[Home]

Summary:ASTERISK-12826: Asterisk segfaults when using SIP session timers
Reporter:Nik Soggia (nik soggia)Labels:
Date Opened:2008-10-06 05:46:44Date Closed:2009-07-08 09:36:05
Priority:CriticalRegression?No
Status:Closed/CompleteComponents:Channels/chan_sip/General
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:( 0) backtrace-inspired.txt
( 1) bt-23-10-2008.txt
( 2) core.01.txt
( 3) core.02.txt
( 4) core.03.txt
( 5) core.04.txt
( 6) core.05.txt
( 7) core.06.txt
( 8) core.07.txt
( 9) core.08.txt
(10) core.09.txt
(11) core.10.txt
(12) core.11.txt
(13) core.12.txt
(14) core.13.txt
(15) core.14.txt
(16) core.15.txt
(17) core.16.txt
(18) core.17.txt
(19) core.18.txt
(20) core.19.txt
(21) core.20.txt
(22) core.21.txt
(23) core.22.txt
(24) core.23.txt
(25) core.24.txt
(26) handle_leak.txt
Description:My Asterisk 1.6.0-rc6 shows the same symptoms as in issue 0012919: under moderate or heavy traffic it keeps crashing randomly about every half an hour.
Inbound traffic is coming from a single equipment (not under my control) that always sends "Session-Expires" in the SIP packet. In the additional information I enclosed a typical incoming packet.

I set "session-timers = refuse" in sip.conf [general] last friday and it didn't crash anymore in about three days. after a so long time without a single crash I think that we can say that it fixed the problem.

I collected 23 core dumps in about 10 hours, it is a production machine that suddendly started crashing and I had no time to recompile and enable thread debugging as recommended. In the additional information I enclosed all the backtraces.

The backtraces show that the crash is mostly inside proc_session_timer(), but in different lines, as if p->stimer disappears just after the initial consistency check (maybe the channel is closing exactly when the timer expires?).

Should you need the core dumps (about 130 Mb), I can send them to you privately, they contain lots of confidential data and I can't make them public.

****** ADDITIONAL INFORMATION ******

<--- SIP read from UDP://REMOTEIP:5060 --->
INVITE sip:OMISSIS0@LOCALIP SIP/2.0
Max-Forwards: 70
Session-Expires: 3600;Refresher=uac
Supported: timer
To: OMISSIS0 <sip:OMISSIS0@LOCALIP>
From: <sip:REMOTEIP:5060>;tag=OMISSIS1
Contact: <sip:REMOTEIP:5060>
Call-ID: OMISSIS2@REMOTEIP
CSeq: 1 INVITE
Via: SIP/2.0/UDP REMOTEIP:5060;branch=OMISSIS3
Content-Type: application/sdp
Content-Length: 219

v=0
o=NexTone-MSW 0 0 IN IP4 REMOTEIP
s=sip call
c=IN IP4 REMOTEIP
t=0 0
m=audio 20208 RTP/AVP 0 8 18 4 101
a=fmtp:101 0-15
a=rtpmap:101 telephone-event/8000
a=fmtp:18 annexb=yes
a=rtpmap:18 G729/8000


#0  0xb751a2f6 in proc_session_timer (vp=0xb6054f48) at chan_sip.c:19078
19078 if ((p->stimer->st_active != TRUE) || (p->owner->_state != AST_STATE_UP)) {
#0  0xb751a2f6 in proc_session_timer (vp=0xb6054f48) at chan_sip.c:19078
#1  0x081133d6 in ast_sched_runq (con=0xb7a143b8) at sched.c:371
#2  0xb752f272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x85) at utils.c:917
#4  0xb7d100fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7dd899e in clone () from /lib/tls/libc.so.6

#0  0xb76192c1 in proc_session_timer (vp=0x8542740) at chan_sip.c:19072
19072 if (p->stimer->st_active == TRUE) {
#0  0xb76192c1 in proc_session_timer (vp=0x8542740) at chan_sip.c:19072
#1  0x081133d6 in ast_sched_runq (con=0x81c3588) at sched.c:371
#2  0xb762e272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x455449) at utils.c:917
#4  0xb7cf90fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7dc199e in clone () from /lib/tls/libc.so.6

