[asterisk-bugs] [Asterisk 0013040]: 1.4.21.1 crashes seg fault using console/dsp

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=13040 
====================================================================== 
Reported By:                Geisj
Assigned To:                kpfleming
====================================================================== 
Project:                    Asterisk
Issue ID:                   13040
Category:                   Channels/chan_alsa
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     assigned
Asterisk Version:           1.4.21.1 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             2008-07-09 15:17 CDT
Last Modified:              2008-08-01 13:44 CDT
====================================================================== 
Summary:                    1.4.21.1 crashes seg fault using console/dsp
Description: 
Simple call into dialplan, dials console/dsp speaks message
every minute then hangs up. EVENTUALLY seg faults with below.
I am using alsa 1.0.16 with centos 4.6

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1215857760 (LWP 29590)]
__ast_read (chan=0x8ed5e08, dropaudio=0) at channel.c:2052
2052                    f = AST_LIST_REMOVE_HEAD(&chan->readq,
frame_list);
(gdb) where
http://bugs.digium.com/view.php?id=0  __ast_read (chan=0x8ed5e08, dropaudio=0)
at channel.c:2052
http://bugs.digium.com/view.php?id=1  0x08087b69 in ast_channel_bridge
(c0=0x8eca668, c1=0x8ed5e08,
    config=0xb78720d0, fo=0xb7871ca0, rc=0xb7871ca4) at channel.c:2348
http://bugs.digium.com/view.php?id=2  0x002f4bad in ast_bridge_call
(chan=0x8eca668, peer=0x8ed5e08,
    config=0xb78720d0) at res_features.c:1422
http://bugs.digium.com/view.php?id=3  0x00cbf03a in dial_exec_full
(chan=0x8eca668, data=) at
app_dial.c:1699
http://bugs.digium.com/view.php?id=4  0x00cc1bd4 in dial_exec (chan=0xffffffff,
data=0xffffffff)
    at app_dial.c:1753
http://bugs.digium.com/view.php?id=5  0x080ca1d0 in pbx_extension_helper
(c=0x8eca668, con=)
    at /usr/src/digium/asterisk-1.4.21.1/include/asterisk/strings.h:35
http://bugs.digium.com/view.php?id=6  0x080ceb46 in __ast_pbx_run (c=0x8eca668)
at pbx.c:2317
http://bugs.digium.com/view.php?id=7  0x080d097e in pbx_thread (data=0x8eca668)
at pbx.c:2636
http://bugs.digium.com/view.php?id=8  0x080ff5e5 in dummy_start
(data=0xffffffff) at utils.c:895
http://bugs.digium.com/view.php?id=9  0x005963cc in start_thread () from
/lib/tls/libpthread.so.0
http://bugs.digium.com/view.php?id=10 0x004ef1ae in clone () from
/lib/tls/libc.so.6
(gdb) q
The program is running.  Quit anyway (and detach it)? (y or n) Detaching
from program: /usr/sbin/asterisk, process 28404

====================================================================== 

---------------------------------------------------------------------- 
 (0090995) kpfleming (administrator) - 2008-08-01 13:44
 http://bugs.digium.com/view.php?id=13040#c90995 
---------------------------------------------------------------------- 
Well, there isn't much else to go on then; somehow the 'readq' field in the
channel structure has been corrupted and contains incorrect pointer values,
so when the code tries to get the next entry off the linked list that is
supposedly there, it crashes because it is following an invalid pointer.

The next likely step to try to find out why that occurred would be run
Asterisk inside valgrind and watch for memory usage warnings, but doing so
is somewhat complex and will slow down Asterisk quite a bit. Instructions
on how do this are in doc/valgrind.txt in the source tree. It's probably
the shortest path to finding out why this is occurring. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2008-08-01 13:44 kpfleming      Note Added: 0090995                          
======================================================================