FreeSWITCH

freeswitch crashes passing b-leg remote zrtp-hash (audio) to a-leg

Details

  • Type: Bug Bug
  • Status: Closed Closed
  • Priority: Minor Minor
  • Resolution: Fixed
  • Affects Version/s: None
  • Fix Version/s: None
  • Component/s: mod_sofia
  • Labels:
    None
  • Environment:
    ubuntu 12.04 LTS desktop version
  • Platform:
    Linux x86/gcc
  • Uname:
    Linux ubuntu 3.2.0-23-generic #36-Ubuntu SMP Tue Apr 10 20:39:51 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
  • CPU Info:
    Hide
    processor : 0
    vendor_id : GenuineIntel
    cpu family : 6
    model : 15
    model name : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz
    stepping : 2
    microcode : 0x56
    cpu MHz : 1861.858
    cache size : 2048 KB
    physical id : 0
    siblings : 2
    core id : 0
    cpu cores : 2
    apicid : 0
    initial apicid : 0
    fpu : yes
    fpu_exception : yes
    cpuid level : 10
    wp : yes
    flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts nopl aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm lahf_lm dts tpr_shadow
    bogomips : 3723.71
    clflush size : 64
    cache_alignment : 64
    address sizes : 36 bits physical, 48 bits virtual
    power management:

    processor : 1
    vendor_id : GenuineIntel
    cpu family : 6
    model : 15
    model name : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz
    stepping : 2
    microcode : 0x56
    cpu MHz : 1861.858
    cache size : 2048 KB
    physical id : 0
    siblings : 2
    core id : 1
    cpu cores : 2
    apicid : 1
    initial apicid : 1
    fpu : yes
    fpu_exception : yes
    cpuid level : 10
    wp : yes
    flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts nopl aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm lahf_lm dts tpr_shadow
    bogomips : 3724.01
    clflush size : 64
    cache_alignment : 64
    address sizes : 36 bits physical, 48 bits virtual
    power management:
    Show
    processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 15 model name : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz stepping : 2 microcode : 0x56 cpu MHz : 1861.858 cache size : 2048 KB physical id : 0 siblings : 2 core id : 0 cpu cores : 2 apicid : 0 initial apicid : 0 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts nopl aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm lahf_lm dts tpr_shadow bogomips : 3723.71 clflush size : 64 cache_alignment : 64 address sizes : 36 bits physical, 48 bits virtual power management: processor : 1 vendor_id : GenuineIntel cpu family : 6 model : 15 model name : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz stepping : 2 microcode : 0x56 cpu MHz : 1861.858 cache size : 2048 KB physical id : 0 siblings : 2 core id : 1 cpu cores : 2 apicid : 1 initial apicid : 1 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts nopl aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm lahf_lm dts tpr_shadow bogomips : 3724.01 clflush size : 64 cache_alignment : 64 address sizes : 36 bits physical, 48 bits virtual power management:
  • GCC Version:
    gcc version 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5)
  • FreeSWITCH GIT Revision:
    head of master
  • Reproduced with GIT HEAD?:
    yes

Description

I have configured an ATA to talk to freeswitch on port 5060. The first call outgoing call thru google-voice goes OK, but the second one causes a crash. My google voice setup was obtained from the freeswitch wiki.

This is what I see in the log at the end:

2012-06-09 17:09:34.613401 [NOTICE] mod_sofia.c:2528 Ring-Ready sofia/internal/1000@192.168.1.4:5060!
2012-06-09 17:09:34.613401 [DEBUG] switch_core_session.c:923 Send signal sofia/internal/1000@192.168.1.4:5060 [BREAK]
2012-06-09 17:09:34.613401 [DEBUG] sofia.c:5828 Channel sofia/internal/1000@192.168.1.4:5060
entering state [early][180]
2012-06-09 17:09:34.613401 [DEBUG] switch_core_session.c:777 Send signal sofia/internal/1000@192.168.1.4:5060 [BREAK]
2012-06-09 17:09:34.613401 [NOTICE] switch_ivr_originate.c:519 Ring Ready sofia/internal/1000@192.168.1.4:5060!
2012-06-09 17:09:34.613401 [DEBUG] sofia_glue.c:3930 Looking for zrtp-hash
2012-06-09 17:09:34.613401 [DEBUG] sofia_glue.c:3908 Deciding whether to pass zrtp-hash between legs
2012-06-09 17:09:34.613401 [DEBUG] sofia_glue.c:3916 Found peer channel; propagating zrtp-hash if set
2012-06-09 17:09:34.613401 [DEBUG] sofia_glue.c:3876 Deciding whether to pass zrtp-hash between a-leg and b-leg
2012-06-09 17:09:34.613401 [DEBUG] sofia_glue.c:3892 Passing b-leg remote zrtp-hash (audio) to a-leg


Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Yuvraj Dhillon added a comment -
I turned off inbound-zrtp-passthru in conf/sip_profiles/internal.xml and the crash seems to have gone away...
Show
Yuvraj Dhillon added a comment - I turned off inbound-zrtp-passthru in conf/sip_profiles/internal.xml and the crash seems to have gone away...
Hide
Permalink
Jeff Lenk added a comment -
Please attach a backtrace

http://wiki.freeswitch.org/wiki/Reporting_Bugs#Getting_a_Backtrace

Also when submitting bug please use the real git hash to identify version info.
Show
Jeff Lenk added a comment - Please attach a backtrace http://wiki.freeswitch.org/wiki/Reporting_Bugs#Getting_a_Backtrace Also when submitting bug please use the real git hash to identify version info.
Hide
Permalink
Yuvraj Dhillon added a comment -
git hash: fc2bb00eb19edc245ae6e9bcdff814c07f1e603b

stacktrace:

#0 _zstr (s=0x31 <Address 0x31 out of bounds>) at ./src/include/switch_utils.h:84
84 return !s || *s == '\0';
(gdb) bt
#0 _zstr (s=0x31 <Address 0x31 out of bounds>) at ./src/include/switch_utils.h:84
#1 switch_core_perform_session_strdup (session=<optimized out>, todup=0x31 <Address 0x31 out of bounds>,
    file=0x7f80a3b9d571 "sofia_glue.c", func=0x7f80a3ba2900 "sofia_glue_pass_zrtp_hash2", line=3893)
    at src/switch_core_memory.c:237
#2 0x00007f80a3aa07c1 in sofia_glue_pass_zrtp_hash2 (aleg_session=<optimized out>, bleg_session=<optimized out>)
    at sofia_glue.c:3893
#3 0x00007f80a3aa0988 in sofia_glue_pass_zrtp_hash (session=0x7f809001ea38) at sofia_glue.c:3917
#4 0x00007f80a3aa41cf in sofia_glue_negotiate_sdp (session=0x7f809001ea38,
    r_sdp=0x7f80a8044f18 "v=0\r\no=- 120484 120484 IN IP4 192.168.1.2\r\ns=-\r\nc=IN IP4 192.168.1.2\r\nt=0 0\r\nm=audio 10144 RTP/AVP 0 2 4 8 18 100 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:2 G726-32/8000\r\na=rtpmap:4 G723/8000\r\na=rtpmap:8 P"...) at sofia_glue.c:4689
#5 0x00007f80a3aad359 in sofia_glue_tech_media (tech_pvt=0x7f809002aa78, r_sdp=<optimized out>) at sofia_glue.c:4149
#6 0x00007f80a3a7534e in sofia_answer_channel (session=0x7f809001ea38) at mod_sofia.c:732
#7 sofia_receive_message (session=0x7f809001ea38, msg=<optimized out>) at mod_sofia.c:2533
#8 0x00007f80b3ae76ae in switch_core_session_perform_receive_message (session=0x7f809001ea38,
    message=0x7f806e95cf60, file=<optimized out>, func=<optimized out>, line=<optimized out>)
    at src/switch_core_session.c:721
#9 0x00007f80b3acf110 in switch_channel_perform_answer (channel=0x7f80900245f8,
    file=0x7f80b3c2a2bd "src/switch_ivr_originate.c", func=0x7f80b3c2afc0 "switch_ivr_originate", line=3284)
    at src/switch_channel.c:3382
#10 0x00007f80b3b2000a in switch_ivr_originate (session=0x7f809001ea38, bleg=<optimized out>, cause=0x7f806e9649f8,
    bridgeto=<optimized out>, timelimit_sec=60, table=0x0, cid_name_override=0x0, cid_num_override=0x0,
    caller_profile_override=0x0, ovars=0x0, flags=0, cancel_cause=0x0) at src/switch_ivr_originate.c:3284
#11 0x00007f80a2e111ad in audio_bridge_function (session=0x7f809001ea38,
    data=0x7f809002c1b0 "dingaling/puneetdhillon/+18006434926@voice.google.com")
    at /usr/local/src/freeswitch/src/mod/applications/mod_dptools/mod_dptools.c:2948
#12 0x00007f80b3ae9187 in switch_core_session_exec (session=0x7f809001ea38, application_interface=0x18b70c8,
    arg=0x7f809002c1b0 "dingaling/puneetdhillon/+18006434926@voice.google.com") at src/switch_core_session.c:2321
#13 0x00007f80b3ae96c2 in switch_core_session_execute_application_get_flags (session=0x7f809001ea38,
    app=0x7f809002c1a8 "bridge", arg=0x7f809002c1b0 "dingaling/puneetdhillon/+18006434926@voice.google.com",
    flags=<optimized out>) at src/switch_core_session.c:2206
#14 0x00007f80b3aebe8c in switch_core_standard_on_execute (session=0x7f809001ea38)
    at src/switch_core_state_machine.c:217
#15 switch_core_session_run (session=0x7f809001ea38) at src/switch_core_state_machine.c:440
#16 0x00007f80b3ae725d in switch_core_session_thread (thread=<optimized out>, obj=0x7f809001ea38)
