[Opalvoip-devel] 100% reproducible Segmentation fault with SIP+TCP

[Vyacheslav F. <v.f...@or...>]

It's possible Segmentation fault on termination SIP connection (on receiving 100 OK for BYE)
if used TCP transport.
It's 100% reproducible (at least with t38modem and faxopal for receiving fax)
on 1 CPU (no hyperthreading) system with Red Hat Enterprise Linux WS release 4 (Nahant).

The scenario follows:

  The thread 0x635fbb0 calls SIPConnection::~SIPConnection.
  SIPConnection::~SIPConnection calls transport->CloseWait():

2010/02/18 12:44:12.279  Opal Garbage:0x635fbb0 Opal    Transport clean up on termination

  OpalTransport::CloseWait() calls Close():

2010/02/18 12:44:12.279  Opal Garbage:0x635fbb0 Opal    Transport Close

  OpalTransport::Close() calls GetBaseWriteChannel()->Close():

2010/02/18 12:44:12.279  Opal Garbage:0x635fbb0 PWLib   Closing channel, fd=41

  The thread 0x635fbb0 unblocks the thread 0x8c29bb0 ():

2010/02/18 12:44:12.279   Opal Answer:0x8c29bb0 PTLib   Unblocked I/O fd=42
2010/02/18 12:44:12.279  Opal Garbage:0x635fbb0 PTLib   Unblocking I/O fd=42 thread=Opal Answer:0x8c29bb0
2010/02/18 12:44:12.279   Opal Answer:0x8c29bb0 SIP     PDU Read failed: Interrupted system call

  The thread 0x8c29bb0 returns to SIPEndPoint::NewIncomingConnection():

2010/02/18 12:44:12.280   Opal Answer:0x8c29bb0 SIP     Listening thread finished.

  SIPEndPoint::NewIncomingConnection() returns PTrue (the transport object should be
  deleted by the caller) to OpalEndPoint::ListenerCallback().
  OpalEndPoint::ListenerCallback() deletes transport:

2010/02/18 12:44:12.280   Opal Answer:0x8c29bb0 Opal    Transport clean up on termination
2010/02/18 12:44:12.280   Opal Answer:0x8c29bb0 Opal    Transport Close
2010/02/18 12:44:12.280   Opal Answer:0x8c29bb0 OpalTransport::CloseWait: OK 0x8deae48
2010/02/18 12:44:12.280   Opal Answer:0x8c29bb0 Opal    Deleted transport tcp$127.0.0.1:52894<if=tcp$127.0.0.1:5060>
2010/02/18 12:44:12.281   Opal Answer:0x8c29bb0 PTLib   Thread ended: name="Opal Answer:0x8c29bb0", real=30.089, kernel=0.000 (0%), user=0.010 (0%), both=0.010 (0%)
2010/02/18 12:44:12.282   Opal Answer:0x8c29bb0 PTLib   Destroyed thread 0x8dea268 Opal Answer:0x8c29bb0(id = 8c29bb0)
2010/02/18 12:44:12.282   Housekeeper:0x1126bb0 PTLib   MONITOR: timers=2, expiries=16

  The thread 0x635fbb0 do "Segmentation fault" because it still use the deleted transport.



*******************************************************************************************************
This message and any attachments (the "message") are confidential and intended solely for the addressees. 
Any unauthorised use or dissemination is prohibited.
Messages are susceptible to alteration. Orange Business Services shall not be liable for the message if altered, changed or
falsified. If you are not the intended addressee of this message, please cancel it immediately and inform 
the sender.
*******************************************************************************************************