[OpenSIPS-Users] Crash on BYE (free after free)

[Callum Guy]

Hi All,

I've had a couple of incidents this week where OpenSIPs crashed during BYE
processing, in both cases the SIP logs show BYE arriving from both sides of
a call within a couple of milliseconds - these overlap and result in 481's
being both sent to our media server and being received from our media
server as shown in the image below (UA <> OpenSIPs <> Media server):

[image: image.png]

It is during the processing of the final 481 that OpenSIPs hits the bug.
The error shown in the logs is:

opensips[234594]: CRITICAL:core:fm_free: freeing already freed shm pointer
(0x7f56fefaaa18), first free: (null): (null)(0) - aborting!

User logs show that the 481 was being processed for an established dialog
and executes an onreply route followed by a failure route. The failure
route issues t_check_trans and rtpengine_delete (which may have already
been removed during BYE processing). Is there likely to be anything that I
can do at the script level if this is a race condition?

This server is using the official CentOS 3.0.1 release, happy to upgrade if
there have been any relevant fixes since that version.

Thanks,

Callum

-- 


 <https://www.x-on.co.uk/service/surgery-connect/coronavirus.htm>


*0333 
332 0000  |  x-on.co.uk <https://www.x-on.co.uk>  |   ** 
<https://www.linkedin.com/company/x-on>   <https://www.facebook.com/XonTel> 
  <https://twitter.com/xonuk> **  |  Coronavirus 
<https://www.x-on.co.uk/service/surgery-connect/coronavirus.htm>*


THE 
ITSPA AWARDS 2020 <http://www.itspa.org.uk/itspa-awards> AND Best ITSP - 
Mid Market, Best Software and Best Vertical Solution are trade marks of the 
Internet Telephony Services Providers' Association, used under licence.


X-on
is a trading name of Storacall Technology Ltd a limited company 
registered in
England and Wales.

Registered Office : Avaland House, 110 
London Road, Apsley, Hemel Hempstead,
Herts, HP3 9SD. Company Registration 
No. 2578478.

The information in this e-mail is confidential and for use by 
the addressee(s)
only. If you are not the intended recipient, please notify 
X-on immediately on +44(0)333 332 0000 and delete the
message from your 
computer. If you are not a named addressee you must not use,
disclose, 
disseminate, distribute, copy, print or reply to this email. Views
or 
opinions expressed by an individual
within this email may not necessarily

reflect the views of X-on or its associated companies. Although X-on 
routinely
screens for viruses, addressees should scan this email and any 
attachments
for
viruses. X-on makes no representation or warranty as to the 
absence of viruses
in this email or any attachments.










-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensips.org/pipermail/users/attachments/20200511/1f75a811/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 13215 bytes
Desc: not available
URL: <http://lists.opensips.org/pipermail/users/attachments/20200511/1f75a811/attachment-0001.png>