[asterisk-bugs] [Asterisk 0017084]: [patch] Asterisk crash in func_odbc

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=17084 
====================================================================== 
Reported By:                falves11
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   17084
Category:                   Channels/General
Reproducibility:            random
Severity:                   crash
Priority:                   normal
Status:                     ready for testing
Asterisk Version:           SVN 
JIRA:                       SWP-1162 
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): 1.6.1 
SVN Revision (number only!): 253802 
Request Review:              
====================================================================== 
Date Submitted:             2010-03-23 12:46 CDT
Last Modified:              2010-05-05 02:40 CDT
====================================================================== 
Summary:                    [patch] Asterisk crash in func_odbc
Description: 
I am attaching the GDB backtrace
====================================================================== 

---------------------------------------------------------------------- 
 (0121397) freddy77 (reporter) - 2010-05-05 02:40
 https://issues.asterisk.org/view.php?id=17084#c121397 
---------------------------------------------------------------------- 
I narrow down the problem. Cores happen mostly on unixODBC code but problem
is related to asterisk. It happen only with multiprocessor machines with
high traffic and odbc drivers which does not support multiple statements on
a single connection (like FreeTDS). 

We enabled unixODBC logging and after some days log demonstrate this
situation (I can send a 100K log).
1- thread1: allocate statement1 on connection1
2- thread2: allocate statement2 on connection1
3- thread2: do some processing on statement2
4- thread1: try to do some processing on statement1, it fails cause
connection1 support only a single active statement
5- thread1: disconnect connection1 and try another connection
6- thread2: core cause statement2 has been freed by thread1 disconnection

The problem is a race condition in res_odbc.c (1 and 2 should not happen
together).

Here you are the fix.

--- res/res_odbc.c.orig	2010-05-05 03:03:59.000000000 -0400
+++ res/res_odbc.c	2010-05-05 03:05:12.000000000 -0400
@@ -689,9 +689,13 @@
 		while ((obj = ao2_iterator_next(&aoi))) {
 			if (! obj->used) {
 				ast_mutex_lock(&obj->lock);
-				obj->used = 1;
+				/* this time check inside lock to avoid thread problems */
+				if (!obj->used) {
+					obj->used = 1;
+					ast_mutex_unlock(&obj->lock);
+					break;
+				}
 				ast_mutex_unlock(&obj->lock);
-				break;
 			}
 			ao2_ref(obj, -1);
 		} 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-05-05 02:40 freddy77       Note Added: 0121397                          
======================================================================