[Home]

Summary:ASTERISK-17873: [patch] Crash when using PickupChan
Reporter:Remi Quezada (remiq)Labels:
Date Opened:2011-05-17 14:33:57Date Closed:2011-06-03 16:06:26
Priority:CriticalRegression?No
Status:Closed/CompleteComponents:Applications/app_directed_pickup
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:( 0) bt-pickupchan-r315894.txt
( 1) bug19310-r315894.diff.txt
( 2) issue19310_v1.8_v2.patch
( 3) issue19310_v1.8.patch
( 4) pickup-backtrace.txt
( 5) pickup-backtrace-r319469.txt
( 6) pickupchan-1.6-cli.txt
( 7) pickup-cli-msg.txt
( 8) pickup-cli-msg-r319469.txt
Description:Asterisk is crashing sometimes when using PickupChan application.  I attached the backtrace and console messages before the crash.  
Comments:By: Leif Madsen (lmadsen) 2011-05-17 17:09:40

(06:04:44 PM) rmudgett: lmadsen, dvossel That crash is in Playback because PickupChan has masqueraded the channel away.  The tech pointer is NULL.

(06:05:29 PM) dvossel: how is the sip_setoption function getting called on a masqueraded channel

(06:06:16 PM) rmudgett: PickupChan returns zero so the dialplan keeps executing.  The masquerade has been setup and happens while Playback is setting up.

(06:06:43 PM) rmudgett: Thus Playback tries to playback a file on a ZOMBIE.

(06:07:15 PM) dvossel: I thought ZOMBIES were hungup ?!

(06:07:16 PM) rmudgett: I think a quick fix might be to have PickupChan return nonzero if the Pickup was successful.

(06:07:31 PM) rmudgett: ZOMBIES have not been destroyed yet.

(06:08:10 PM) dvossel: but if it gets hungup in pickupchan, then why does it go to do the playback

(06:08:11 PM) rmudgett: Their guts have been extracted by the masquerade.
(06:08:30 PM) rmudgett: PicupChan returns zero not nonzero.
(06:09:12 PM) rmudgett: The main PBX execution loop does not check to see if the channel is a ZOMBIE or setup for masquerade.
(06:09:21 PM) rmudgett: i think.
(06:11:06 PM) rmudgett: Another strategy would be to make PickupChan complete the masquerade before it returns.


By: Alec Davis (alecdavis) 2011-05-17 20:17:44

Shameless plug!
https://reviewboard.asterisk.org/r/1217/
app_pickup: implement ${PICKUPRESULT} for dialplan related pickups
By: Alec Davis (alecdavis) 2011-05-17 21:13:27

rmudgett: the stategy to complete the masquerade before PickupChan returns I think is best. In fact all of the directed pickups.

I'm sure I struck this same issue with the *8 pickup work, when playing out the pickupsounds, hence the ast_do_masquerade in features.c:ast_pickup_call().
By: Alec Davis (alecdavis) 2011-05-18 05:28:56

bt-pickupchan-r315894.txt
Using 1.8 r315894 with the dialplan below, and getting 2 SIP phones to pickup the ringing extension at the same time, I could 100% of the time get asterisk to segfault.

However, 1.8 SVN-branch-1.8-r319469 never failed.

exten => 74,1,NoOp(PICKUP Channel)
exten => 74,n,Macro(directed-sip-call-pickup)

[macro-directed-sip-call-pickup]
exten => s,1,NoOp(PICKUP Channel)
exten => s,n,PickupChan(SIP/gxp-823)
exten => s,n,Playback(you-sound-cute)

edit: removed reference in pickup macro to ${PICKUPRESULT} as it's my test code.


By: Alec Davis (alecdavis) 2011-05-18 05:54:07

bug19310-r315894.diff.txt

was fixed when ASTERISK-17264 was commited.
By: Remi Quezada (remiq) 2011-05-18 08:30:53

I still get a crash with r319469.  I attached the backtrace and CLI msg.

Here is my pickup macro:

[macro-mtt-directed-sip-call-pickup]

exten => s,1,PickupChan(SIP/${MACRO_EXTEN:${ARG1}}${TL_DASH}${tenant})
exten => s,n,NoOp(pickupresult=${PICKUPRESULT})
exten => s,n,Playback(privacy-incorrect)
exten => s,n,Hangup


By: Leif Madsen (lmadsen) 2011-05-18 12:27:06

https://reviewboard.asterisk.org/r/1220/ may also be related per rmudgett
By: Richard Mudgett (rmudgett) 2011-05-18 14:07:46

The issue19310_v1.8.patch file is the first patch in https://reviewboard.asterisk.org/r/1221/
By: Alec Davis (alecdavis) 2011-05-19 04:20:41

remiq: what is the sequence you use to crash?
Is it 2 users pickup the same ringing extension?

Using the method of 2 users pickup same call, with Asterisk SVN-branch-1.8-r319654M without reviewboard 1221 download I was able to get a Playback on a ZOMBIE channel!!!!!

After applying review board patch, always seemed good.

Console output before patching.<pre>    -- Executing [74@phones:1] NoOp("SIP/gxp-824-00000012", "PICKUP Channel") in new stack
   -- Executing [74@phones:2] Macro("SIP/gxp-824-00000012", "directed-sip-call-pickup") in new stack
   -- Executing [s@macro-directed-sip-call-pickup:1] NoOp("SIP/gxp-824-00000012", "PICKUP Channel") in new stack
   -- Executing [s@macro-directed-sip-call-pickup:2] PickupChan("SIP/gxp-824-00000012", "SIP/gxp-823") in new stack
 == Using SIP RTP CoS mark 5
 == Extension Changed 822[phones] new state InUse for Notify User gxp-824
 == Extension Changed 822[phones] new state InUse for Notify User gxp-823
 == Extension Changed 822[phones] new state InUse for Notify User gxp-822
   -- Executing [74@phones:1] NoOp("SIP/gxp-822-00000013", "PICKUP Channel") in new stack
   -- Executing [74@phones:2] Macro("SIP/gxp-822-00000013", "directed-sip-call-pickup") in new stack
   -- Executing [s@macro-directed-sip-call-pickup:1] NoOp("SIP/gxp-822-00000013", "PICKUP Channel") in new stack
   -- Executing [s@macro-directed-sip-call-pickup:2] PickupChan("SIP/gxp-822-00000013", "SIP/gxp-823") in new stack
[2011-05-19 20:56:22.615438] NOTICE[14569]: app_directed_pickup.c:389 pickupchan_exec: No target channel found for SIP/gxp-823.
   -- Executing [s@macro-directed-sip-call-pickup:3] <b><u>Playback("SIP/gxp-822-00000013"</u></b>, "you-sound-cute") in new stack
 == Extension Changed 823[phones] new state Idle for Notify User gxp-824
 == Extension Changed 823[phones] new state Idle for Notify User gxp-823
 == Extension Changed 823[phones] new state Idle for Notify User gxp-822
   -- Executing [s@macro-directed-sip-call-pickup:3] <b><u>Playback("SIP/gxp-823-00000011<ZOMBIE>"</u></b>, "you-sound-cute") in new stack
 == Spawn extension (macro-directed-sip-call-pickup, s, 3) exited non-zero on 'SIP/gxp-823-00000011<ZOMBIE>' in macro 'directed-sip-call-pickup'
 == Spawn extension (phones, 74, 2) exited non-zero on 'SIP/gxp-823-00000011<ZOMBIE>'
   -- SIP/gxp-824-00000012 answered SIP/snom8929-00000010
   -- <SIP/gxp-822-00000013> Playing 'you-sound-cute.gsm' (language 'en')
   -- Auto fallthrough, channel 'SIP/gxp-822-00000013' status is 'UNKNOWN'</pre>
By: Alec Davis (alecdavis) 2011-05-19 04:53:20

pickupchan-1.6-cli.txt again 2 callers attempt pickup of same call with PickupChan().

One plays out to a ZOMBIE.

Asterisk SVN-branch-1.6.2-r319653M
By: Remi Quezada (remiq) 2011-05-19 07:34:20

Yes that is correct.  I have two sip peers ringing at the same time and I pickup one of the two.
By: Alec Davis (alecdavis) 2011-05-19 16:04:16

remiq: Did you get a chance to test with issue19310_v1.8.patch or issue19310_v1.8_v2.patch?
By: Remi Quezada (remiq) 2011-05-19 16:14:08

Yes I did.  I tried issue19310_v1.8_v2.patch, PickupChan is working properly now.  No more crashes.
By: Digium Subversion (svnbot) 2011-05-20 10:48:27

Repository: asterisk
Revision: 319997

U   branches/1.8/apps/app_directed_pickup.c
U   branches/1.8/main/features.c

------------------------------------------------------------------------
r319997 | rmudgett | 2011-05-20 10:48:26 -0500 (Fri, 20 May 2011) | 25 lines

Crash when using directed pickup applications.

The directed pickup applications can cause a crash if the pickup was
successful because the dialplan keeps executing.

This patch does the following:

* Completes the channel masquerade on a successful pickup before the
application returns.  The channel is now guaranteed a zombie and must not
continue executing the dialplan.

