[Home]

Summary:ASTERISK-06025: chan_sip schedules destruction of subscription twice (causes crash)
Reporter:Philip Walls (malverian)Labels:
Date Opened:2006-01-09 18:06:41.000-0600Date Closed:2006-01-28 06:55:56.000-0600
Priority:CriticalRegression?No
Status:Closed/CompleteComponents:Channels/chan_sip/General
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:
Description:It appears that the chan_sip __sip_destroy method is scheduling the destruction of calls that have already been destroyed. This results in a double-free and a corrupted stack (no backtrace).

Initially I believed that this problem was only occuring when the owner was in place, but the most recent crash disproves that theory.

This problem has been an issue for me since I began using Asterisk (pre-1.2 CVS) through 1.2.0 and 1.2.1. I have other logs available if you believe they will be of any use.

This problem may be brought out by our inhouse developed SIP phone. We use that phone along with about 30x SNOM 320 phones. If the SIP phone is required to reproduce this bug, I should be able to provide you with a Win32 binary (works well in wine).

****** ADDITIONAL INFORMATION ******

Jan  6 23:24:03 DEBUG[30813] chan_sip.c: Auto destroying call ''
Jan  6 23:24:03 NOTICE[30813] sched.c: Attempted to delete nonexistent schedule entry 0!
Jan  6 23:24:03 WARNING[30813] chan_sip.c: Trying to destroy "", not found in dialog list?!?!
Jan  6 23:24:03 WARNING[30813] chan_sip.c: Huh?  Not a SIP header ()?
Jan  6 23:24:03 DEBUG[30813] chan_sip.c: Auto destroying call <A5>F<B7>L<C8>'
Jan  6 23:24:03 NOTICE[30813] sched.c: Attempted to delete nonexistent schedule entry 0!
Jan  6 23:24:03 WARNING[30813] chan_sip.c: Trying to destroy <A5>F<B7>L<C8>", not found in dialog list?!?!
Jan  6 23:24:03 DEBUG[30813] chan_sip.c: Stopping retransmission on 'fehv4tkmp5k9hb17jl92@209.208.68.76' of Request 103: Match Found
Jan  6 23:24:03 DEBUG[30813] chan_sip.c: Auto destroying call ''
Comments:By: paradise (paradise) 2006-01-10 00:29:34.000-0600

see also bug ASTERISK-5755813
there is also some patches there.
it seems that this bug is related to subscription and hint system.
if you remove all hints from extensions.conf no more crash will occur.
By: Olle Johansson (oej) 2006-01-10 00:46:23.000-0600

Please provide a SIP debug of a call that ends like this. Turn on debug and verbosity to 4 and capture together with sip debugging.
By: Olle Johansson (oej) 2006-01-10 00:47:11.000-0600

paradise: Why do you think this bug is related to subscriptions?
By: paradise (paradise) 2006-01-10 02:20:47.000-0600

when i remove hints no more crash will occur. but when adding them back crashing starts.
By: Philip Walls (malverian) 2006-01-10 11:08:08.000-0600

This looks identical to the problem paradise linked to. Sorry for the duplicate.

I am getting spammed with call destruction of a bunch of subscription related call IDs right before crash. I can't disable hints here on my production system to confirm that the crashes stop.

As it is the crashes occur seemingly at random intervals (sometimes days between, sometimes 2-3 in a day).
By: Olle Johansson (oej) 2006-01-24 13:30:14.000-0600

Got access to the machine to debug this
By: Olle Johansson (oej) 2006-01-26 01:57:37.000-0600

Malverian: Any more crashes on your machine?
By: Ramon Peek-Fares (ramonpeek) 2006-01-27 10:34:05.000-0600

Just to inform you, I have had the same issue several times now. Using Asterisk 1.2.2 stable and I also use Snom phones 320 and 360. Although my believe is it happens due to a login from an Xlite user. Because everytime it happens that user has just logged on.

My FULL.log shows:
Jan 27 15:45:15 VERBOSE[6283] logger.c:     -- Registered SIP '5171' at 192.168.1.253 port 8286 expires 180
Jan 27 15:45:15 DEBUG[6283] chan_sip.c: Stopping retransmission on '190becbe1739cc780c18f8ae20704a70@pbx.trends.nl' of Request 102: Match Found
Jan 27 15:45:16 DEBUG[6283] chan_sip.c: Auto destroying call '441eeb6ad83cb753@bGFwdG9wLXJwLnRyZW5kcy5ubA..'
Jan 27 15:45:16 DEBUG[6283] chan_sip.c: Auto destroying call 'd854802eeb7ccc08@bGFwdG9wLXJwLnRyZW5kcy5ubA..'
Jan 27 15:45:16 DEBUG[6283] chan_sip.c: Auto destroying call ''
Jan 27 15:45:16 NOTICE[6283] sched.c: Attempted to delete nonexistent schedule entry 0!

++++ CRASH ++++

Notice the empty '' ??!?
By: Serge Vecher (serge-v) 2006-01-27 10:55:41.000-0600

ramonpeek: stable 1.2.2 is outdated. Please test with v.1.2.3. If the problem persists: 1) set debug 4; 2) set verbose 4; 3) sip debug on; 4)capture the full transaction and 5) post log here as an _attachment_.
By: Philip Walls (malverian) 2006-01-27 14:18:08.000-0600

oej, Last night I implemented the patch you made into our production server. We haven't had any crashes yet so far. I will keep you posted.
By: Philip Walls (malverian) 2006-01-27 14:22:55.000-0600

Also, I haven't tried mgernoth's patch from bug 5813. If we do end up having crashes still, I will try it out.
By: Olle Johansson (oej) 2006-01-28 06:52:40.000-0600

Resolved in svn 1.2 and trunk. If there are new problems with this issue, please re-open or contact us in #asterisk-dev on Freenode IRC. Thanks to Malverian for letting me access his system.

Revision 8808 of 1.2, Fixed previously in trunk.