[asterisk-bugs] [Asterisk 0015915]: crash when calling ao2_unlock inside pthread_timer_disable_continuous

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=15915 
====================================================================== 
Reported By:                keiron
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   15915
Category:                   Resources/res_timing_pthread
Reproducibility:            random
Severity:                   crash
Priority:                   normal
Status:                     feedback
Asterisk Version:           Older 1.6.1 
JIRA:                       SWP-307 
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2009-09-18 01:03 CDT
Last Modified:              2009-11-30 23:37 CST
====================================================================== 
Summary:                    crash when calling ao2_unlock inside
pthread_timer_disable_continuous
Description: 
When under heavy load we have experienced random crashes (6 times in a day)
at the same point in the code. The load is with about 200 channels, 70
users and making a lot of calls. It was very stable until we started
reaching a certain level of usage.
====================================================================== 

---------------------------------------------------------------------- 
 (0114440) paul-tg (reporter) - 2009-11-30 23:37
 https://issues.asterisk.org/view.php?id=15915#c114440 
---------------------------------------------------------------------- 
Asterisk 1.6.2.0-rc6 is affected.

We have just hit this during a load spike in production; at a load of
around 4 calls per second, Asterisk on one of our servers crashed (and was
resurrected by safe_asterisk) twice in four minutes.

The backtraces show that a02_unlock() was passed a bad pointer -- 0x04 and
0x80 for the two crashes:

https://issues.asterisk.org/view.php?id=0  _ao2_unlock (user_data=0x80,
file=0x2aaabb0336e0
"res_timing_pthread.c", 
    func=0x2aaabb033d20 "pthread_timer_disable_continuous", line=240, 
    var=0x2aaabb0336f5 "timer") at astobj2.c:115
https://issues.asterisk.org/view.php?id=1  0x00002aaabb0309ce in
pthread_timer_disable_continuous (
    handle=<value optimized out>) at res_timing_pthread.c:240
https://issues.asterisk.org/view.php?id=2  0x0000000000470edd in __ast_read
(chan=0xbd0eab0, dropaudio=0)
    at channel.c:2693
https://issues.asterisk.org/view.php?id=3  0x00002aaab7fded23 in wait_for_answer
(in=0x2aaac47073e0, 
    outgoing=0xbd07620, to=0x44afb35c, peerflags=0x44afb3a0,
pa=0x44afaa20, 
    num_in=<value optimized out>, result=0x44afb354) at app_dial.c:893
https://issues.asterisk.org/view.php?id=4  0x00002aaab7fe191b in dial_exec_full
(chan=0x2aaac47073e0, 
    data=<value optimized out>, peerflags=0x44afb3a0, continue_exec=0x0)
    at app_dial.c:1852

It would appear that ao2_find() in find_timer() is returning a dodgy
pointer, but I have not delved further into the core files to find out why. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-11-30 23:37 paul-tg        Note Added: 0114440                          
======================================================================