#0  0xb74972c1 in proc_session_timer (vp=0x8435bc8) at chan_sip.c:19072
19072 if (p->stimer->st_active == TRUE) {
#0  0xb74972c1 in proc_session_timer (vp=0x8435bc8) at chan_sip.c:19072
#1  0x081133d6 in ast_sched_runq (con=0xb7914288) at sched.c:371
#2  0xb74ac272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x3f9) at utils.c:917
#4  0xb7ca10fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7d6999e in clone () from /lib/tls/libc.so.6

#0  0xb7d85703 in strlen () from /lib/tls/libc.so.6
#0  0xb7d85703 in strlen () from /lib/tls/libc.so.6
#1  0xb7d59ef1 in vfprintf () from /lib/tls/libc.so.6
#2  0xb7d78700 in vsnprintf () from /lib/tls/libc.so.6
#3  0x081224d8 in __ast_str_helper (buf=0xb76152c4, max_len=8192, append=0,
   fmt=0x30303038 <Address 0x30303038 out of bounds>, ap=0x30303038 <Address 0x30303038 out of bounds>) at utils.c:1567
#4  0x080c44ef in ast_log (level=3, file=0xb7687524 "chan_sip.c", line=808464440,
   function=0xb76883e8 "proc_session_timer", fmt=0xb768fc60 "Null stimer in proc_session_timer - %s\n") at logger.c:1041
ASTERISK-1  0xb762d4ba in proc_session_timer (vp=0xb76883e8) at chan_sip.c:19065
ASTERISK-2  0x081133d6 in ast_sched_runq (con=0x81c5120) at sched.c:371
ASTERISK-3  0xb7642272 in do_monitor (data=0x0) at chan_sip.c:18968
ASTERISK-4  0x08124559 in dummy_start (data=0x0) at utils.c:917
ASTERISK-5  0xb7d0d0fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-6 0xb7dd599e in clone () from /lib/tls/libc.so.6

#0  0xb767f2f6 in proc_session_timer (vp=0x95e3198) at chan_sip.c:19078
19078 if ((p->stimer->st_active != TRUE) || (p->owner->_state != AST_STATE_UP)) {
#0  0xb767f2f6 in proc_session_timer (vp=0x95e3198) at chan_sip.c:19078
#1  0x081133d6 in ast_sched_runq (con=0x81c3588) at sched.c:371
#2  0xb7694272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x19) at utils.c:917
#4  0xb7d5f0fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7e2799e in clone () from /lib/tls/libc.so.6

#0  0xb75fd2c1 in proc_session_timer (vp=0x9c73038) at chan_sip.c:19072
19072 if (p->stimer->st_active == TRUE) {
#0  0xb75fd2c1 in proc_session_timer (vp=0x9c73038) at chan_sip.c:19072
#1  0x081133d6 in ast_sched_runq (con=0x81c4b88) at sched.c:371
#2  0xb7612272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x3935355f) at utils.c:917
#4  0xb7cdd0fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7da599e in clone () from /lib/tls/libc.so.6

#0  0xb7d9d6db in strlen () from /lib/tls/libc.so.6
#0  0xb7d9d6db in strlen () from /lib/tls/libc.so.6
#1  0xb7d71ef1 in vfprintf () from /lib/tls/libc.so.6
#2  0xb7d90700 in vsnprintf () from /lib/tls/libc.so.6
#3  0x081224d8 in __ast_str_helper (buf=0xb762d2c4, max_len=8192, append=0, fmt=0x1fffa <Address 0x1fffa out of bounds>,
   ap=0x1fffa <Address 0x1fffa out of bounds>) at utils.c:1567
#4  0x080c44ef in ast_log (level=3, file=0xb769f524 "chan_sip.c", line=131066, function=0xb76a03e8 "proc_session_timer",
   fmt=0xb76a7c60 "Null stimer in proc_session_timer - %s\n") at logger.c:1041
ASTERISK-1  0xb76454ba in proc_session_timer (vp=0xb76a03e8) at chan_sip.c:19065
ASTERISK-2  0x081133d6 in ast_sched_runq (con=0x81c3588) at sched.c:371
ASTERISK-3  0xb765a272 in do_monitor (data=0x0) at chan_sip.c:18968
ASTERISK-4  0x08124559 in dummy_start (data=0x0) at utils.c:917
ASTERISK-5  0xb7d250fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-6 0xb7ded99e in clone () from /lib/tls/libc.so.6

