[asterisk-bugs] [JIRA] (ASTERISK-28413) pjsip show channelstats crashes asterisk while printing a channel being hung up

[Alex Hermann (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-28413?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Alex Hermann updated ASTERISK-28413:
------------------------------------

    Attachment: ast-28413-1.backtrace.txt

Backtrace of the crashing thread.

In frame #1, {{media->rtp == 0}}, causing the crash.

> pjsip show channelstats crashes asterisk while printing a channel being hung up
> -------------------------------------------------------------------------------
>
>                 Key: ASTERISK-28413
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-28413
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Channels/chan_pjsip
>    Affects Versions: 13.23.1
>            Reporter: Alex Hermann
>              Labels: pjsip
>         Attachments: ast-28413-1.backtrace.txt, ast-28413-1.txt
>
>
> I got a crash when {{pjsip show channelstats}} was executing (via Manager). In function {{cli_channelstats_print_body()}} it was trying to retrieve the stats via {{ast_rtp_instance_get_stats(media->rtp,...)}} for a channel that was in the process of being hung up. In this case, {{media->rtp}} was NULL even though it was checked for NULL only a few lines before, meaning the rtp instance got removed by another thread even though the print function still had a reference to it.
> I tried to find the code responsible for synchronizing access to {{media->rtp}} (locks, refcount) but could not find it. This makes me believe this is a bug in the code. Something should be in place to prevent the rtp instance from disappearing while still being referenced.
> As this crash was a one-time event (for now) I don't have debug logs. I do have a backtrace which i'll try to attach.



--
This message was sent by Atlassian JIRA
(v6.2#6252)