate_tsd ()
from /lib/libpthread.so.0
http://bugs.digium.com/view.php?id=8  0x00bf1b8e in start_thread () from
/lib/libpthread.so.0
http://bugs.digium.com/view.php?id=9  0x00b49dee in clone () from /lib/libc.so.6

bt full and thread apply all bt are in the uploaded txt.

Any clues?

====================================================================== 

---------------------------------------------------------------------- 
 dimas - 09-30-07 09:22  
---------------------------------------------------------------------- 
You are saying you have rxfax/txfax compiled, but do you use it? There is a
bug in these applications which under some circumstances may lead to memory
corruption. (more on this in issue 10815)

If I were you, I would run asterisk under valgrind to find where memory
gets corrupt. 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
09-30-07 09:22  dimas          Note Added: 0071213                          
======================================================================