#0  0xb760c2c1 in proc_session_timer (vp=0x994e4d8) at chan_sip.c:19072
19072 if (p->stimer->st_active == TRUE) {
#0  0xb760c2c1 in proc_session_timer (vp=0x994e4d8) at chan_sip.c:19072
#1  0x081133d6 in ast_sched_runq (con=0x81c4b78) at sched.c:371
#2  0xb7621272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x2e58) at utils.c:917
#4  0xb7cec0fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7db499e in clone () from /lib/tls/libc.so.6

#0  0xb75e82c1 in proc_session_timer (vp=0xb69890a8) at chan_sip.c:19072
19072 if (p->stimer->st_active == TRUE) {
#0  0xb75e82c1 in proc_session_timer (vp=0xb69890a8) at chan_sip.c:19072
#1  0x081133d6 in ast_sched_runq (con=0x81c4b78) at sched.c:371
#2  0xb75fd272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x15b7f8) at utils.c:917
#4  0xb7cc80fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7d9099e in clone () from /lib/tls/libc.so.6

#0  0xb75c72c1 in proc_session_timer (vp=0xb710bc58) at chan_sip.c:19072
19072 if (p->stimer->st_active == TRUE) {
#0  0xb75c72c1 in proc_session_timer (vp=0xb710bc58) at chan_sip.c:19072
#1  0x081133d6 in ast_sched_runq (con=0x81c4b78) at sched.c:371
#2  0xb75dc272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0xd5d5d5d5) at utils.c:917
#4  0xb7ca70fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7d6f99e in clone () from /lib/tls/libc.so.6

#0  0xb76752c1 in proc_session_timer (vp=0xb6756240) at chan_sip.c:19072
19072 if (p->stimer->st_active == TRUE) {
#0  0xb76752c1 in proc_session_timer (vp=0xb6756240) at chan_sip.c:19072
#1  0x081133d6 in ast_sched_runq (con=0x81c4b78) at sched.c:371
#2  0xb768a272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x3530392d) at utils.c:917
#4  0xb7d550fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7e1d99e in clone () from /lib/tls/libc.so.6

#0  0xb75ed2f6 in proc_session_timer (vp=0xb6765b08) at chan_sip.c:19078
19078 if ((p->stimer->st_active != TRUE) || (p->owner->_state != AST_STATE_UP)) {
#0  0xb75ed2f6 in proc_session_timer (vp=0xb6765b08) at chan_sip.c:19078
#1  0x081133d6 in ast_sched_runq (con=0x81c4b78) at sched.c:371
#2  0xb7602272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x61666564) at utils.c:917
#4  0xb7ccd0fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7d9599e in clone () from /lib/tls/libc.so.6

#0  0xb7d576db in strlen () from /lib/tls/libc.so.6
#0  0xb7d576db in strlen () from /lib/tls/libc.so.6
#1  0xb7d2bef1 in vfprintf () from /lib/tls/libc.so.6
#2  0xb7d4a700 in vsnprintf () from /lib/tls/libc.so.6
#3  0x081224d8 in __ast_str_helper (buf=0xb75e72c4, max_len=8192, append=0, fmt=0x10007 <Address 0x10007 out of bounds>,
   ap=0x10007 <Address 0x10007 out of bounds>) at utils.c:1567
#4  0x080c44ef in ast_log (level=3, file=0xb7659524 "chan_sip.c", line=65543, function=0xb765a3e8 "proc_session_timer",
   fmt=0xb7661c60 "Null stimer in proc_session_timer - %s\n") at logger.c:1041
ASTERISK-1  0xb75ff4ba in proc_session_timer (vp=0xb765a3e8) at chan_sip.c:19065
ASTERISK-2  0x081133d6 in ast_sched_runq (con=0x81c4b88) at sched.c:371
ASTERISK-3  0xb7614272 in do_monitor (data=0x0) at chan_sip.c:18968
ASTERISK-4  0x08124559 in dummy_start (data=0x0) at utils.c:917
ASTERISK-5  0xb7cdf0fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-6 0xb7da799e in clone () from /lib/tls/libc.so.6

