[asterisk-bugs] [Asterisk 0012155]: race condition between sip hangup and "core show channel xxx" results in crash

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=12155 
====================================================================== 
Reported By:                tsearle
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   12155
Category:                   Resources/res_features
Reproducibility:            sometimes
Severity:                   crash
Priority:                   normal
Status:                     new
Asterisk Version:           1.4.18 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             03-06-2008 02:56 CST
Last Modified:              04-09-2008 19:55 CDT
====================================================================== 
Summary:                    race condition between sip hangup and "core show
channel xxx" results in crash
Description: 
sometimes when the command "core show channel (channel name)" it results in
a crash when trying to print the contents of the channels cdr object. 
Analysis of the core dumps have show this to always occur at the same time
the channel is in the process of hanging up.

Following the code backwards I found that the root cause was in
res_features.c
After shutting down the bridge, it frees the channel cdr object without
first locking the channel to make sure it's safe.

Attached is a patch that introduces locking.
====================================================================== 

---------------------------------------------------------------------- 
 pliew - 04-09-08 19:55  
---------------------------------------------------------------------- 
I can add that we have seen this behaviour on a few of our customer sites
using 1.4.12 to the latest 1.4.19. They monitor Zap channel utilisation via
the AMI "command -> core show channels" and at intermittent times will
cause the SMP kernel to have a "panic attack". Asterisk still runs, but the
thread that deals with further AMI requests for "show channels" dies. We
will try the second patch on one of those servers and report back. 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
04-09-08 19:55  pliew          Note Added: 0085264                          
======================================================================