[asterisk-bugs] [Asterisk 0016754]: [patch] Multiple segfaults in leave_voicemail at app_voicemail.c:4451 Asterisk 1.4.29

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=16754 
====================================================================== 
Reported By:                aragon
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   16754
Category:                   Applications/app_voicemail
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     ready for testing
Asterisk Version:           1.4.29 
JIRA:                       SWP-844 
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2010-02-02 13:08 CST
Last Modified:              2010-02-08 13:29 CST
====================================================================== 
Summary:                    [patch] Multiple segfaults in leave_voicemail at
app_voicemail.c:4451 Asterisk 1.4.29
Description: 
Asterisk 1.4.27 was locking at leave_voicemail and after upgrading to
1.4.29 in a desperate attempt to clear the locking Asterisk 1.4.29 started
segfaulting every 2 or 3 minutes.  I had to downgrade to 1.4.27 to prevent
the segfaults.
Here is the evidence of the lock in the ast CLI
app.c: Failed to lock path
'/var/spool/asterisk/voicemail/customer/3329/INBOX': File exists.
The permissions on this folder look normal.
Under 1.4.27 core show locks was useless, core show channels was useless.
When voicemail directories start locking htop showed CPU utilization at
300 where normal load is about 1 on 1.4.27

Attaching Asterisk CLI history.
Ran 1.4.29 under Valgrind for a few minutes until it crashed so I could
upload valgrind capture.
Uploading gdb file with bt, bt full, thread apply all bt full
I believe that while Asterisk was locked on mailbox leaving a message in
mailbox 3329 caused the segfault.  Other mailboxes display similar locking
symptoms in Asterisk CLI.


====================================================================== 

---------------------------------------------------------------------- 
 (0117852) aragon (reporter) - 2010-02-08 13:29
 https://issues.asterisk.org/view.php?id=16754#c117852 
---------------------------------------------------------------------- 
tilghman:

Here is my hypothesis of what happened:
.lock is created by app_voicemail.c on count_messages function ...
-create a .lock 
-look for all .txt files and increment by 1 the counter
-unlock / remove the lock file
-return result
-called when someone open his voicemail or when someone leave a message on
a mailbox
-.lock files are written constantly but in some case (probably because of
CPU load) the .lock file was not removed
-next access to INBOX caused crash because of orphaned .lock file

You mentioned you "have no idea how the userdata portion within astobj2
could ever be NULL".
I suspect that the null is because nothing was able to delete the orphaned
.lock file in the mailbox due to CPU load.  It would be nice to see some
sanity check to auto delete the .lock file if it shouldn't be there rather
than a null... (If you have something you want me to test that does this
then I will happily test).

Anyway, your patch prevents the segfault in the worst case scenario and I
have no proof that the huge load which started all of this was caused by
Asterisk. Therefore I'm happy if you commit your patch and close out this
bug report.  I'll open another bug report if I find that Asterisk is
causing the high CPU load. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-02-08 13:29 aragon         Note Added: 0117852                          
======================================================================