    at src/switch_core_session.c:1411
#17 0x00007f80b3857e9a in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#18 0x00007f80b35854bd in clone () from /lib/x86_64-linux-gnu/libc.so.6
#19 0x0000000000000000 in ?? ()
Show
Yuvraj Dhillon added a comment - git hash: fc2bb00eb19edc245ae6e9bcdff814c07f1e603b stacktrace: #0 _zstr (s=0x31 <Address 0x31 out of bounds>) at ./src/include/switch_utils.h:84 84 return !s || *s == '\0'; (gdb) bt #0 _zstr (s=0x31 <Address 0x31 out of bounds>) at ./src/include/switch_utils.h:84 #1 switch_core_perform_session_strdup (session=<optimized out>, todup=0x31 <Address 0x31 out of bounds>,     file=0x7f80a3b9d571 "sofia_glue.c", func=0x7f80a3ba2900 "sofia_glue_pass_zrtp_hash2", line=3893)     at src/switch_core_memory.c:237 #2 0x00007f80a3aa07c1 in sofia_glue_pass_zrtp_hash2 (aleg_session=<optimized out>, bleg_session=<optimized out>)     at sofia_glue.c:3893 #3 0x00007f80a3aa0988 in sofia_glue_pass_zrtp_hash (session=0x7f809001ea38) at sofia_glue.c:3917 #4 0x00007f80a3aa41cf in sofia_glue_negotiate_sdp (session=0x7f809001ea38,     r_sdp=0x7f80a8044f18 "v=0\r\no=- 120484 120484 IN IP4 192.168.1.2\r\ns=-\r\nc=IN IP4 192.168.1.2\r\nt=0 0\r\nm=audio 10144 RTP/AVP 0 2 4 8 18 100 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:2 G726-32/8000\r\na=rtpmap:4 G723/8000\r\na=rtpmap:8 P"...) at sofia_glue.c:4689 #5 0x00007f80a3aad359 in sofia_glue_tech_media (tech_pvt=0x7f809002aa78, r_sdp=<optimized out>) at sofia_glue.c:4149 #6 0x00007f80a3a7534e in sofia_answer_channel (session=0x7f809001ea38) at mod_sofia.c:732 #7 sofia_receive_message (session=0x7f809001ea38, msg=<optimized out>) at mod_sofia.c:2533 #8 0x00007f80b3ae76ae in switch_core_session_perform_receive_message (session=0x7f809001ea38,     message=0x7f806e95cf60, file=<optimized out>, func=<optimized out>, line=<optimized out>)     at src/switch_core_session.c:721 #9 0x00007f80b3acf110 in switch_channel_perform_answer (channel=0x7f80900245f8,     file=0x7f80b3c2a2bd "src/switch_ivr_originate.c", func=0x7f80b3c2afc0 "switch_ivr_originate", line=3284)     at src/switch_channel.c:3382 #10 0x00007f80b3b2000a in switch_ivr_originate (session=0x7f809001ea38, bleg=<optimized out>, cause=0x7f806e9649f8,     bridgeto=<optimized out>, timelimit_sec=60, table=0x0, cid_name_override=0x0, cid_num_override=0x0,     caller_profile_override=0x0, ovars=0x0, flags=0, cancel_cause=0x0) at src/switch_ivr_originate.c:3284 #11 0x00007f80a2e111ad in audio_bridge_function (session=0x7f809001ea38,     data=0x7f809002c1b0 "dingaling/puneetdhillon/+ 18006434926@voice.google.com ")     at /usr/local/src/freeswitch/src/mod/applications/mod_dptools/mod_dptools.c:2948 #12 0x00007f80b3ae9187 in switch_core_session_exec (session=0x7f809001ea38, application_interface=0x18b70c8,     arg=0x7f809002c1b0 "dingaling/puneetdhillon/+ 18006434926@voice.google.com ") at src/switch_core_session.c:2321 #13 0x00007f80b3ae96c2 in switch_core_session_execute_application_get_flags (session=0x7f809001ea38,     app=0x7f809002c1a8 "bridge", arg=0x7f809002c1b0 "dingaling/puneetdhillon/+ 18006434926@voice.google.com ",     flags=<optimized out>) at src/switch_core_session.c:2206 #14 0x00007f80b3aebe8c in switch_core_standard_on_execute (session=0x7f809001ea38)     at src/switch_core_state_machine.c:217 #15 switch_core_session_run (session=0x7f809001ea38) at src/switch_core_state_machine.c:440 #16 0x00007f80b3ae725d in switch_core_session_thread (thread=<optimized out>, obj=0x7f809001ea38)     at src/switch_core_session.c:1411 #17 0x00007f80b3857e9a in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0 #18 0x00007f80b35854bd in clone () from /lib/x86_64-linux-gnu/libc.so.6 #19 0x0000000000000000 in ?? ()
Hide
Permalink
Yuvraj Dhillon added a comment -
Do you need the "bt full","thread apply all bt", etc traces as well?
Show
Yuvraj Dhillon added a comment - Do you need the "bt full","thread apply all bt", etc traces as well?
Hide
Permalink
Jeff Lenk added a comment -
Travis,

