<html>
<body>
<div style="font-family: Verdana, Arial, Helvetica, Sans-Serif;">
<table bgcolor="#f9f3c9" width="100%" cellpadding="8" style="border: 1px #c9c399 solid;">
<tr>
<td>
This is an automatically generated e-mail. To reply, visit:
<a href="https://reviewboard.asterisk.org/r/1738/">https://reviewboard.asterisk.org/r/1738/</a>
</td>
</tr>
</table>
<br />
<blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
<p style="margin-top: 0;">On February 14th, 2012, 10:19 a.m., <b>Mark Michelson</b> wrote:</p>
<blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">This part has me a bit confused:
"If an item is added to the container prior to/while traversing it, the version number of that item will be greater then the version of iterator, and will be ignored"
If I'm reading internal_ao2_iterator_next() correctly, we specifically pay attention to objects with a higher version number than the iterator. So if something were to be added to the container while we are traversing, we won't ignore the new object if its version number is higher than the iterator's. This can lead to the same illegal writes past the end of peerarray that were possible before.
I don't think the change to ao2_iterator_init() actually helps anything. The only thing that the c_version of an ao2_iterator is used for is as an optimization to keep searching within the current bucket if the container can be detected as not having changed between calls to ao2_iterator_next(). The only time this optimization can be used is if the ao2_iterator's obj field is non-NULL. In the first call to ao2_iterator_next() after the initial ao2_iterator_init(), the obj field will be NULL, so the container version optimization couldn't be used anyway.</pre>
</blockquote>
<p>On February 14th, 2012, 10:35 a.m., <b>Matt Jordan</b> wrote:</p>
<blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Yup, this doesn't work. I thought the handling of the version in the iterator was handled differently - upon rereading it, it doesn't work how I thought it did. Nuts.
The only way to keep the array from being overrun is either to lock the peers container, or bail out once we've added the number of items we initially counted when we sized the array. I'm inclined to go with the second approach, even if it means the output of the "sip show peers" command isn't going to be terribly accurate. With a large number of peers, locking the container through the entire traversal may be prohibitive, which I think is what this was initially trying to avoid.</pre>
</blockquote>
</blockquote>
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Another alternative, which does involve locking the container but for a very short time, would be to call ao2_callback() on the container with a callback function that is non-selective, and let ao2_callback() hand you a dynamically allocated iterator with references to all the objects that existed in the container at that instant (a snapshot).</pre>
<br />
<p>- Kevin</p>
<br />
<p>On February 14th, 2012, 6:51 a.m., Matt Jordan wrote:</p>
<table bgcolor="#fefadf" width="100%" cellspacing="0" cellpadding="8" style="background-image: url('https://reviewboard.asterisk.org/media/rb/images/review_request_box_top_bg.png'); background-position: left top; background-repeat: repeat-x; border: 1px black solid;">
<tr>
<td>
<div>Review request for Asterisk Developers, Mark Michelson and rmudgett.</div>
<div>By Matt Jordan.</div>
<p style="color: grey;"><i>Updated Feb. 14, 2012, 6:51 a.m.</i></p>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Description </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
<tr>
<td>
<pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">The SIP show peers command stores pointers to the current peers in the peers container in a fixed size array. The size of this array is determined a bit before iterating through the peers container. The container is not locked during the array initialization, nor while the iterator is initialized. There are at least two problems with this:
1) The array is allocated at the beginning of the method. There are a number of exit points from the function that occur before the array is deallocated, resulting in a memory leak.
2) The array size is supposed to be the current number of peers in the container. However, the peers container is not locked when the size is determined, and the version of the iterator is not set until ao2_iterator_next is called. Thus, any items added to the peers container prior to the first traversal of the container will be "counted" during the traversal, and the array can be overrun.
This would typically occur if some other thread performed a sip reload at the same time as the sip show peers command, and additional peers were added in between when the array was sized and when the peers were traversed.
This patch takes a bit more of a pessimistic view of the thread-safety involved with showing the peers. We lock the container during the period that we build the array for sorting and when we initialize the ao2_iterator. The ao2_iterator initialization has been modified as well to set the version to the container version, as opposed to waiting for the first traversal of the container. This should be safe:
1) If an item is added to the container prior to/while traversing it, the version number of that item will be greater then the version of iterator, and will be ignored
2) If an item is removed from the container prior to/while traversing it, the number of items added to the array will be less then the array size, which is acceptable
Note that you can still have a situation where a reload occurs during a sip show peers which changes what the command will output while it is building the peer array; however, that's no different then the current behavior. The only way to prevent that would be to lock the peers container during the entire traversal, which would potentially impact performance on normal SIP operations.</pre>
</td>
</tr>
</table>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Testing </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
<tr>
<td>
<pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Basic testing involving running sip show peers and reloading. More testing will need to be done by the issue reporter, who was performing "sip reloads" alongside a script that ran "sip show peers" once a second.</pre>
</td>
</tr>
</table>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Diffs</b> </h1>
<ul style="margin-left: 3em; padding-left: 0;">
<li>/branches/1.8/channels/chan_sip.c <span style="color: grey">(355135)</span></li>
<li>/branches/1.8/main/astobj2.c <span style="color: grey">(355135)</span></li>
</ul>
<p><a href="https://reviewboard.asterisk.org/r/1738/diff/" style="margin-left: 3em;">View Diff</a></p>
</td>
</tr>
</table>
</div>
</body>
</html>