[asterisk-bugs] [Asterisk 0012155]: race condition between sip hangup and "core show channel xxx" results in crash

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=12155 
====================================================================== 
Reported By:                tsearle
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   12155
Category:                   Resources/res_features
Reproducibility:            sometimes
Severity:                   crash
Priority:                   normal
Status:                     new
Asterisk Version:           1.4.18 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             03-06-2008 02:56 CST
Last Modified:              03-10-2008 09:52 CDT
====================================================================== 
Summary:                    race condition between sip hangup and "core show
channel xxx" results in crash
Description: 
sometimes when the command "core show channel (channel name)" it results in
a crash when trying to print the contents of the channels cdr object. 
Analysis of the core dumps have show this to always occur at the same time
the channel is in the process of hanging up.

Following the code backwards I found that the root cause was in
res_features.c
After shutting down the bridge, it frees the channel cdr object without
first locking the channel to make sure it's safe.

Attached is a patch that introduces locking.
====================================================================== 

---------------------------------------------------------------------- 
 tsearle - 03-10-08 09:52  
---------------------------------------------------------------------- 
in the case of the assignment operation the pointer is null (which is ok)
and pointing to a valid cdr object after so there is no risk of a crash
(assignment is an atomic operation)

I will update the patch as per your comments 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
03-10-08 09:52  tsearle        Note Added: 0083667                          
======================================================================