* Changes the return value of the directed pickup applications to return
zero if the pickup failed and nonzero(-1) if the pickup succeeded.

* Made some code optimizations that no longer require re-checking the
pickup channel to see if it is still available to pickup.

(closes issue ASTERISK-17873)
Reported by: remiq
Patches:
     issue19310_v1.8_v2.patch uploaded by rmudgett (license 664)
Tested by: alecdavis, remiq, rmudgett

Review: https://reviewboard.asterisk.org/r/1221/

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=319997
By: Digium Subversion (svnbot) 2011-05-20 10:52:21

Repository: asterisk
Revision: 319998

_U  trunk/
U   trunk/apps/app_directed_pickup.c
U   trunk/main/features.c

------------------------------------------------------------------------
r319998 | rmudgett | 2011-05-20 10:52:21 -0500 (Fri, 20 May 2011) | 32 lines

Merged revisions 319997 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.8

........
 r319997 | rmudgett | 2011-05-20 10:48:25 -0500 (Fri, 20 May 2011) | 25 lines
 
 Crash when using directed pickup applications.
 
 The directed pickup applications can cause a crash if the pickup was
 successful because the dialplan keeps executing.
 
 This patch does the following:
 
 * Completes the channel masquerade on a successful pickup before the
 application returns.  The channel is now guaranteed a zombie and must not
 continue executing the dialplan.
 
 * Changes the return value of the directed pickup applications to return
 zero if the pickup failed and nonzero(-1) if the pickup succeeded.
 
 * Made some code optimizations that no longer require re-checking the
 pickup channel to see if it is still available to pickup.
 
 (closes issue ASTERISK-17873)
 Reported by: remiq
 Patches:
       issue19310_v1.8_v2.patch uploaded by rmudgett (license 664)
 Tested by: alecdavis, remiq, rmudgett
 
 Review: https://reviewboard.asterisk.org/r/1221/
........

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=319998
By: Digium Subversion (svnbot) 2011-05-25 11:23:13

Repository: asterisk
Revision: 320796

U   branches/1.8/include/asterisk/channel.h
U   branches/1.8/main/channel.c
U   branches/1.8/main/features.c

------------------------------------------------------------------------
r320796 | rmudgett | 2011-05-25 11:23:12 -0500 (Wed, 25 May 2011) | 17 lines

Give zombies a safe channel driver to use.

Recent crashes from zombie channels suggests that they need a safe home to
goto.  When a masquerade happens, the physical part of the zombie channel
is hungup.  The hangup normally sets the channel private pointer to NULL.
If someone then blindly does a callback to the channel driver, a crash is
likely because the private pointer is NULL.

The masquerade now sets the channel technology of zombie channels to the
kill channel driver.

Related to the following issues:
(issue ASTERISK-17690)
(issue ASTERISK-17873)

Review: https://reviewboard.asterisk.org/r/1224/

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=320796
By: Digium Subversion (svnbot) 2011-05-26 08:04:22

Repository: asterisk
Revision: 320820

_U  trunk/
U   trunk/include/asterisk/channel.h
U   trunk/main/channel.c
U   trunk/main/features.c
U   trunk/main/format_cap.c

------------------------------------------------------------------------
r320820 | rmudgett | 2011-05-26 08:04:20 -0500 (Thu, 26 May 2011) | 24 lines

Merged revisions 320796 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.8

........
 r320796 | rmudgett | 2011-05-25 11:23:11 -0500 (Wed, 25 May 2011) | 17 lines
 
 Give zombies a safe channel driver to use.
 
 Recent crashes from zombie channels suggests that they need a safe home to
 goto.  When a masquerade happens, the physical part of the zombie channel
 is hungup.  The hangup normally sets the channel private pointer to NULL.
 If someone then blindly does a callback to the channel driver, a crash is
 likely because the private pointer is NULL.
 
 The masquerade now sets the channel technology of zombie channels to the
 kill channel driver.
 
 Related to the following issues:
 (issue ASTERISK-17690)
 (issue ASTERISK-17873)
 
 Review: https://reviewboard.asterisk.org/r/1224/
........

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=320820
By: Jeff Swank (socs28) 2011-06-20 13:40:13.607-0500

Do I have to install this patch?  or is it in the latest versions yet?
By: Alistair Cunningham (acunningham) 2011-07-08 02:10:04.151-0500

One of our customer have been suffering from a problem very similar to this on 1.8.4.4. However, I've been unable to apply the patch due to numerous rejects. Which version of Asterisk is this patch for? Would it be possible to have a patch for 1.8.4.4?