Please have a look
Show
Jeff Lenk added a comment - Travis, Please have a look
Hide
Permalink
Travis Cross added a comment -
Thanks Jeff; looking.
Show
Travis Cross added a comment - Thanks Jeff; looking.
Hide
Permalink
Travis Cross added a comment -
Yuvraj: Thanks for your report. Please attach the full FS debug log of both the first call and the call causing the crash.

I ask because the problem isn't where it's crashing, it's memory that either isn't getting cleared or is getting mis-set earlier. So it would be helpful to see what's happening before we get to this point.
Show
Travis Cross added a comment - Yuvraj: Thanks for your report. Please attach the full FS debug log of both the first call and the call causing the crash. I ask because the problem isn't where it's crashing, it's memory that either isn't getting cleared or is getting mis-set earlier. So it would be helpful to see what's happening before we get to this point.
Hide
Permalink
Git added a comment -
Repository: freeswitch
Branch: refs/heads/master
Commit: a10ec2b http://fisheye.freeswitch.org/changelog/freeswitch.git/?cs=a10ec2b
Closed By: anthm@freeswitch.org

Comment:
FS-4299 --resolve regression from 23f8967c the code was not making sure both endpoints were type 'sofia' and dereferencing dingaling channel into sofia and causing memory corruption


FreeSWITCH Support Contracts and Consulting Services available!

Contact us:
Email: consulting@freeswitch.org
Web: http://www.freeswitch.org
Phone: +1-918-420-9266
Tollfree: +1-877-742-2583
Fax: +1-918-420-9267
iNum: +883 5100 1420 9266


Come To ClueCon in August to learn more about FreeSWITCH and Internet Telephony!
http://www.cluecon.com

Show
Git added a comment - Repository: freeswitch Branch: refs/heads/master Commit: a10ec2b http://fisheye.freeswitch.org/changelog/freeswitch.git/?cs=a10ec2b Closed By: anthm@freeswitch.org Comment: FS-4299 --resolve regression from 23f8967c the code was not making sure both endpoints were type 'sofia' and dereferencing dingaling channel into sofia and causing memory corruption FreeSWITCH Support Contracts and Consulting Services available! Contact us: Email: consulting@freeswitch.org Web: http://www.freeswitch.org Phone: +1-918-420-9266 Tollfree: +1-877-742-2583 Fax: +1-918-420-9267 iNum: +883 5100 1420 9266 Come To ClueCon in August to learn more about FreeSWITCH and Internet Telephony! http://www.cluecon.com
Hide
Permalink
Auto Admin added a comment -
Due to a long period of inactivity (13 or more days), this issue is due to be automatically close within 24 hours.
If this issue is not actually resolved, please reopen it and add appropriate comments to help developers fix the issue.

Thanks,
  Jira Admin
Show
Auto Admin added a comment - Due to a long period of inactivity (13 or more days), this issue is due to be automatically close within 24 hours. If this issue is not actually resolved, please reopen it and add appropriate comments to help developers fix the issue. Thanks,   Jira Admin

People

  • Assignee:
    Travis Cross
    Reporter:
    Yuvraj Dhillon
Vote (0)
Watch (1)

Dates

  • Created:
    Updated:
    Resolved: