Summary:	ASTERISK-14911: [patch] Channel reference leak when calling through an optimized local channel
Reporter:	Mark Michelson (mmichelson)	Labels:
Date Opened:	2009-09-29 15:29:51	Date Closed:	2009-09-29 16:30:59
Priority:	Major	Regression?	No
Status:	Closed/Complete	Components:	Core/Channels
Versions:		Frequency of Occurrence
Related Issues:
Environment:		Attachments:	( 0) channel_ref_debugging.diff ( 1) console.txt ( 2) refs_BROKE.txt ( 3) refs_WORKING.txt
Description:	I discovered while working on the group CCSS branch that I was leaking a lot of memory due to a datastore not being destroyed on the inbound channel to Asterisk. Further investigation shows that the channel is unlinked from the channel container but never has its destructor called. The following dialplan is what I use to reproduce the issue: [internal] exten => 2000,hint,SIP/2000 exten => 2000,1,Dial(SIP/2000,10,Tt) exten => 2000,n,Hangup() exten => 667,1,Dial(Local/2000@internal,5,tTkKg) exten => 667,n,Hangup From SIP/2001, I dial 667. SIP/2000 answers the call. After talking for a few seconds, both phones are hung up. The problem is that channel SIP/2001 is not destroyed. If a call is placed to 2000, instead of 667, then there is no issue. Also, if I add /n to the end of the Local channel name in extension 667 priority 1, then all channels are properly destroyed. Note that "core show channels" will show that there are no active channels when this situation has occurred since the channel has been unlinked from the container. ****** ADDITIONAL INFORMATION ****** I added some debugging to my working copy of channel.c. I am uploading the patch, as well as the console output that is produced. You'll be able to see that four channels are allocated, but only three of them have their destructor called. You may also note that ast_channel_release is called on some no-name channels. This is because a dummy channel is allocated and released in cdr_custom.c. If more console output is required, then please let me know. Given how easy this is to reproduce, though, I suspect that won't be necessary.
Comments:	By: Mark Michelson (mmichelson) 2009-09-29 15:34:04 I have uploaded channel_ref_debugging.diff and console.txt. The former is the patch which helps to see which channels have been allocated, unlinked, and destroyed. The latter is console output from a single call from SIP/2001 to extension 667@internal. SIP/2000 answers the call, and then SIP/2001 hangs up. By: Mark Michelson (mmichelson) 2009-09-29 15:40:26 I've uploaded two additional files. I turned on REF_DEBUG and ran two calls. With the dialplan outlined in the description, I ended up with the file called refs_BROKE.txt. I added a /n to the Local channel and reran the test and ended up with the refs_WORKING.txt file. EDIT: I only added REF_DEBUG to channel.c. As a result, calls to ast_channel_ref and ast_channel_unref are not recorded in the attached files. By: Mark Michelson (mmichelson) 2009-09-29 16:19:21 I have re-uploaded refs_BROKE.txt and refs_WORKING.txt. The test is just as in my previous note. However, I made this run by patching the code so that ast_channel_ref and ast_channel_unref are taken into account. That should make it much easier to debug. In refs_BROKE.txt, the channel at address 0xd5dcf0 is the one which is not properly destroyed. By: Mark Michelson (mmichelson) 2009-09-29 16:27:10 Problem is in CEL code. ast_cel_report_event has return paths that do not properly unref the "peer" channel. I'll commit the necessary changes. By: Digium Subversion (svnbot) 2009-09-29 16:30:46 Repository: asterisk Revision: 220995 U   trunk/main/cel.c ------------------------------------------------------------------------ r220995 | mmichelson | 2009-09-29 16:30:46 -0500 (Tue, 29 Sep 2009) | 11 lines Fix channel reference leak. ast_cel_report_event would geet a reference to the bridged channel. However, certain return paths, such as if CEL was not enabled, would result in a reference leak. All return paths now properly unref the channel. (closes issue ASTERISK-14911) Reported by: mmichelson ------------------------------------------------------------------------ http://svn.digium.com/view/asterisk?view=rev&revision=220995 By: Digium Subversion (svnbot) 2009-09-29 16:30:59 Repository: asterisk Revision: 220996 _U  branches/1.6.2/ ------------------------------------------------------------------------ r220996 | mmichelson | 2009-09-29 16:30:58 -0500 (Tue, 29 Sep 2009) | 16 lines Blocked revisions 220995 via svnmerge ........  r220995 | mmichelson | 2009-09-29 16:28:04 -0500 (Tue, 29 Sep 2009) | 11 lines    Fix channel reference leak.    ast_cel_report_event would geet a reference to the  bridged channel. However, certain return paths, such  as if CEL was not enabled, would result in a reference  leak. All return paths now properly unref the channel.    (closes issue ASTERISK-14911)  Reported by: mmichelson ........ ------------------------------------------------------------------------ http://svn.digium.com/view/asterisk?view=rev&revision=220996