#0  0xb766b2c1 in proc_session_timer (vp=0x8b4dff8) at chan_sip.c:19072
19072 if (p->stimer->st_active == TRUE) {
#0  0xb766b2c1 in proc_session_timer (vp=0x8b4dff8) at chan_sip.c:19072
#1  0x081133d6 in ast_sched_runq (con=0xb7501020) at sched.c:371
#2  0xb7680272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x2ab3ce9d) at utils.c:917
#4  0xb7d4b0fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7e1399e in clone () from /lib/tls/libc.so.6

#0  0xb76682f6 in proc_session_timer (vp=0x8e46988) at chan_sip.c:19078
19078 if ((p->stimer->st_active != TRUE) || (p->owner->_state != AST_STATE_UP)) {
#0  0xb76682f6 in proc_session_timer (vp=0x8e46988) at chan_sip.c:19078
#1  0x081133d6 in ast_sched_runq (con=0x81c4b88) at sched.c:371
#2  0xb767d272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x408d3b70) at utils.c:917
#4  0xb7d480fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7e1099e in clone () from /lib/tls/libc.so.6

#0  0xb76702f6 in proc_session_timer (vp=0x8512da8) at chan_sip.c:19078
19078 if ((p->stimer->st_active != TRUE) || (p->owner->_state != AST_STATE_UP)) {
#0  0xb76702f6 in proc_session_timer (vp=0x8512da8) at chan_sip.c:19078
#1  0x081133d6 in ast_sched_runq (con=0x81c3588) at sched.c:371
#2  0xb7685272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x328fc736) at utils.c:917
#4  0xb7d500fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7e1899e in clone () from /lib/tls/libc.so.6

#0  0xb7d146db in strlen () from /lib/tls/libc.so.6
#0  0xb7d146db in strlen () from /lib/tls/libc.so.6
#1  0xb7ce8ef1 in vfprintf () from /lib/tls/libc.so.6
#2  0xb7d07700 in vsnprintf () from /lib/tls/libc.so.6
#3  0x081224d8 in __ast_str_helper (buf=0xb75a42c4, max_len=8192, append=0,
   fmt=0x48e3e495 <Address 0x48e3e495 out of bounds>, ap=0x48e3e495 <Address 0x48e3e495 out of bounds>) at utils.c:1567
#4  0x080c44ef in ast_log (level=3, file=0xb7616524 "chan_sip.c", line=1222894741,
   function=0xb76173e8 "proc_session_timer", fmt=0xb761ec60 "Null stimer in proc_session_timer - %s\n") at logger.c:1041
ASTERISK-1  0xb75bc4ba in proc_session_timer (vp=0xb76173e8) at chan_sip.c:19065
ASTERISK-2  0x081133d6 in ast_sched_runq (con=0x81c4b78) at sched.c:371
ASTERISK-3  0xb75d1272 in do_monitor (data=0x0) at chan_sip.c:18968
ASTERISK-4  0x08124559 in dummy_start (data=0x0) at utils.c:917
ASTERISK-5  0xb7c9c0fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-6 0xb7d6499e in clone () from /lib/tls/libc.so.6

#0  0xb74d82c1 in proc_session_timer (vp=0x892e288) at chan_sip.c:19072
19072 if (p->stimer->st_active == TRUE) {
#0  0xb74d82c1 in proc_session_timer (vp=0x892e288) at chan_sip.c:19072
#1  0x081133d6 in ast_sched_runq (con=0x81a9568) at sched.c:371
#2  0xb74ed272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x2e637874) at utils.c:917
#4  0xb7cba0fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7d8299e in clone () from /lib/tls/libc.so.6

