[OpenSIPS-Devel] [ opensips-Bugs-3432430 ] Crash on CANCEL when using rtpproxy

[SourceForge.net]

Bugs item #3432430, was opened at 2011-11-02 15:11
Message generated for change (Comment added) made by rrb3942
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=1086410&aid=3432430&group_id=232389

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: modules
>Group: trunk
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Ryan Bullock (rrb3942)
Assigned to: Nobody/Anonymous (nobody)
Summary: Crash on CANCEL when using rtpproxy

Initial Comment:
When processing a CANCEL for a call that has had rtpproxy_offer("froc") called on it opensips crashes. If no calls to rtpproxy_offer are made the call is handled fine.

Important bits of the log, more attached:
CRITICAL:core:free_lump: called on a not free-able lump:0x7fb7094fda38 flags=2
CRITICAL:core:receive_fd: EOF on 10

For some reason a core file is not being generated.

System Information:
Scientific Linux 6.1
Kernel: 2.6.32-131.17.1.el6.x86_64

Opensips Information:
version: opensips 1.7.0-notls (x86_64/linux)
flags: STATS: Off, USE_IPV6, USE_TCP, DISABLE_NAGLE, USE_MCAST, SHM_MEM, SHM_MMAP, PKG_MALLOC, F_MALLOC, FAST_LOCK-ADAPTIVE_WAIT
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
svnrevision: 2:8518M
@(#) $Id: main.c 8265 2011-08-19 16:34:21Z bogdan_iancu $
main.c compiled on 13:56:58 Nov  1 2011 with gcc 4.4.5

This is our cancel handling:

if (is_method("CANCEL")) {
	if (t_check_trans()) {
		t_relay();
	}
	exit;
}

Crash seems to happen when the t_relay() is called. Calling unforce_rtp_proxy() before t_relay makes no difference. I have not tried different flag combinations on the rtpproxy_offer().

Thanks.

----------------------------------------------------------------------

>Comment By: Ryan Bullock (rrb3942)
Date: 2011-11-04 11:16

Message:
Also happens on latest trunk.

Looking through the source code to understand the error message, it looks
like a lump with the LUMPFLAG_SHMEM flag is being added somewhere, but I
can't seem to find it.

I attached a debug log from the cancel processing.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=1086410&aid=3432430&group_id=232389