chan_iax2 crashes on nonexistent fr->callno (patch available)

Bug #501116 reported by Ryan Finnie on 2009-12-28
20
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Asterisk
Fix Released
Undecided
Unassigned
asterisk (Ubuntu)
Undecided
Unassigned
Karmic
Undecided
Unassigned

Bug Description

Binary package hint: asterisk

We are getting occasional segfaults on a karmic system (1:1.6.2.0~rc2-0ubuntu1.1) with heavy iax2 traffic (crashes occur every few days):

[442046.620342] asterisk[8552]: segfault at 48d ip b6022c71 sp b4ee04a0 error 4 in chan_iax2.so[b5ff2000+48000]

A backtrace reveals:

Core was generated by `/usr/sbin/asterisk -f -p -g -U asterisk -vvvg -c'.
Program terminated with signal 11, Segmentation fault.
#0 0xb6022c71 in socket_process (thread=<value optimized out>) at chan_iax2.c:9451
9451 if (ast_test_flag(iaxs[fr->callno], IAX_ENCRYPTED)) {
(gdb) bt
#0 0xb6022c71 in socket_process (thread=<value optimized out>) at chan_iax2.c:9451
#1 0xb602bfa1 in iax2_process_thread (data=0xb8fb5748) at chan_iax2.c:11133
#2 0xb76b56b4 in dummy_start (data=0xb8fb1fb0) at utils.c:968
#3 0xb714b80e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#4 0xb735e7ee in clone () from /lib/tls/i686/cmov/libc.so.6

This bug was reported as part of another bug report in the Asterisk issues system (https://bit.ly/2BtN52W) and fixed in both the 1.4 and 1.6.2 lines (the patch is the same for both lines):

https://bit.ly/2BtN52W

Please consider applying this patch, as it is causing Asterisk-wide crashes. Thank you.

Changed in asterisk:
status: Unknown → In Progress

I patched the source, here's the debdiff.
This is my first patch, so I hope I've done it well. Any comment/suggestion will be very useful.

Changed in asterisk (Ubuntu):
status: New → Confirmed

Changed karmic to karmic-proposed and added a '#' before LP number.

Changed in asterisk (Ubuntu):
status: Confirmed → New
Devid Antonio Filoni (d.filoni) wrote :

ubuntu-sru ACK.

Devid Antonio Filoni (d.filoni) wrote :

Package uploaded.

Changed in asterisk (Ubuntu):
status: New → Confirmed
Changed in asterisk (Ubuntu Karmic):
status: New → Confirmed

I updated lucid package too, by adding the old patches (already in karmic) and the new one that fixes this bug.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package asterisk - 1:1.6.2.0~rc2-0ubuntu2

---------------
asterisk (1:1.6.2.0~rc2-0ubuntu2) lucid; urgency=low

  [ Dave Walker (Daviey) ]
  * SECURITY UPDATE: ACL not respected on SIP INVITE (LP: #491632).
    - debian/patches/AST-2009-007: Additional check in channels/chan_sip.c to
      check ACL for handling SIP INVITEs. This blocks calls on networks
      intended to be prohibited, by configuration. Based on upstream patch.
    - AST-2009-007
    - CVE-2009-3723
  * SECURITY UPDATE: SIP responses expose valid usernames (LP: #491637).
    - debian/patches/AST-2009-008: Sanitise certain return of REGISTER message
      to stop a specially crafted series of requests returning valid usernames.
      Based on upstream patch.
    - AST-2009-008
    - CVE-2009-3727
  * SECURITY UPDATE: RTP Remote Crash Vulnerability (LP: #493555).
    - debian/patches/AST-2009-010: Stops Asterisk from crashing when an RTP
      comfort noise payload containing 24 bytes or greater is recieved.
    - AST-2009-010
    - CVE-2009-4055

  [ Roberto D'Auria ]
  * debian/patches/iax2-heavy-traffic-fix: Stops asterisk crashing on
    heavy traffic on iax2 channel, editing channels/chan_iax2.c.
    Based on upstream patch. (LP: #501116)
 -- Roberto D'Auria <email address hidden> Wed, 30 Dec 2009 14:49:24 +0100

Changed in asterisk (Ubuntu):
status: Confirmed → Fix Released

Accepted into karmic-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Changed in asterisk (Ubuntu Karmic):
status: Confirmed → Fix Committed
tags: added: verification-needed
Ryan Finnie (fo0bar) wrote :

Thanks Scott. They have not yet hit the mirrors, but I have downloaded the .debs from LP and begun testing. The patch is correct and there does not appear to be build regressions, but I will continue testing and post back later.

For anyone else that wants to test, the problem is a race condition, but I did work out a procedure for triggering it somewhat consistently:

1. Set up 2 asterisk servers, Server A and Server B (the affected server). Ideally the servers should be far enough away on the network (in my setup, they're 90ms RTT from each other).
2. Register Twinkle with Server A.
3. Set up a dial plan that allows Twinkle to call Server B via Server A with Dial(IAX2/serverb/s,60). The endpoint on Server B must pick up immediately, for example Answer() and Playback(tt-weasels).
4. Dial the endpoint with Twinkle, then hang up.
5. Rapidly toggle between F12 (redial) and Esc (hang up).
6. Server B should eventually segfault if unpatched, but should not if patched.

Ryan Finnie (fo0bar) wrote :

The karmic-proposed packages have been running for the work week in production without a problem, so I can confirm the patched version as verified. Thank you.

Martin Pitt (pitti) on 2010-01-08
tags: added: verification-done
removed: verification-needed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package asterisk - 1:1.6.2.0~rc2-0ubuntu1.2

---------------
asterisk (1:1.6.2.0~rc2-0ubuntu1.2) karmic-proposed; urgency=low

  * debian/patches/iax2-heavy-traffic-fix: Stops asterisk crashing on
    heavy traffic on iax2 channel, editing channels/chan_iax2.c.
    Based on upstream patch. (LP: #501116)
 -- Roberto D'Auria <email address hidden> Tue, 29 Dec 2009 22:42:00 +0100

Changed in asterisk (Ubuntu Karmic):
status: Fix Committed → Fix Released
Ryan Finnie (fo0bar) wrote :

Bug was fixed as part of #15609, but unrelated to it. Therefore this is actually fixed in Asterisk, so the bug does not need to be tracked.

Changed in asterisk:
importance: Unknown → Undecided
status: In Progress → New
status: New → Fix Released
tranadols (tramadols) on 2019-02-13
description: updated
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.