[asterisk-bugs] [Asterisk 0015109]: Abort by memory allocator, possibly in moh_files_generator

Asterisk Bug Tracker noreply at bugs.digium.com
Tue Aug 18 15:24:49 CDT 2009


A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=15109 
====================================================================== 
Reported By:                jvandal
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   15109
Category:                   Resources/res_musiconhold
Reproducibility:            random
Severity:                   block
Priority:                   normal
Status:                     feedback
Target Version:             1.4.27
Asterisk Version:           1.4.24 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2009-05-14 10:49 CDT
Last Modified:              2009-08-18 15:24 CDT
====================================================================== 
Summary:                    Abort by memory allocator, possibly in
moh_files_generator
Description: 
I have a server running with Asterisk 1.4.24.1 where it randomly segfault
for "unknown" reason.

I'm not sure if this is related to moh_files_generator function or with
filestream_descructor.

Let me know what needed in order to fix this crash, if GDB traces aren't
enough. 

Asterisk is compiled with DONT_OPTIMIZE and others flag needed for "gdb".

======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
related to          0014958 Segfault Asterisk 1.4.24.1
related to          0015123 out of bounds crash and core dump
related to          0015506 Asterisk 1.4.26rc5 (revision 202945 ) d...
parent of           0015396 app_queue segfault in revision 202945
has duplicate       0015195 double free or corruption (!prev) in mo...
====================================================================== 

---------------------------------------------------------------------- 
 (0109242) marhbere (reporter) - 2009-08-18 15:24
 https://issues.asterisk.org/view.php?id=15109#c109242 
---------------------------------------------------------------------- 
rusell, In our case is SIP attended transfers, and our scenario is:

SIP -> QUEUE (Members are LOCAL without '/n' and Dynamics) -> SIP
(Attended Transfer) -> SIP.
In 24hs where were made 75 attended transfer, only 1 of these has produced
the crash.

This is last log before crash:

