[asterisk-bugs] [Asterisk 0013623]: Asterisk segfaults when using SIP session timers

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=13623 
====================================================================== 
Reported By:                Nik Soggia
Assigned To:                dvossel
====================================================================== 
Project:                    Asterisk
Issue ID:                   13623
Category:                   Channels/chan_sip/General
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     assigned
Target Version:             1.6.1.2
Asterisk Version:           1.6.1-beta1 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2008-10-06 05:46 CDT
Last Modified:              2009-07-08 09:35 CDT
====================================================================== 
Summary:                    Asterisk segfaults when using SIP session timers
Description: 
My Asterisk 1.6.0-rc6 shows the same symptoms as in issue 0012919: under
moderate or heavy traffic it keeps crashing randomly about every half an
hour.
Inbound traffic is coming from a single equipment (not under my control)
that always sends "Session-Expires" in the SIP packet. In the additional
information I enclosed a typical incoming packet.

I set "session-timers = refuse" in sip.conf [general] last friday and it
didn't crash anymore in about three days. after a so long time without a
single crash I think that we can say that it fixed the problem.

I collected 23 core dumps in about 10 hours, it is a production machine
that suddendly started crashing and I had no time to recompile and enable
thread debugging as recommended. In the additional information I enclosed
all the backtraces.

The backtraces show that the crash is mostly inside proc_session_timer(),
but in different lines, as if p->stimer disappears just after the initial
consistency check (maybe the channel is closing exactly when the timer
expires?).

Should you need the core dumps (about 130 Mb), I can send them to you
privately, they contain lots of confidential data and I can't make them
public.
======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
related to          0012919 Segmentation fault in "Session tim...
has duplicate       0015309 After 20 mins with heaviy traffic it bl...
====================================================================== 

---------------------------------------------------------------------- 
 (0107482) svnbot (reporter) - 2009-07-08 09:35
 https://issues.asterisk.org/view.php?id=13623#c107482 
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 205117

U   branches/1.6.0/channels/chan_sip.c
U   branches/1.6.0/include/asterisk/sched.h

------------------------------------------------------------------------
r205117 | dvossel | 2009-07-08 09:35:58 -0500 (Wed, 08 Jul 2009) | 15
lines

SIP Dialog ref counting

This patch adds reference counting for sip dialogs into 1.6.0.
When proc_session_timer() is called from the scheduler thread
it has no guarantee the session timer's dialog won't be freed
from underneath it.  Now the session timer holds a reference
to the dialog, preventing it from being destroyed during the
middle of proc_session_timer().

(closes issue https://issues.asterisk.org/view.php?id=13623)
Reported by: Nik Soggia

Review: https://reviewboard.asterisk.org/r/302/


------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=205117 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-07-08 09:35 svnbot         Checkin                                      
2009-07-08 09:35 svnbot         Note Added: 0107482                          
======================================================================