[asterisk-bugs] [Asterisk 0013409]: [patch] Huge memory leak because memory of channel cdr struct is never returned

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=13409 
====================================================================== 
Reported By:                tomaso
Assigned To:                murf
====================================================================== 
Project:                    Asterisk
Issue ID:                   13409
Category:                   Core/Channels
Reproducibility:            always
Severity:                   block
Priority:                   normal
Status:                     feedback
Asterisk Version:           SVN 
SVN Branch (only for SVN checkouts, not tarball releases): 1.6.0 
SVN Revision (number only!): 137818 
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             2008-09-01 09:48 CDT
Last Modified:              2008-09-08 15:05 CDT
====================================================================== 
Summary:                    [patch] Huge memory leak because memory of channel
cdr struct is never returned
Description: 
After two days of stress testing by making lots of calls across sip and
dahdi channels the asterisk process memory reached dizzy values: VSZ=3,2GB,
RSS=1,6GB before asterisk stucked completely (even the RAM of our server
(2GB) is finite ;-) ).

Actually this problem is not a question of load, but appears for each
single call.

Using valgrind the reason for that was quickly found: The memory of the
channel cdr struct (chan->cdr) is never returned, not for sip, not for
dahdi channels, when a channel is cleared.

Reproduce:
a.f.a.p. default configuration (modules.conf, etc.)
Make lots of calls and see ps's VSZ and RSS values.

Interested in a patch ? Or is someone revise this anyway?

======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
related to          0013235 Memory leak in Asterisk 1.4 and Trunk
====================================================================== 

---------------------------------------------------------------------- 
 (0092187) dferrer (reporter) - 2008-09-08 15:05
 http://bugs.digium.com/view.php?id=13409#c92187 
---------------------------------------------------------------------- 
Murf & tomaso, I've can reproduce the bug that I mentioned. Asterisk
crashes when doing an and attended transfer.
In a normal call, A -> B, A press "attended_transfer" combination
(res_features, http://bugs.digium.com/view.php?id=0 in my case), then A calls B,
B answers. B accepts call,
so A must hungup, when hungup is done, Asterisk crashes with segmentation
fault, with same backtrace that I post.

I've tested with SVN revs 141565 and 141267. Also I can confirm that code
that frees the cdr is what causes the segfault:

main/channel.c: svn rev 141156
 1281   if (chan->cdr) {
 1282     ast_cdr_discard(chan->cdr);
 1283     chan->cdr = NULL;
 1284   }

If I comment this chunk of code, attended transfer works as expected (no
asterisk crash).
The problem appears that the free of CDR gives problem in
ast_cdr_specialized_reset(), cdr->next is is pointing anywhere, but not
NULL. I'm attaching the last bt, for rev 141565.

Should I open another bug or continue from here? 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2008-09-08 15:05 dferrer        Note Added: 0092187                          
======================================================================