[asterisk-bugs] [JIRA] (ASTERISK-21847) Segfault due to dahdi_restart and round robin

[Richard Mudgett (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-21847?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Richard Mudgett updated ASTERISK-21847:
---------------------------------------

    Attachment: jira_asterisk_21847_v1.8.patch

[^jira_asterisk_21847_v1.8.patch] - This patch clears the round_robin pointer array in dahdi_restart().

There is a very similar place in the v1.6.2 code.

Thank you for the analysis.  I can see not clearing the round_robin array causing a crash if you are using the round robin channel allocation method and do a restart.
                
> Segfault due to dahdi_restart and round robin
> ---------------------------------------------
>
>                 Key: ASTERISK-21847
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-21847
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Channels/chan_dahdi
>    Affects Versions: 1.8.22.0, 11.4.0
>         Environment: Not relevant
>            Reporter: Ivo Andonov
>            Severity: Minor
>         Attachments: jira_asterisk_21847_v1.8.patch
>
>
> Hello everyone,
> I did not specify a version as I think this one matches any version.
> I'm using Asterisk 1.6.2.20 in a production environment. Every morning I restart the PRI interface using the "dahdi restart" application. The first call that the system gets after that using the PRI generates a segfault. The dial string uses the round robin channel search. 
> After generating a core dump and a bt full I traced the problem down to dahdi_request function in which the struct dahdi_pvt *p gets set to an invalid pointer (0x38 in my case). Looking into the code I think I spoted the possible problem. Leaving it to the developers' opinion, but here are my findings:
> 1. (minor) round_robin array is defined as being of size 32, while the comments / description says "Dial(DAHDI/(g|G|r|R)<group#(0-63)>"... This might be confusing as the array is 32 and not 64. While there is an array length check against the group parameter in recent versions, it is not in 1.6.2.20.
> 2. dahdi_restart destroys all channels and thus invalidates any pointers in the round_robin array, however the latter is not reset to null, and I think this is the cause of the segfault I'm getting. round_robin is memset to 0 at load_module only.
> Best,
> Ivo

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.asterisk.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira