[asterisk-bugs] [JIRA] (ASTERISK-25403) A11 SIGSEGV clearerr (fp=0x0) at clearerr.c:26...in ast_careful_fwrite

[Mark Michelson (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-25403?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=227752#comment-227752 ] 

Mark Michelson commented on ASTERISK-25403:
-------------------------------------------

Based on the logs, it looks like there is a race condition related to a websocket session. One thread closes the websocket connection and destroys the websocket session, and immediately after, another thread attempts to send a SIP request on that websocket session. It appears that there is a reference counting error in chan_sip when it comes to websocket sessions.

> A11 SIGSEGV clearerr (fp=0x0) at clearerr.c:26...in ast_careful_fwrite
> ----------------------------------------------------------------------
>
>                 Key: ASTERISK-25403
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-25403
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>    Affects Versions: 11.19.0
>         Environment: Ubuntu 14.04.2 LTS , asterisk version 11.19 updated to trunk, last commit: b4535b0
>            Reporter: Nicole McIntosh
>            Assignee: Mark Michelson
>         Attachments: debug_last_10000_lines.txt, telesto-debug-sept17_c.txt.gz, telesto-fullbt-sept17.txt
>
>
> crash from clearerr. Full bt and debug logs added.
> {noformat}
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  clearerr (fp=0x0) at clearerr.c:26
> 26      clearerr.c: No such file or directory.
> (gdb) bt
> #0  clearerr (fp=0x0) at clearerr.c:26
> #1  0x000000000059ab61 in ast_careful_fwrite (f=0x0, fd=403,
>     src=0x7fc57808a2a0 "\201~\002 at OPTIONS sip:qaa6jskd at xx.xx.xx.xx;transport=wss SIP/2.0\r\nVia: SIP/2.0/WS 
> xx.xx.xx.xx:5060;branch=z9hG4bK00cdd40b;rport\r\nMax-Forwards: 70\r\nFrom: \"Unknown\" <sip:Unknown at xx.xx.xx.xx>;tag=as1263c02"..., 
> len=580, timeoutms=288) at utils.c:1432
> #2  0x00007fc5b822b48b in __ast_websocket_write (session=0x7fc52a924278,
>     opcode=AST_WEBSOCKET_OPCODE_TEXT,
>     payload=0x7fc54425da48 "OPTIONS sip:qaa6jskd at xx.xx.xx.xx;transport=wss SIP/2.0\r\nVia: SIP/2.0/WS 
> xx.xx.xx.xx:5060;branch=z9hG4bK00cdd40b;rport\r\nMax-Forwards: 70\r\nFrom: \"Unknown\" <sip:Unknown at xx.xx.xx.xx>;tag=as1263c026\r
> \nT"..., payload_size=576) at res_http_websocket.c:273
> #3  0x00007fc55b8e43cd in __sip_xmit (p=0x7fc54425ec28, data=0x7fc54425da30) at chan_sip.c:3739
> #4  0x00007fc55b8e5c8c in __sip_reliable_xmit (p=0x7fc54425ec28, seqno=102, resp=0,
>     data=0x7fc54425da30, fatal=1, sipmethod=3) at chan_sip.c:4149
> #5  0x00007fc55b8e8099 in send_request (p=0x7fc54425ec28, req=0x7fc57808b1d0,
>     reliable=XMIT_CRITICAL, seqno=102) at chan_sip.c:4657
> #6  0x00007fc55b91411a in transmit_invite (p=0x7fc54425ec28, sipmethod=3, sdp=0, init=2,
>     explicit_uri=0x0) at chan_sip.c:14328
> #7  0x00007fc55b964986 in sip_poke_peer (peer=0x125af68, force=0) at chan_sip.c:29911
> #8  0x00007fc55b91e3c6 in sip_poke_peer_s (data=0x125af68) at chan_sip.c:15907
> #9  0x000000000057c0bd in ast_sched_runq (con=0x10c4600) at sched.c:639
> #10 0x00007fc55b961ec7 in do_monitor (data=0x0) at chan_sip.c:29360
> #11 0x000000000059a430 in dummy_start (data=0x119a010) at utils.c:1223
> #12 0x00007fc5ba719182 in start_thread (arg=0x7fc57808c700) at pthread_create.c:312
> #13 0x00007fc5bb88647d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
> {noformat}



--
This message was sent by Atlassian JIRA
(v6.2#6252)