[2009-08-15 17:29:04.717] DEBUG[22402] chan_sip.c: Trying to put 'SIP/2.0
20' onto UDP socket destined for 10.240.18.189:5060
[2009-08-15 17:29:04.717] DEBUG[22402] channel.c: Planning to masquerade
channel SIP/EXT-THSMSW-b7577a10 into the structure of SIP/325-b75ca530
[2009-08-15 17:29:04.718] DEBUG[22402] channel.c: Done planning to
masquerade channel SIP/EXT-THSMSW-b7577a10 into the structure of
SIP/325-b75ca530
[2009-08-15 17:29:04.718] DEBUG[22402] chan_sip.c: Trying to put 'NOTIFY
sip' onto UDP socket destined for 10.240.18.189:5060
[2009-08-15 17:29:04.718] DEBUG[22402] chan_sip.c: SIP attended transfer:
Unlocking channel SIP/325-b75ca530
[2009-08-15 17:29:04.718] DEBUG[4109] channel.c: Got clone lock for
masquerade on 'SIP/EXT-THSMSW-b7577a10' at 0x91c1c3c
[2009-08-15 17:29:04.718] DEBUG[4109] chan_sip.c: Hangup call
SIP/EXT-THSMSW-b7577a10<MASQ>, SIP callid 12f5f432-d97c1df6 at 10.240.18.189
[2009-08-15 17:29:04.718] DEBUG[4109] chan_sip.c: Trying to put 'SIP/2.0
60' onto UDP socket destined for 10.240.18.189:5060
[2009-08-15 17:29:04.718] DEBUG[4109] res_config_mysql.c: MySQL RealTime:
Connection okay.
[2009-08-15 17:29:04.718] DEBUG[4109] res_config_mysql.c: MySQL RealTime:
Insert SQL: INSERT into PBX_QDR (time, callid, queuename, agent, event,
data) values ('1250357344', 'ippbx01v2.xxxxxxxxxx.net-1250357236.24456',
'qTHS-CustomerService', '6502', 'TRANSFER',
's|FunctionRouteChannel|15|60')
[2009-08-15 17:29:04.744] DEBUG[22402] chan_sip.c: Stopping retransmission
on '3688fc1b714ee6962f9b011e50ad76ee at 10.240.10.54' of Request 103: Match
Found
[2009-08-15 17:29:04.744] DEBUG[22402] chan_sip.c: Got 200 OK on NOTIFY
for transfer
[2009-08-15 17:29:04.756] DEBUG[22402] chan_sip.c: Stopping retransmission
on '12f5f432-d97c1df6 at 10.240.18.189' of Response 102: Match Found
[2009-08-15 17:29:04.841] DEBUG[4109] res_config_mysql.c: MySQL RealTime:
row inserted on table: PBX_QDR, id: 894502
[2009-08-15 17:29:04.841] DEBUG[4109] channel.c: Set channel
SIP/EXT-THSMSW-b7577a10 to write format ulaw
[2009-08-15 17:29:04.841] DEBUG[4109] channel.c: Set channel
SIP/EXT-THSMSW-b7577a10 to read format ulaw
[2009-08-15 17:29:04.841] DEBUG[4109] channel.c: Putting channel
SIP/EXT-THSMSW-b7577a10 in 4/4 formats
[2009-08-15 17:29:04.841] DEBUG[4109] channel.c: Driver for channel
'SIP/EXT-THSMSW-b7577a10' does not support indication 3, emulating it
[2009-08-15 17:29:04.841] DEBUG[4109] channel.c: Set channel
SIP/EXT-THSMSW-b7577a10 to write format slin
[2009-08-15 17:29:04.841] DEBUG[4109] channel.c: Scheduling timer at 160
sample intervals
[2009-08-15 17:29:04.841] DEBUG[4109] channel.c: Released clone lock on
'SIP/325-b75ca530<ZOMBIE>'
[2009-08-15 17:29:04.841] DEBUG[4109] channel.c: Done Masquerading
SIP/EXT-THSMSW-b7577a10 (6)
[2009-08-15 17:29:11.987] VERBOSE[4139] logger.c: [2009-08-15
17:29:11.987]  Asterisk Event Logger Started /var/log/asterisk/event_log

