[asterisk-dev] channel.c:ast_channel_free question

[Russell Bryant]

Norman Franke wrote:
> While tracking down another issue, I came across this code in
> main/channel.c:ast_channel_free:
> 
>         if (chan->tech_pvt) {
>                 ast_log(LOG_WARNING, "Channel '%s' may not have been
> hung up properly\n", chan->name);
>                 free(chan->tech_pvt);
>         }
> 
> I had valgrind report something was still using this. That may have been
> due to some other bugs since fixed in bug report 11940, but I'm not
> sure. Anyway, should this really be freeing chan->tech_pvt when chan_sip
> should generally be taking care of that?
> 
> ==7874== Invalid read of size 4
> ==7874==    at 0x59D0671: ??? (chan_sip.c:4564)
> ==7874==    by 0x5A03A9A: ??? (chan_sip.c:15366)
> ==7874==    by 0x80AD830: ast_io_wait (io.c:279)
> ==7874==    by 0x5A0477C: ??? (chan_sip.c:15613)
> ==7874==    by 0x810003C: dummy_start (utils.c:852)
> ==7874==    by 0x403123F: start_thread (in
> /lib/tls/i686/cmov/libpthread-2.3.6.so)
> ==7874==    by 0x4FAF49D: clone (in /lib/tls/i686/cmov/libc-2.3.6.so)
> ==7874==  Address 0x719d4d0 is 136 bytes inside a block of size 5,620
> free'd
> ==7874==    at 0x401D40C: free (vg_replace_malloc.c:323)
> ==7874==    by 0x8072362: __ast_free_region (astmm.c:174)
> ==7874==    by 0x80726EE: __ast_free (astmm.c:208)
> ==7874==    by 0x8081D5F: ast_channel_free (channel.c:1202)
> ==7874==    by 0x8082A22: ast_hangup (channel.c:1496)
> ==7874==    by 0x697BD42: ??? (app_dial.c:1726)
> ==7874==    by 0x697BF6D: ??? (app_dial.c:1760)
> ==7874==    by 0x80BE5EE: pbx_exec (pbx.c:532)
> ==7874==    by 0x80C19E7: pbx_extension_helper (pbx.c:1851)
> ==7874==    by 0x80C2AE1: ast_spawn_extension (pbx.c:2306)
> ==7874==    by 0x80C2FFD: __ast_pbx_run (pbx.c:2408)
> ==7874==    by 0x80C3DB2: pbx_thread (pbx.c:2623)

The bug in this case would be that chan_sip still has a reference to the channel
after the channel has been free'd.  That is not supposed to ever happen.


-- 
Russell Bryant
Senior Software Engineer
Open Source Team Lead
Digium, Inc.