[asterisk-bugs] [Asterisk 0012969]: chanspy - crashes Asterisk - still

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=12969 
====================================================================== 
Reported By:                kowalma
Assigned To:                putnopvut
====================================================================== 
Project:                    Asterisk
Issue ID:                   12969
Category:                   Applications/app_chanspy
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     feedback
Asterisk Version:           1.4.20.1 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             2008-07-01 09:28 CDT
Last Modified:              2008-08-19 13:42 CDT
====================================================================== 
Summary:                    chanspy - crashes Asterisk - still
Description: 
Problem is same as in issue 11782. Chanspy crashes asterisk. I'll recompile
asterisk to fit settings decribed in docs/valgrind.txt
====================================================================== 

---------------------------------------------------------------------- 
 (0091557) svnbot (reporter) - 2008-08-19 13:42
 http://bugs.digium.com/view.php?id=12969#c91557 
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 138886

U   branches/1.4/apps/app_chanspy.c

------------------------------------------------------------------------
r138886 | mmichelson | 2008-08-19 13:42:13 -0500 (Tue, 19 Aug 2008) | 23
lines

Add a lock and unlock prior to the destruction of the chanspy_ds
lock to ensure that no other threads still have it locked. While
this should not happen under normal circumstances, it appears that
if the spyer and spyee hang up at nearly the same time, the following
may occur.

1. ast_channel_free is called on the spyee's channel.
2. The chanspy datastore is removed from the spyee's channel in 
   ast_channel_free.
3. In the spyer's thread, the spyer attempts to remove and destroy the
datastore
   from the spyee channel, but the datastore has already been removed in
step 2, 
   so the spyer continues in the code.
4. The spyee's thread continues and calls the datastore's destroy
callback, 
   chanspy_ds_destroy. This involves locking the chanspy_ds.
5. Now the spyer attempts to destroy the chanspy_ds lock. The problem is
that in step 4, 
   the spyee has locked this lock, meaning that the spyer is attempting to
destroy a lock 
   which is currently locked by another thread.

The backtrace provided in issue http://bugs.digium.com/view.php?id=12969
supports the idea that this is
possible
(and has even occurred). This commit does not close the issue, but should
help
in preventing one type of crash associated with the use of app_chanspy.


------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=138886 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2008-08-19 13:42 svnbot         Note Added: 0091557                          
======================================================================