#0  0xb76682f6 in proc_session_timer (vp=0x84d1d38) at chan_sip.c:19078
19078 if ((p->stimer->st_active != TRUE) || (p->owner->_state != AST_STATE_UP)) {
#0  0xb76682f6 in proc_session_timer (vp=0x84d1d38) at chan_sip.c:19078
#1  0x081133d6 in ast_sched_runq (con=0x81c4d80) at sched.c:371
#2  0xb767d272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x33373035) at utils.c:917
#4  0xb7d480fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7e1099e in clone () from /lib/tls/libc.so.6

#0  0xb7da7703 in strlen () from /lib/tls/libc.so.6
#0  0xb7da7703 in strlen () from /lib/tls/libc.so.6
#1  0xb7d7bef1 in vfprintf () from /lib/tls/libc.so.6
#2  0xb7d9a700 in vsnprintf () from /lib/tls/libc.so.6
#3  0x081224d8 in __ast_str_helper (buf=0xb76372c4, max_len=8192, append=0,
   fmt=0xfff8fff8 <Address 0xfff8fff8 out of bounds>, ap=0xfff8fff8 <Address 0xfff8fff8 out of bounds>) at utils.c:1567
#4  0x080c44ef in ast_log (level=3, file=0xb76a9524 "chan_sip.c", line=-458760, function=0xb76aa3e8 "proc_session_timer",
   fmt=0xb76b1c60 "Null stimer in proc_session_timer - %s\n") at logger.c:1041
ASTERISK-1  0xb764f4ba in proc_session_timer (vp=0xb76aa3e8) at chan_sip.c:19065
ASTERISK-2  0x081133d6 in ast_sched_runq (con=0x81c4d80) at sched.c:371
ASTERISK-3  0xb7664272 in do_monitor (data=0x0) at chan_sip.c:18968
ASTERISK-4  0x08124559 in dummy_start (data=0x0) at utils.c:917
ASTERISK-5  0xb7d2f0fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-6 0xb7df799e in clone () from /lib/tls/libc.so.6

#0  0xb7dc4703 in strlen () from /lib/tls/libc.so.6
#0  0xb7dc4703 in strlen () from /lib/tls/libc.so.6
#1  0xb7d98ef1 in vfprintf () from /lib/tls/libc.so.6
#2  0xb7db7700 in vsnprintf () from /lib/tls/libc.so.6
#3  0x081224d8 in __ast_str_helper (buf=0xb76182c4, max_len=8192, append=0,
   fmt=0x48e49210 <Address 0x48e49210 out of bounds>, ap=0x48e49210 <Address 0x48e49210 out of bounds>) at utils.c:1567
#4  0x080c44ef in ast_log (level=3, file=0xb76c6524 "chan_sip.c", line=1222939152,
   function=0xb76c73e8 "proc_session_timer", fmt=0xb76cec60 "Null stimer in proc_session_timer - %s\n") at logger.c:1041
ASTERISK-1  0xb766c4ba in proc_session_timer (vp=0xb76c73e8) at chan_sip.c:19065
ASTERISK-2  0x081133d6 in ast_sched_runq (con=0x81c4b78) at sched.c:371
ASTERISK-3  0xb7681272 in do_monitor (data=0x0) at chan_sip.c:18968
ASTERISK-4  0x08124559 in dummy_start (data=0x0) at utils.c:917
ASTERISK-5  0xb7d4c0fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-6 0xb7e1499e in clone () from /lib/tls/libc.so.6

#0  0xb76622c1 in proc_session_timer (vp=0xb543e278) at chan_sip.c:19072
19072 if (p->stimer->st_active == TRUE) {
#0  0xb76622c1 in proc_session_timer (vp=0xb543e278) at chan_sip.c:19072
#1  0x081133d6 in ast_sched_runq (con=0x81c4b88) at sched.c:371
#2  0xb7677272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x39353231) at utils.c:917
#4  0xb7d420fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7e0a99e in clone () from /lib/tls/libc.so.6

