Ubuntu
asterisk package

chan_iax2 crashes on nonexistent fr->callno (patch available)

Bug #501116 reported by Ryan Finnie
20
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Asterisk
Fix Released
Undecided
Unassigned
asterisk (Ubuntu)
Fix Released
Undecided
Unassigned
Karmic
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: asterisk

We are getting occasional segfaults on a karmic system (1:1.6.2.0~rc2-0ubuntu1.1) with heavy iax2 traffic (crashes occur every few days):

[442046.620342] asterisk[8552]: segfault at 48d ip b6022c71 sp b4ee04a0 error 4 in chan_iax2.so[b5ff2000+48000]

A backtrace reveals:

Core was generated by `/usr/sbin/asterisk -f -p -g -U asterisk -vvvg -c'.
Program terminated with signal 11, Segmentation fault.
#0 0xb6022c71 in socket_process (thread=<value optimized out>) at chan_iax2.c:9451
9451 if (ast_test_flag(iaxs[fr->callno], IAX_ENCRYPTED)) {
(gdb) bt
#0 0xb6022c71 in socket_process (thread=<value optimized out>) at chan_iax2.c:9451
#1 0xb602bfa1 in iax2_process_thread (data=0xb8fb5748) at chan_iax2.c:11133
#2 0xb76b56b4 in dummy_start (data=0xb8fb1fb0) at utils.c:968
#3 0xb714b80e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#4 0xb735e7ee in clone () from /lib/tls/i686/cmov/libc.so.6

This bug was reported as part of another bug report in the Asterisk issues system (https://bit.ly/2BtN52W) and fixed in both the 1.4 and 1.6.2 lines (the patch is the same for both lines):

https://bit.ly/2BtN52W

Please consider applying this patch, as it is causing Asterisk-wide crashes. Thank you.

See original description
Bug Watch Updater (bug-watch-updater)
Changed in asterisk:
status: Unknown → In Progress
Revision history for this message
Roberto D'Auria (everlastingfire) wrote :

I patched the source, here's the debdiff.
This is my first patch, so I hope I've done it well. Any comment/suggestion will be very useful.

Changed in asterisk (Ubuntu):
status: New → Confirmed
Revision history for this message
Roberto D'Auria (everlastingfire) wrote :

Changed karmic to karmic-proposed and added a '#' before LP number.

Roberto D'Auria (everlastingfire)
Changed in asterisk (Ubuntu):
status: Confirmed → New
Revision history for this message
Devid Antonio Filoni (d.filoni) wrote :

ubuntu-sru ACK.

Revision history for this message
Devid Antonio Filoni (d.filoni) wrote :

Package uploaded.

Changed in asterisk (Ubuntu):
status: New → Confirmed
Luca Falavigna (dktrkranz)
Changed in asterisk (Ubuntu Karmic):
status: New → Confirmed
Revision history for this message
Roberto D'Auria (everlastingfire) wrote :

I updated lucid package too, by adding the old patches (already in karmic) and the new one that fixes this bug.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package asterisk - 1:1.6.2.0~rc2-0ubuntu2

---------------
asterisk (1:1.6.2.0~rc2-0ubuntu2) lucid; urgency=low

  [ Dave Walker (Daviey) ]
  * SECURITY UPDATE: ACL not respected on SIP INVITE (LP: #491632).
    - debian/patches/AST-2009-007: Additional check in channels/chan_sip.c to
      check ACL for handling SIP INVITEs. This blocks calls on networks
      intended to be prohibited, by configuration. Based on upstream patch.
    - AST-2009-007
    - CVE-2009-3723
  * SECURITY UPDATE: SIP responses expose valid usernames (LP: #491637).
    - debian/patches/AST-2009-008: Sanitise certain return of REGISTER message
      to stop a specially crafted series of requests returning valid usernames.
      Based on upstream patch.
    - AST-2009-008
    - CVE-2009-3727
  * SECURITY UPDATE: RTP Remote Crash Vulnerability (LP: #493555).
    - debian/patches/AST-2009-010: Stops Asterisk from crashing when an RTP
      comfort noise payload containing 24 bytes or greater is recieved.
    - AST-2009-010
    - CVE-2009-4055

  [ Roberto D'Auria ]
  * debian/patches/iax2-heavy-traffic-fix: Stops asterisk crashing on
    heavy traffic on iax2 channel, editing channels/chan_iax2.c.
    Based on upstream patch. (LP: #501116)
 -- Roberto D'Auria <email address hidden> Wed, 30 Dec 2009 14:49:24 +0100

Changed in asterisk (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Scott Kitterman (kitterman) wrote : Please test proposed package

Accepted into karmic-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Changed in asterisk (Ubuntu Karmic):
status: Confirmed → Fix Committed
tags: added: verification-needed
Revision history for this message
Ryan Finnie (fo0bar) wrote :

Thanks Scott. They have not yet hit the mirrors, but I have downloaded the .debs from LP and begun testing. The patch is correct and there does not appear to be build regressions, but I will continue testing and post back later.

For anyone else that wants to test, the problem is a race condition, but I did work out a procedure for triggering it somewhat consistently:

1. Set up 2 asterisk servers, Server A and Server B (the affected server). Ideally the servers should be far enough away on the network (in my setup, they're 90ms RTT from each other).
2. Register Twinkle with Server A.
3. Set up a dial plan that allows Twinkle to call Server B via Server A with Dial(IAX2/serverb/s,60). The endpoint on Server B must pick up immediately, for example Answer() and Playback(tt-weasels).
4. Dial the endpoint with Twinkle, then hang up.
5. Rapidly toggle between F12 (redial) and Esc (hang up).
6. Server B should eventually segfault if unpatched, but should not if patched.

Revision history for this message
Ryan Finnie (fo0bar) wrote :

The karmic-proposed packages have been running for the work week in production without a problem, so I can confirm the patched version as verified. Thank you.

Martin Pitt (pitti)
tags: added: verification-done
removed: verification-needed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package asterisk - 1:1.6.2.0~rc2-0ubuntu1.2

---------------
asterisk (1:1.6.2.0~rc2-0ubuntu1.2) karmic-proposed; urgency=low

  * debian/patches/iax2-heavy-traffic-fix: Stops asterisk crashing on
    heavy traffic on iax2 channel, editing channels/chan_iax2.c.
    Based on upstream patch. (LP: #501116)
 -- Roberto D'Auria <email address hidden> Tue, 29 Dec 2009 22:42:00 +0100

Changed in asterisk (Ubuntu Karmic):
status: Fix Committed → Fix Released
Revision history for this message
Ryan Finnie (fo0bar) wrote :

Bug was fixed as part of #15609, but unrelated to it. Therefore this is actually fixed in Asterisk, so the bug does not need to be tracked.

Changed in asterisk:
importance: Unknown → Undecided
status: In Progress → New
status: New → Fix Released
tranadols (tramadols)
description: updated
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.