Date: Sat, 14 Jul 2018 10:42:59 +0200 From: Hans Petter Selasky <hps@selasky.org> To: Andreas Longwitz <longwitz@incore.de>, freebsd-isdn@freebsd.org Subject: Re: chan_capi caused segmentation fault in asterisk Message-ID: <4f793820-3d66-c6e0-e0fb-eb10c1eb7875@selasky.org> In-Reply-To: <5B49026F.8070407@incore.de> References: <5B49026F.8070407@incore.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On 07/13/18 21:50, Andreas Longwitz wrote:
> Hi Hans,
>
> I run asterisk and chan_capi latest version from your git repository.
> After upgrading my production PBX server from FreeBSD 8 to FreeBSD 10
> Stable I saw some cores of asterisk, they all looked like this:
>
> Core was generated by `/usr/local/sbin/asterisk -n -F -U asterisk'.
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0 0x28782f9d in strlen () from /lib/libc.so.7
> [Current thread is 1 (Thread 29c55800 (LWP 100447))]
> (gdb) where
> #0 0x28782f9d in strlen () from /lib/libc.so.7
> #1 0x28777f5d in __vfprintf () from /lib/libc.so.7
> #2 0x286b369e in vsnprintf () from /lib/libc.so.7
> #3 0x081a40dc in __ast_string_field_ptr_build_va (mgr=0x290719b0,
> pool_head=0x2907197c, ptr=0x29071980, format=0x28972e9e "CAPI/%s/%s-free",
> ap1=0xbb733ce0 "\v", ap2=0xbb733ce0 "\v") at utils.c:1968
> #4 0x080a8d4f in __ast_channel_alloc_ap (needqueue=0, state=0,
> cid_num=0x0, cid_name=0x0, acctcode=0x0, exten=0x0, context=0x0,
> linkedid=0x0,
> amaflag=0, file=0x2896e23d "chan_capi.c", line=2023,
> function=0x28972e89 "cd_alloc_pbx_channel", name_fmt=0x28972e9e
> "CAPI/%s/%s-free",
> ap1=0xbb733ce0 "\v", ap2=0xbb733ce0 "\v") at channel.c:1273
> #5 0x080a96e6 in __ast_channel_alloc (needqueue=0, state=0,
> cid_num=0x0, cid_name=0x0, acctcode=0x0, exten=0x0, context=0x0,
> linkedid=0x0,
> amaflag=0, file=0x2896e23d "chan_capi.c", line=2023,
> function=0x28972e89 "cd_alloc_pbx_channel", name_fmt=0x28972e9e
> "CAPI/%s/%s-free")
> at channel.c:1378
> #6 0x2894f2f2 in cd_alloc_pbx_channel (name=0xb <error: Cannot access
> memory at address 0xb>, dest=0xbb733e4e "4982892") at chan_capi.c:2022
> #7 0x2893df39 in chan_capi_request (type=0xbb734990 "CAPI", format=8,
> requestor=0x2a45ad1c, data=0xbb7351a4, cause=0xbb734bcc)
> at chan_capi.c:3485
> #8 0x080b620f in ast_request (type=0xbb734990 "CAPI", format=8,
> requestor=0x2a45ad1c, data=0xbb7351a4, cause=0xbb734bcc) at channel.c:5740
> #9 0x28ab0328 in dial_exec_full (chan=0x2a45ad1c, data=0xbb735cdc
> "CAPI/ISDN_NT_EUMEX/4982892", peerflags=0xbb7358e8, continue_exec=0x0)
> at app_dial.c:2342
> #10 0x28ab5050 in dial_exec (chan=0x2a45ad1c, data=0xbb735cdc
> "CAPI/ISDN_NT_EUMEX/4982892") at app_dial.c:3061
> #11 0x0813cfff in pbx_exec (c=0x2a45ad1c, app=0x2a807800,
> data=0xbb735cdc "CAPI/ISDN_NT_EUMEX/4982892") at pbx.c:1479
> #12 0x081468c5 in pbx_extension_helper (c=0x2a45ad1c, con=0x0,
> context=0x2a45b088 "capi_to_eumex", exten=0x2a45b0d8 "4982892", priority=1,
> label=0x0, callerid=0x2a429a90 "039831429096", action=E_SPAWN,
> found=0xbb739d70, combined_find_spawn=1) at pbx.c:4739
> #13 0x081484f8 in ast_spawn_extension (c=0x2a45ad1c, context=0x2a45b088
> "capi_to_eumex", exten=0x2a45b0d8 "4982892", priority=1,
> callerid=0x2a429a90 "039831429096", found=0xbb739d70,
> combined_find_spawn=1) at pbx.c:5381
> #14 0x08148eb5 in __ast_pbx_run (c=0x2a45ad1c, args=0x0) at pbx.c:5484
> #15 0x0814a9b5 in pbx_thread (data=0x2a45ad1c) at pbx.c:5825
> #16 0x081a29c6 in dummy_start (data=0x2a429aa0) at utils.c:1173
>
> (gdb) f 7
> #7 0x2893df39 in chan_capi_request (type=0xbb734990 "CAPI", format=8,
> requestor=0x2a45ad1c, data=0xbb7351a4, cause=0xbb734bcc)
> at chan_capi.c:3485
> 3485 pbx_chan = cd_alloc_pbx_channel(cep->name, dest);
> (gdb) list
> 3480
> 3481 /*
> 3482 * Allocate a PBX channel before allocating the CAPI
> channel,
> 3483 * while unlocked:
> 3484 */
> 3485 pbx_chan = cd_alloc_pbx_channel(cep->name, dest);
> 3486
> 3487 /* have to lock the CAPI application first! */
> 3488
> 3489 cc_mutex_lock(&p_app->lock);
> 3490
> 3491 cep = cep_root_acquire();
>
> So the core happens when cd_alloc_pbx_channel is called with parameter
> cep->name, because cep is not allocated at this time (first two lines
> later). After changing this call to
> pbx_chan = cd_alloc_pbx_channel("cep_name", dest)
> no dumps anymore.
>
> I think you will have a better solution for this.
>
Hi,
The name of the channel is updated a few lines down of that location.
Using "" should be sufficient. Can you try this patch:
https://github.com/hselasky/chan_capi/commit/c07f9ba0c6f18b4d782c9418a20cb76e60fb59bf
--HPS
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4f793820-3d66-c6e0-e0fb-eb10c1eb7875>