The gdb bt:
https://issues.asterisk.org/view.php?id=0  0x00c36416 in __kernel_vsyscall ()
https://issues.asterisk.org/view.php?id=1  0x00348460 in raise (sig=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
https://issues.asterisk.org/view.php?id=2  0x00349e28 in abort () at abort.c:88
https://issues.asterisk.org/view.php?id=3  0x00385fed in __libc_message
(do_abort=2, fmt=0x460e68 "*** glibc
detected *** %s: %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:170
https://issues.asterisk.org/view.php?id=4  0x0038c3a4 in malloc_printerr
(action=2, str=0x460f40 "double free or
corruption (out)", ptr=0xb635a138) at malloc.c:5994
https://issues.asterisk.org/view.php?id=5  0x0038e356 in __libc_free
(mem=0xb635a138) at malloc.c:3625
https://issues.asterisk.org/view.php?id=6  0x0037bda4 in _IO_new_fclose
(fp=0xb635a138) at iofclose.c:88
https://issues.asterisk.org/view.php?id=7  0x080d5aa5 in filestream_destructor
(arg=0xb6396390) at file.c:329
https://issues.asterisk.org/view.php?id=8  0x08080640 in ao2_ref
(user_data=0xb6396390, delta=-1) at
astobj2.c:227
https://issues.asterisk.org/view.php?id=9  0x080d873b in
ast_filestream_frame_freed (fr=0xb63963c0) at
file.c:1309
https://issues.asterisk.org/view.php?id=10 0x080d9bd0 in __frame_free
(fr=0xb63963c0, cache=1) at frame.c:338
https://issues.asterisk.org/view.php?id=11 0x080d9d2e in ast_frame_free
(frame=0xb63963c0, cache=1) at
frame.c:380
https://issues.asterisk.org/view.php?id=12 0x01dff6e5 in moh_files_generator
(chan=0x91c1bb0, data=0xb5b9fad8,
len=0, samples=160) at res_musiconhold.c:302
https://issues.asterisk.org/view.php?id=13 0x08096f95 in generator_force
(data=0x91c1bb0) at channel.c:1930
https://issues.asterisk.org/view.php?id=14 0x080987bf in __ast_read
(chan=0x91c1bb0, dropaudio=0) at
channel.c:2647
https://issues.asterisk.org/view.php?id=15 0x0809a1e5 in ast_read
(chan=0x91c1bb0) at channel.c:3021
https://issues.asterisk.org/view.php?id=16 0x080a03af in ast_generic_bridge
(c0=0x91c1bb0, c1=0xb733ed30,
config=0xb5cce540, fo=0xb5ccca5c, rc=0xb5ccca58, bridge_end=
      {tv_sec = 0, tv_usec = 0}) at channel.c:4749
https://issues.asterisk.org/view.php?id=17 0x080a1de3 in ast_channel_bridge
(c0=0x91c1bb0, c1=0xb733ed30,
config=0xb5cce540, fo=0xb5ccca5c, rc=0xb5ccca58)
    at channel.c:5120
https://issues.asterisk.org/view.php?id=18 0x080cd3ac in ast_bridge_call
(chan=0x91c1bb0, peer=0xb733ed30,
config=0xb5cce540) at features.c:2330
https://issues.asterisk.org/view.php?id=19 0x00c1640b in try_calling
(qe=0xb5ccea70, options=0xb5cce9c8 "",
announceoverride=0xb5cce9ca "", url=0xb5cce9c9 "", 
    tries=0xb5ccec34, noption=0xb5ccec30, agi=0x0, macro=0x0, gosub=0x0,
ringing=0) at app_queue.c:3956
https://issues.asterisk.org/view.php?id=20 0x00c1a233 in queue_exec
(chan=0x91c1bb0, data=0xb5cd0e38) at
app_queue.c:4879
https://issues.asterisk.org/view.php?id=21 0x080ff85c in pbx_exec (c=0x91c1bb0,
app=0xb7e76c10, data=0xb5cd0e38)
at pbx.c:951
https://issues.asterisk.org/view.php?id=22 0x08106afe in pbx_extension_helper
(c=0x91c1bb0, con=0x0,
context=0x91c1e04 "FunctionRouteQueue", exten=0x91c1e54 "s", 
    priority=6, label=0x0, callerid=0xb7553b10 "18133258149",
action=E_SPAWN, found=0xb5cd327c, combined_find_spawn=1)
    at pbx.c:3120
https://issues.asterisk.org/view.php?id=23 0x081085d4 in ast_spawn_extension
(c=0x91c1bb0, context=0x91c1e04
"FunctionRouteQueue", exten=0x91c1e54 "s", priority=6, 
    callerid=0xb7553b10 "18133258149", found=0xb5cd327c,
combined_find_spawn=1) at pbx.c:3584
https://issues.asterisk.org/view.php?id=24 0x08108c86 in __ast_pbx_run
(c=0x91c1bb0, args=0x0) at pbx.c:3671
https://issues.asterisk.org/view.php?id=25 0x08109e9d in pbx_thread
(data=0x91c1bb0) at pbx.c:3944
https://issues.asterisk.org/view.php?id=26 0x0815ac0c in dummy_start
(data=0x924b5d0) at utils.c:861
https://issues.asterisk.org/view.php?id=27 0x004cb51f in start_thread
(arg=0xb5cd3b90) at pthread_create.c:297
https://issues.asterisk.org/view.php?id=28 0x0040104e in clone () at
../sysdeps/unix/sysv/linux/i386/clone.S:130

To resolve to find the real problem, we tried to establish MALLOC_CHECK_
to 1, but is not working. the system crashed again and has occurred without
causing what is said in "man malloc". Why could this have happened?

Reg 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-08-18 15:24 marhbere       Note Added: 0109242                          
======================================================================




More information about the asterisk-bugs mailing list