[asterisk-bugs] [Asterisk 0013623]: Asterisk segfaults when using SIP session timers

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=13623 
====================================================================== 
Reported By:                Nik Soggia
Assigned To:                dvossel
====================================================================== 
Project:                    Asterisk
Issue ID:                   13623
Category:                   Channels/chan_sip/General
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     assigned
Asterisk Version:           1.6.1-beta1 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2008-10-06 05:46 CDT
Last Modified:              2009-06-29 16:49 CDT
====================================================================== 
Summary:                    Asterisk segfaults when using SIP session timers
Description: 
My Asterisk 1.6.0-rc6 shows the same symptoms as in issue 0012919: under
moderate or heavy traffic it keeps crashing randomly about every half an
hour.
Inbound traffic is coming from a single equipment (not under my control)
that always sends "Session-Expires" in the SIP packet. In the additional
information I enclosed a typical incoming packet.

I set "session-timers = refuse" in sip.conf [general] last friday and it
didn't crash anymore in about three days. after a so long time without a
single crash I think that we can say that it fixed the problem.

I collected 23 core dumps in about 10 hours, it is a production machine
that suddendly started crashing and I had no time to recompile and enable
thread debugging as recommended. In the additional information I enclosed
all the backtraces.

The backtraces show that the crash is mostly inside proc_session_timer(),
but in different lines, as if p->stimer disappears just after the initial
consistency check (maybe the channel is closing exactly when the timer
expires?).

Should you need the core dumps (about 130 Mb), I can send them to you
privately, they contain lots of confidential data and I can't make them
public.
======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
related to          0012919 Segmentation fault in "Session tim...
has duplicate       0015309 After 20 mins with heaviy traffic it bl...
====================================================================== 

---------------------------------------------------------------------- 
 (0107181) russell (administrator) - 2009-06-29 16:49
 https://issues.asterisk.org/view.php?id=13623#c107181 
---------------------------------------------------------------------- 
This is going to be more complicated than I originally thought, since in
1.6.0, sip_pvt is not a reference counted object at all ... 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-06-29 16:49 russell        Note Added: 0107181                          
======================================================================