#0  0xb76842f6 in proc_session_timer (vp=0x87325c0) at chan_sip.c:19078
19078 if ((p->stimer->st_active != TRUE) || (p->owner->_state != AST_STATE_UP)) {
#0  0xb76842f6 in proc_session_timer (vp=0x87325c0) at chan_sip.c:19078
#1  0x081133d6 in ast_sched_runq (con=0x81c4b88) at sched.c:371
#2  0xb7699272 in do_monitor (data=0x0) at chan_sip.c:18968
#3  0x08124559 in dummy_start (data=0x3c13404b) at utils.c:917
#4  0xb7d640fb in start_thread () from /lib/tls/libpthread.so.0
ASTERISK-1  0xb7e2c99e in clone () from /lib/tls/libc.so.6
Comments:By: Leif Madsen (lmadsen) 2008-10-06 11:29:49

The core dumps will only be useful on the system they were generated on. If you wish to attach a backtrace (per the instructions in the doc/backtrace.txt file of your Asterisk source) after removing any private information necessary. Thanks!
By: Nik Soggia (nik soggia) 2008-10-07 04:03:17

# here is how I generated the files
echo -e >bt.txt 'set pagination off\nthread apply all bt\nquit'
echo -e >btf.txt 'set pagination off\nbt full\nquit'
for i in core.??; do
echo 1>&2 "processing ${i}..."
gdb >"${i}.txt" -batch -q -n -e /usr/sbin/asterisk -c "${i}" -x bt.txt
printf '\n%80s\n\n' | tr ' ' '#' >>"${i}.txt"
gdb >>"${i}.txt" -batch -q -n -e /usr/sbin/asterisk -c "${i}" -x btf.txt
done
rm -f bt.txt btf.txt

cp "${0}" "${0}.txt"
for i in core.??.txt "${0}.txt"; do
sed -i \
-e 's/(omissis)/(omissis)/gi' \
-e 's/(omissis)/(omissis)/gi' \
-e 's/(omissis)/(omissis)/gi' \
"${i}"
done
By: Leif Madsen (lmadsen) 2008-10-07 12:18:25

It doesn't appear that you have DONT_OPTIMIZE enabled in your core dumps (I don't see anything that says "value_optimized", but it still appears to be missing that flag...)

In menuselect under the compile flags, be sure to enable DONT_OPTIMIZE, re-compile and re-install Asterisk in order to provide better backtraces for the developers.

Thanks!
By: Nik Soggia (nik soggia) 2008-10-10 10:51:55

Hi, I'm very sorry for the delay.

If I enable DONT_OPTIMIZE asterisk will keep crashing only when "session-timers = refuse" is missing from sip.conf, but it also produces pointless (imho) core dumps like the one I just uploaded (core.24.txt).
By: Raj Jain (rjain) 2008-10-10 10:56:30

session-timers=refuse missing in sip.conf is equivalent to saying that you've enabled the feature in the session-timers=accept mode.
By: Leif Madsen (lmadsen) 2008-10-10 12:36:38

Setting this back to acknowledged in the hope a developer and take a look at this issue to determine where to go from here.
By: Michiel ten Hagen (stimpie) 2008-10-23 04:55:52

I experience similar crashes in 1.6.0.1, backtrace (bt-23-10-2008.txt) is uploaded.
after adding session-timers=refuse the crashing stops


By: Brett Nemeroff (brettnem) 2008-12-11 15:19:59.000-0600

This is happening to me as well. on asterisk-1.6.0-rc6
By: Leif Madsen (lmadsen) 2009-01-28 14:47:34.000-0600

rjain:  did you mean to assign this issue to yourself?
By: Raj Jain (rjain) 2009-02-01 08:59:21.000-0600

Yes, I meant to assign this to myself. Let me try to reproduce this.
By: Dmitry V Ilyin (widgetii) 2009-03-17 02:29:40

This bug in my production system also (asterisk-1.6.0.5)
By: Dmitry V Ilyin (widgetii) 2009-03-18 09:16:10

Strange, but I set session-timers=refuse in [general] section in sip.conf, and nothing to change - asterisk will continue crashes.

