ASTERISK-06696: asterisk crash in chan

[Home]

Summary: ASTERISK-06696: asterisk crash in chan_iax2

Reporter: Tim Ferguson (crashhd) Labels:

Date Opened: 2006-04-04 11:50:35 Date Closed: 2006-05-10 11:33:58

Priority: Critical Regression? No

Status: Closed/Complete Components: Core/General

Versions: Frequency of
Occurrence

Related
Issues:

Environment: Attachments: ( 0) thread_apply_all_bt.txt

Description: Asterisk will randomly crash. Pretty common occurence on this one box I have. Asterisk version is SVN-branch-1.2-r16771 ; zaptel 1.2.5 ; libpri 1.2.2

****** ADDITIONAL INFORMATION ******

(gdb) bt
#0 0x008aeae9 in schedule_delivery (fr=0xb7189188, updatehistory=1, fromtrunk=0, tsout=0xb74e5904) at chan_iax2.c:2398
#1 0x008a859e in socket_read (id=0x9225cd8, fd=8, events=1, cbdata=0x9225d08) at chan_iax2.c:7614
#2 0x080558ab in ast_io_wait (ioc=0x9224858, howlong=0) at io.c:284
#3 0x008a2f89 in network_thread (ignore=0x0) at chan_iax2.c:7983
#4 0x00442dd8 in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1 0x00835d2a in clone () from /lib/tls/libc.so.6
(gdb) bt full
#0 0x008aeae9 in schedule_delivery (fr=0xb7189188, updatehistory=1, fromtrunk=0, tsout=0xb74e5904) at chan_iax2.c:2398
frame = {data = 0xb7189180, ts = 43, ms = 344, type = -1223688176, next = 0x88ecf8, prev = 0xb7100010}
type = 1
len = 20
ret = 0
needfree = 0
t = {tv_sec = 22, tv_usec = 665000}
#1 0x008a859e in socket_read (id=0x9225cd8, fd=8, events=1, cbdata=0x9225d08) at chan_iax2.c:7614
orignative = 1
sin = {sin_family = 2, sin_port = 55569, sin_addr = {s_addr = 2511540295}, sin_zero = "\000\000\000\000\000\000\000"}
res = 164
updatehistory = 1
new = 0
buf = "\000\001X\211~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\177\177\177\177\177\177", '\0' <repeats 64 times>, "\001\000\000\000\001", '\0' <repeats 115 times>, "e0x"...
ptr = (void *) 0x0
len = 16
dcallno = 0
fh = (struct ast_iax2_full_hdr *) 0xb7189188
mte = (struct ast_iax2_meta_trunk_entry *) 0x0
mtm = (struct ast_iax2_meta_trunk_mini *) 0xb6b80e30
dblbuf = "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~", '\0' <repeats 2000 times>, "0b\v\b\000\000\000\024?020x\000\000\000@\000\000\000\000\000\000\000\000\0000b\v\b\000\000\000\024?020x\000\000\000@", '\0' <repeats 73 times>...
fr = {sockfd = 0, callno = 14, dcallno = 0, data = 0x0, datalen = 0, retries = 0, ts = 22665, retrytime = 0,
outoforder = 0, sentyet = 0, oseqno = 13, iseqno = 9, transfer = 0, final = 0, direction = 0, retrans = 0, next = 0x0,
prev = 0x0, af = {frametype = 2, subclass = 4, datalen = 160, samples = 160, mallocd = 0, offset = 64, src = 0x8b8b2f "IAX2",
data = 0xb74e59a4, delivery = {tv_sec = 0, tv_usec = 0}, prev = 0x0, next = 0x0}, unused = '\0' <repeats 63 times>,
afdata = 0xb74e59a4 "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}
cur = (struct iax_frame *) 0xb7189188
iabuf = "10.0.4.253\00049\000\000"
f = {frametype = 2, subclass = 4, datalen = 160, samples = 160, mallocd = 0, offset = 0, src = 0x8b8b2f "IAX2",
data = 0xb74e69b4, delivery = {tv_sec = 0, tv_usec = 0}, prev = 0x0, next = 0x0}
c = (struct ast_channel *) 0x0
dp = (struct iax2_dpcache *) 0xb74e5934
tpeer = (struct iax2_trunk_peer *) 0xb74e5934
ies = {called_number = 0x0, calling_number = 0x0, calling_ani = 0x0, calling_name = 0x0, calling_ton = -1,
calling_tns = -1, calling_pres = -1, called_context = 0x0, username = 0x0, password = 0x0, capability = 0, format = 0,
codec_prefs = 0x0, language = 0x0, version = 0, adsicpe = 0, dnid = 0x0, rdnis = 0x0, authmethods = 0, encmethods = 0,
challenge = 0x0, md5_result = 0x0, rsa_result = 0x0, apparent_addr = 0x0, refresh = 0, dpstatus = 0, callno = 0, cause = 0x0,
causecode = 16 '\020', iax_unknown = 0 '\0', msgcount = -1, autoanswer = 0, musiconhold = 0, transferid = 0, datetime = 0,
devicetype = 0x0, serviceident = 0x0, firmwarever = -1, fwdesc = 0, fwdata = 0x0, fwdatalen = 0 '\0', enckey = 0x0,
enckeylen = 0 '\0', provver = 0, samprate = 1, provverpres = 0, rr_jitter = 0, rr_loss = 0, rr_pkts = 0, rr_delay = 0,
rr_dropped = 0, rr_ooo = 0}
ied0 = {buf = "\026\031No such context/extension*\001\003", '\0' <repeats 993 times>, pos = 30}
ied1 = {buf = "\t\004\000\000\000\004", '\0' <repeats 1017 times>, pos = 6}
format = -1223126648
exists = 1
minivid = 0
empty = '\0' <repeats 31 times>
duped_fr = (struct iax_frame *) 0x1
host_pref_buf = "(ulaw)", '\0' <repeats 121 times>
caller_pref_buf = "()", '\0' <repeats 125 times>
pref = {order = "\003", '\0' <repeats 30 times>}
rpref = {order = '\0' <repeats 31 times>}
using_prefs = 0x8b9927 "mine"
#2 0x080558ab in ast_io_wait (ioc=0x9224858, howlong=0) at io.c:284
res = 1
x = 0
origcnt = 2
#3 0x008a2f89 in network_thread (ignore=0x0) at chan_iax2.c:7983
res = -1229451728
---Type <return> to continue, or q <return> to quit---
count = 0
f = (struct iax_frame *) 0x9224858
freeme = (struct iax_frame *) 0x5
#4 0x00442dd8 in start_thread () from /lib/tls/libpthread.so.0
No symbol table info available.
ASTERISK-1 0x00835d2a in clone () from /lib/tls/libc.so.6
No symbol table info available.

Comments: By: Tim Ferguson (crashhd) 2006-04-04 12:00:29

The last time it crashed (today) the exit code was: 11
By: Tim Ferguson (crashhd) 2006-04-04 12:01:29

Linux Version: CentOS
Kernel Version: 2.4.21-40.ELsmp
By: Tim Ferguson (crashhd) 2006-04-06 21:09:49

#0 0x00172009 in schedule_delivery (fr=0x8c96c30, updatehistory=Variable "updatehistory" is not available.
) at chan_iax2.c:2381
2381 if ((ast_bridged_channel(iaxs[fr->callno]->owner)->tech->properties & AST_CHAN_TP_WANTSJITTER)) {
(gdb) bt
#0 0x00172009 in schedule_delivery (fr=0x8c96c30, updatehistory=Variable "updatehistory" is not available.
) at chan_iax2.c:2381
#1 0x0018131d in socket_read (id=0x8bc0eb0, fd=8, events=1, cbdata=0x8bc2210) at chan_iax2.c:7617
#2 0x08055b5f in ast_io_wait (ioc=0x8bc21f0, howlong=0) at io.c:284
#3 0x00178daf in network_thread (ignore=0x0) at chan_iax2.c:7986
#4 0x00c93371 in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1 0x00a849be in clone () from /lib/tls/libc.so.6
(gdb) bt full
#0 0x00172009 in schedule_delivery (fr=0x8c96c30, updatehistory=Variable "updatehistory" is not available.
) at chan_iax2.c:2381
len = 20
ret = Variable "ret" is not available.
(gdb)

This is with files debug patch.
By: Tilghman Lesher (tilghman) 2006-04-16 01:35:37

What is the ACTUAL signal that caused this coredump? The signal is listed at the top of the gdb output and is not included in your report.

I suspect you have a machine with a hardware problem.
By: Andrey S Pankov (casper) 2006-04-16 11:18:49

Corydon76: look at the Note ASTERISK-4266688 :)
By: Tim Ferguson (crashhd) 2006-04-17 01:05:32

We only had one crash last week (on the 14th of april). This is down from 2 or 3 a day previous to File's patch to check for the ->tech (pointer) null values (line 2381 of chan_iax2.c)

Here is the gdb, bt full from the most recent crash:
#0 0x00291009 in schedule_delivery (fr=0xb6c27400, updatehistory=Variable "updatehistory" is not available.
) at chan_iax2.c:2381
warning: Source file is more recent than executable.

2381 if ((ast_bridged_channel(iaxs[fr->callno]->owner)->tech) && (ast_bridged_channel(iaxs[fr->callno]->owner)->tech->properties & AST_CHAN_TP_WANTSJITTER)) {
(gdb) bt full
#0 0x00291009 in schedule_delivery (fr=0xb6c27400, updatehistory=Variable "updatehistory" is not available.
) at chan_iax2.c:2381
len = 20
ret = Variable "ret" is not available.

The exit signal was 11 on this most recent crash and 11 on the previously posted crash.
By: Serge Vecher (serge-v) 2006-05-02 16:06:14

CrashHD: what's the status with this situation? Does it still exist in the latest 1.2 branch -- if so, please produce a bt from a non-optimized build. Thanks...
By: Serge Vecher (serge-v) 2006-05-10 11:33:58

no response from a reporter. If the issue still exists in latest trunk or 1.2 branch, please reopen the report with a backtrace from non-optimized build. Thank you.