Summary:	ASTERISK-10033: [Patch] Incorrect logic when creating and queuing dynamic threads in socket_read() and iax2_process_thread()
Reporter:	mihai (mihai)	Labels:
Date Opened:	2007-08-06 15:03:00	Date Closed:	2007-08-06 15:27:36
Priority:	Critical	Regression?	No
Status:	Closed/Complete	Components:	Channels/chan_iax2
Versions:		Frequency of Occurrence
Related Issues:
Environment:		Attachments:	( 0) idle_thread_signal_peter.patch
Description:	Consider the situation where socket_read() calls find_idle_thread() and creates a new dynamic thread. If there is an error condition or if there is a thread already processing a full frame for the current call, the current thread gets put back into the dynamic thread list by a call to insert_idle_thread().  However, with the current code, the thread will conditionally wait on a signal which, in this case, will never come, so the thread will timeout.  Since the thread was never used, put_into_idle is 0, so the thread will exit its for loop and destroy itself without removing its dynamic_list entry.  We end up with entries in dynamic_list that have no corresponding thread and this situation can lead to crashes. The proposed patch changes socket_read and iax2_process_thread so that insertion into dynamic_list queue happens only in the thread itself. We use the thread->iostate == IAX_IOSTATE_IDLE to notify the thread to insert itself into the list. ****** ADDITIONAL INFORMATION ****** This problem was exposed (and partially created) by the fix for the second race condition described in 10289. The patch is generated against 1.4 branch, but applies to trunk as well.   Most of the credit goes to my colleague Pete, who spotted the bug.
Comments:	By: Digium Subversion (svnbot) 2007-08-06 15:26:37 Repository: asterisk Revision: 78242 ------------------------------------------------------------------------ r78242 | russell | 2007-08-06 15:26:36 -0500 (Mon, 06 Aug 2007) | 4 lines Fix an issue where dynamic threads can get free'd, but still exist in the dynamic thread list. (closes issue ASTERISK-10033, patch from Mihai, with credit to his colleague, Pete) ------------------------------------------------------------------------ By: Digium Subversion (svnbot) 2007-08-06 15:27:36 Repository: asterisk Revision: 78243 ------------------------------------------------------------------------ r78243 | russell | 2007-08-06 15:27:36 -0500 (Mon, 06 Aug 2007) | 12 lines Merged revisions 78242 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.4 ........ r78242 | russell | 2007-08-06 15:44:09 -0500 (Mon, 06 Aug 2007) | 4 lines Fix an issue where dynamic threads can get free'd, but still exist in the dynamic thread list. (closes issue ASTERISK-10033, patch from Mihai, with credit to his colleague, Pete) ........ ------------------------------------------------------------------------