| Hello All,
I am also experiencing SEGV on Android regarding the same issue. After phone loses signal, when getting it back the phone might connect to and 2g network, the jump to 3g or 4g. When it “jumps” between networks, the android ConnectivityManager publishes network disconnection and then connection.
So when we try to remove the account and re create it, in some rear situation PJSIP just crushes with SEGV.
What the PJ owners think about this patch ?
Thanks, Oren
Dear PJSIP project,
I've come across a SEGV in pjproject-2.6 on Linux under the following circumstances: - An active account re-registers
- The re-registration fails (in my case, DNS resolution timeout after 10 seconds)
- At exactly the same time, the keep-alive timer fires.
The issue was consistently reproducible for me under a very high network load, with the re-registration interval set to 5 seconds, DNS timeout default (10 seconds) and keepalive interval default (15 seconds). Since 5+10 seconds == 15 seconds, the 2 events coincide and lead to the following backtrace:
Thread #1 (Suspended : Signal : SIGSEGV:Segmentation fault) keep_alive_timer_cb() at pjsua_acc.c:1,981 0x76bcb424 pj_timer_heap_poll() at timer.c:643 0x76e43244 pjsip_endpt_handle_events2() at sip_endpoint.c:713 0x76cc0dd8 worker_thread() at pjsua_core.c:695 0x76bde404
Thread #2
__pthread_mutex_unlock_usercnt() at pthread_mutex_unlock.c:66 0x4940a4d8
__GI___pthread_mutex_unlock() at pthread_mutex_unlock.c:315 0x4940a588 pj_mutex_unlock() at os_core_unix.c:1,323 0x76e4241c PJSUA_UNLOCK() at pjsua_internal.h:584 0x76be4244 pjsua_acc_set_registration() at pjsua_acc.c:2,682 0x76be4244 pj::Account::getInfo() at account.cpp:737 0x76e86438
Analyzing the backtrace, I found 2 problems which are fixed in attached patch: - timer.c: pj_timer_heap_poll places the timer onto the freelist and releases the global lock before calling the callback -- thus the callback may operate on a timer already freed! Proposed fix: keep timer_entry out of the freelist until the callback is done.
- pjsua_acc.c: Even with the 1st issue fixed, the account registration could still be canceled "exactly when the callback fires", because the lock is released before the callback ... thus putting NULL into the ka_transport thus causing the SEGV. Proposed fix: protect against NULL in ka_transport.
While the patch is against pjroject-2.6 , I believe that the issue is still in latest trunk as well.
Please let me know what you think about the attached patch, and consider it for inclusion in pjproject.
Thanks,
Martin -- _______________________________________________ Visit our blog: http://blog.pjsip.orgpjsip mailing list pjsip@xxxxxxxxxxxxxxxhttp://lists.pjsip.org/mailman/listinfo/pjsip_lists.pjsip.org
|
