[OpenSIPS-Devel] [OpenSIPS/opensips] 2b7416: tm: fix shm double-free of script-route refs on sh...

[Bogdan Andrei IANCU]

  Branch: refs/heads/master
  Home:   https://github.com/OpenSIPS/opensips
  Commit: 2b741691d179d1448e6fc6729cda2e6efced174f
      https://github.com/OpenSIPS/opensips/commit/2b741691d179d1448e6fc6729cda2e6efced174f
  Author: Nate Fischer <nate.fischer at sinch.com>
  Date:   2026-07-16 (Thu, 16 Jul 2026)

  Changed paths:
    M modules/tm/t_fwd.c
    M modules/tm/t_reply.c
    M modules/tm/t_reply.h

  Log Message:
  -----------
  tm: fix shm double-free of script-route refs on shared transactions

t_on_reply()/t_on_negative()/t_on_branch() did an unlocked
"if (*holder) shm_free(*holder); *holder = dup(...)" on a route-ref field
of the shared transaction cell. From a request route against an existing
transaction (e.g. a retransmitted in-dialog ACK handled by two UDP
workers concurrently), both read the same pointer and free it; the second
shm_free() aborts while holding the global shm lock, wedging every
process (FAST_LOCK spin) until restart.

Swap the holder atomically under the transaction reply lock, freeing the
old pointer outside the lock. Take the lock only in REQUEST_ROUTE, since
FAILURE_ROUTE and (with onreply_avp_mode) ONREPLY_ROUTE already hold
LOCK_REPLIES and may re-arm these handlers.

Refs #4112


  Commit: ee8abced1292bddfcfd155d74033e3af863dc2bd
      https://github.com/OpenSIPS/opensips/commit/ee8abced1292bddfcfd155d74033e3af863dc2bd
  Author: Bogdan Andrei IANCU <bogdan at opensips.org>
  Date:   2026-07-24 (Fri, 24 Jul 2026)

  Changed paths:
    M modules/tm/t_fwd.c
    M modules/tm/t_reply.c
    M modules/tm/t_reply.h

  Log Message:
  -----------
  Merge pull request #4113 from kvwake/fix/tm-on_reply-shm-double-free

tm: fix shm double-free of script-route refs on shared transactions


Compare: https://github.com/OpenSIPS/opensips/compare/e965d14ce6d4...ee8abced1292

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications