[asterisk-bugs] [Asterisk 0012155]: race condition between sip hangup and "core show channel xxx" results in crash

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=12155 
====================================================================== 
Reported By:                tsearle
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   12155
Category:                   Resources/res_features
Reproducibility:            sometimes
Severity:                   crash
Priority:                   normal
Status:                     new
Asterisk Version:           1.4.18 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             03-06-2008 02:56 CST
Last Modified:              03-10-2008 09:24 CDT
====================================================================== 
Summary:                    race condition between sip hangup and "core show
channel xxx" results in crash
Description: 
sometimes when the command "core show channel (channel name)" it results in
a crash when trying to print the contents of the channels cdr object. 
Analysis of the core dumps have show this to always occur at the same time
the channel is in the process of hanging up.

Following the code backwards I found that the root cause was in
res_features.c
After shutting down the bridge, it frees the channel cdr object without
first locking the channel to make sure it's safe.

Attached is a patch that introduces locking.
====================================================================== 

---------------------------------------------------------------------- 
 eliel - 03-10-08 09:24  
---------------------------------------------------------------------- 
peer->cdr = NULL;
chan->cdr = bridge_cdr; /* make this available to the rest of the world
via the chan while the call is in progress */
+			ast_channel_unlock(peer);

In the second block of the patch you are unlocking the channel structure
but you continue writing into it. (chan->cdr = bridge_cdr). Why you think
it is not necessary to lock till the end of the 'if' block?.

Thanks in advanced 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
03-10-08 09:24  eliel          Note Added: 0083661                          
======================================================================