While submit 'sip show settings' command, I got:

 Session Timers: Originate                            
 Session Refresher:      uas                                  
 Session Expires:        600 secs                          
 Session Min-SE:         90 secs

Is it correct to get workaround of this bug?
By: Dmitry V Ilyin (widgetii) 2009-04-21 13:16:18

Seems that in stop_session_timer() function ast_sched_del() invoked and than later asterisk try to get already deleted p->stimer structure. For example,

/*! \brief Session-Timers: Restart session timer */                                                        
static void restart_session_timer(struct sip_pvt *p)                                                        
{                                                                                                          
       if (!p->stimer) {                                                                                  
               ast_log(LOG_WARNING, "Null stimer in restart_session_timer - %s\n", p->callid);            
               return;                                                                                    
       }

- In this piece of code we checking p->stimer, that yet existing. But in this moment in another thread ast_sched_del() function called, and then p->stimer structure stops live.
                                                                                                           
       if (p->stimer->st_active == TRUE) {                                                                

- In this piece of code we get nonexisting value and hence asterisk crashes.

Need help from Asterisk developers to introduce lock support in this code.
By: inspired (inspired) 2009-05-11 10:21:06

Same thing happens here on 1.6.0.9. I have not tested the supposed workaround yet. Got Asterisk running with safe_asterisk now. backtrace-inspired.txt uploaded.
By: inspired (inspired) 2009-05-11 12:47:40

I can add that I see about 2-3 crashes per day. My longest recorded uptime so far with Asterisk 1.6 and about 900 registrations is 27 hours. I have enabled on "session-timers=refuse" and will get back with results in a few days or when Asterisk crashes again.
By: inspired (inspired) 2009-05-14 08:04:03

4690 calls processed
box1*CLI> core show uptime
System uptime: 2 days, 21 hours, 52 minutes, 24 seconds
Last reload: 1 hour, 29 minutes, 14 seconds

"session-timers=refuse" seems to be a valid workaround.
By: Private Name (falves11) 2009-06-15 20:42:26

The issue with the handle leak is also present in 1.4. Over time, the handles tend to grow and grow. Right now after processing a few hundred thousand calls, my Asterisk 1.4 SVN has 500+ handles with only 6 open calls. I an let the developers log in and look at it.

I just uploaded the evidence of the issue.


By: Leif Madsen (lmadsen) 2009-06-16 14:27:38

Setting status of this back to New as there hasn't been any movement from the assigned developer recently.

rjain: please do feel free to assign this back to yourself if you can move this forward. Thanks!
By: Russell Bryant (russell) 2009-06-29 16:20:12

I have assigned this for dvossel to take a look at.

After reviewing the session timer code, I know what needs to be done here.  The problem only exists in the 1.6.0 branch.

If you search around for the "st_schedid" variable in Asterisk trunk, you'll see that the reference count for the sip_pvt object is handled properly for session timer scheduler entries.  This reference count handling was introduced in Asterisk 1.6.1, as a part of some major chan_sip improvements.  This same refcount handling needs to be done in 1.6.0.

Let me know if you have any questions.
By: Russell Bryant (russell) 2009-06-29 16:49:14

This is going to be more complicated than I originally thought, since in 1.6.0, sip_pvt is not a reference counted object at all ...
By: Digium Subversion (svnbot) 2009-07-08 09:35:59

Repository: asterisk
Revision: 205117

U   branches/1.6.0/channels/chan_sip.c
U   branches/1.6.0/include/asterisk/sched.h

------------------------------------------------------------------------
r205117 | dvossel | 2009-07-08 09:35:58 -0500 (Wed, 08 Jul 2009) | 15 lines

SIP Dialog ref counting

This patch adds reference counting for sip dialogs into 1.6.0.
When proc_session_timer() is called from the scheduler thread
it has no guarantee the session timer's dialog won't be freed
from underneath it.  Now the session timer holds a reference
to the dialog, preventing it from being destroyed during the
middle of proc_session_timer().

(closes issue ASTERISK-12826)
Reported by: Nik Soggia

Review: https://reviewboard.asterisk.org/r/302/


------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=205117