Date: Fri, 13 Jul 2018 21:50:07 +0200 From: Andreas Longwitz <longwitz@incore.de> To: freebsd-isdn@freebsd.org Subject: chan_capi caused segmentation fault in asterisk Message-ID: <5B49026F.8070407@incore.de>
next in thread | raw e-mail | index | archive | help
Hi Hans,
I run asterisk and chan_capi latest version from your git repository.
After upgrading my production PBX server from FreeBSD 8 to FreeBSD 10
Stable I saw some cores of asterisk, they all looked like this:
Core was generated by `/usr/local/sbin/asterisk -n -F -U asterisk'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x28782f9d in strlen () from /lib/libc.so.7
[Current thread is 1 (Thread 29c55800 (LWP 100447))]
(gdb) where
#0 0x28782f9d in strlen () from /lib/libc.so.7
#1 0x28777f5d in __vfprintf () from /lib/libc.so.7
#2 0x286b369e in vsnprintf () from /lib/libc.so.7
#3 0x081a40dc in __ast_string_field_ptr_build_va (mgr=0x290719b0,
pool_head=0x2907197c, ptr=0x29071980, format=0x28972e9e "CAPI/%s/%s-free",
ap1=0xbb733ce0 "\v", ap2=0xbb733ce0 "\v") at utils.c:1968
#4 0x080a8d4f in __ast_channel_alloc_ap (needqueue=0, state=0,
cid_num=0x0, cid_name=0x0, acctcode=0x0, exten=0x0, context=0x0,
linkedid=0x0,
amaflag=0, file=0x2896e23d "chan_capi.c", line=2023,
function=0x28972e89 "cd_alloc_pbx_channel", name_fmt=0x28972e9e
"CAPI/%s/%s-free",
ap1=0xbb733ce0 "\v", ap2=0xbb733ce0 "\v") at channel.c:1273
#5 0x080a96e6 in __ast_channel_alloc (needqueue=0, state=0,
cid_num=0x0, cid_name=0x0, acctcode=0x0, exten=0x0, context=0x0,
linkedid=0x0,
amaflag=0, file=0x2896e23d "chan_capi.c", line=2023,
function=0x28972e89 "cd_alloc_pbx_channel", name_fmt=0x28972e9e
"CAPI/%s/%s-free")
at channel.c:1378
#6 0x2894f2f2 in cd_alloc_pbx_channel (name=0xb <error: Cannot access
memory at address 0xb>, dest=0xbb733e4e "4982892") at chan_capi.c:2022
#7 0x2893df39 in chan_capi_request (type=0xbb734990 "CAPI", format=8,
requestor=0x2a45ad1c, data=0xbb7351a4, cause=0xbb734bcc)
at chan_capi.c:3485
#8 0x080b620f in ast_request (type=0xbb734990 "CAPI", format=8,
requestor=0x2a45ad1c, data=0xbb7351a4, cause=0xbb734bcc) at channel.c:5740
#9 0x28ab0328 in dial_exec_full (chan=0x2a45ad1c, data=0xbb735cdc
"CAPI/ISDN_NT_EUMEX/4982892", peerflags=0xbb7358e8, continue_exec=0x0)
at app_dial.c:2342
#10 0x28ab5050 in dial_exec (chan=0x2a45ad1c, data=0xbb735cdc
"CAPI/ISDN_NT_EUMEX/4982892") at app_dial.c:3061
#11 0x0813cfff in pbx_exec (c=0x2a45ad1c, app=0x2a807800,
data=0xbb735cdc "CAPI/ISDN_NT_EUMEX/4982892") at pbx.c:1479
#12 0x081468c5 in pbx_extension_helper (c=0x2a45ad1c, con=0x0,
context=0x2a45b088 "capi_to_eumex", exten=0x2a45b0d8 "4982892", priority=1,
label=0x0, callerid=0x2a429a90 "039831429096", action=E_SPAWN,
found=0xbb739d70, combined_find_spawn=1) at pbx.c:4739
#13 0x081484f8 in ast_spawn_extension (c=0x2a45ad1c, context=0x2a45b088
"capi_to_eumex", exten=0x2a45b0d8 "4982892", priority=1,
callerid=0x2a429a90 "039831429096", found=0xbb739d70,
combined_find_spawn=1) at pbx.c:5381
#14 0x08148eb5 in __ast_pbx_run (c=0x2a45ad1c, args=0x0) at pbx.c:5484
#15 0x0814a9b5 in pbx_thread (data=0x2a45ad1c) at pbx.c:5825
#16 0x081a29c6 in dummy_start (data=0x2a429aa0) at utils.c:1173
(gdb) f 7
#7 0x2893df39 in chan_capi_request (type=0xbb734990 "CAPI", format=8,
requestor=0x2a45ad1c, data=0xbb7351a4, cause=0xbb734bcc)
at chan_capi.c:3485
3485 pbx_chan = cd_alloc_pbx_channel(cep->name, dest);
(gdb) list
3480
3481 /*
3482 * Allocate a PBX channel before allocating the CAPI
channel,
3483 * while unlocked:
3484 */
3485 pbx_chan = cd_alloc_pbx_channel(cep->name, dest);
3486
3487 /* have to lock the CAPI application first! */
3488
3489 cc_mutex_lock(&p_app->lock);
3490
3491 cep = cep_root_acquire();
So the core happens when cd_alloc_pbx_channel is called with parameter
cep->name, because cep is not allocated at this time (first two lines
later). After changing this call to
pbx_chan = cd_alloc_pbx_channel("cep_name", dest)
no dumps anymore.
I think you will have a better solution for this.
Andreas
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5B49026F.8070407>