Changes since asterisk Version 1.4.9/channels/chan_iax2.c - svn revision 76859 ------------------------------------------------------------------------ r77794 | russell | 2007-07-30 15:16:43 -0500 (Mon, 30 Jul 2007) | 8 lines Fix an issue that could potentially cause corruption of the global iax frame queue. In the network_thread() loop, it traverses the list using the AST_LIST_TRAVERSE_SAFE macro. However, to remove an element of the list within this loop, it used AST_LIST_REMOVE, instead of AST_LIST_REMOVE_CURRENT, which I believe could leave some of the internal variables of the SAFE macro invalid. Mihai says that he already made this change in his local copy and it didn't help his VNAK storm issues, but I still think it's wrong. :) ------------------------------------------------------------------------ r77869 | file | 2007-08-01 12:56:59 -0500 (Wed, 01 Aug 2007) | 2 lines Add some fixes for building on Solaris. ------------------------------------------------------------------------ r77887 | russell | 2007-08-01 17:16:17 -0500 (Wed, 01 Aug 2007) | 23 lines Fix some race conditions which have been causing weird problems in chan_iax2. The most notable problem is that people have been seeing storms of VNAK frames being sent due to really old frames mysteriously being in the retransmission queue and never getting removed. It was possible that a dynamic thread got created, but did not acquire its lock before the thread that created it signals it to perform an action. When this happens, the thread will sleep until it hits a timeout, and then get destroyed. So, the action never gets performed and in some cases, means a frame doesn't get transmitted and never gets freed since the scheduler never gets a chance to reschedule transmission. Another less severe race condition is in the handling of a timeout for a dynamic thread. It was possible for it to be acquired to perform at action at the same time that it hit a timeout. When this occurs, whatever action it was acquired for would never get performed. (patch contributed by Mihai and SteveK) (closes issue #10289) (closes issue #10248) (closes issue #10232) (possibly related to issue #10359) ------------------------------------------------------------------------ r77939 | russell | 2007-08-02 11:56:04 -0500 (Thu, 02 Aug 2007) | 4 lines Add another sanity check to vnak_retransmit(). This check ensures that frames that have already been marked for deletion don't get retransmitted. (closes issue #10361, patch from mihai) ------------------------------------------------------------------------ r77943 | russell | 2007-08-02 13:04:43 -0500 (Thu, 02 Aug 2007) | 9 lines Fix another race condition in the handling of dynamic threads. If the dynamic thread timed out waiting for something to do, but was acquired to perform an action immediately afterwords, then wait on the condition again to give the other thread a chance to finish setting up the data for what action this thread should perform. Otherwise, if it immediately continues, it will perform the wrong action. (reported on IRC by mihai, patch by me) (related to issue #10289) ------------------------------------------------------------------------ r77949 | russell | 2007-08-02 14:25:14 -0500 (Thu, 02 Aug 2007) | 5 lines Fix the case where a dynamic thread times out waiting for something to do during the first time it runs. This shouldn't ever happen, but we should account for it anyway. (pointed out by pete, who works with mihai) ------------------------------------------------------------------------ r78028 | russell | 2007-08-02 21:04:22 -0500 (Thu, 02 Aug 2007) | 6 lines Don't reuse the timespec that was set to 0 in the previous timedwait as it will just return immediately. Also, fix some logic so the thread's lock isn't unlocked twice in the weird case of dynamic threads getting acquired right after a timeout. (pointed out by SteveK) ------------------------------------------------------------------------ r78063 | russell | 2007-08-03 12:01:07 -0500 (Fri, 03 Aug 2007) | 4 lines Only pass through HOLD and UNHOLD control frames when the mohinterpret option is set to "passthrough". This was pointed out by Kevin in the middle of a training session. ------------------------------------------------------------------------ r78242 | russell | 2007-08-06 15:44:09 -0500 (Mon, 06 Aug 2007) | 4 lines Fix an issue where dynamic threads can get free'd, but still exist in the dynamic thread list. (closes issue #10392, patch from Mihai, with credit to his colleague, Pete) ------------------------------------------------------------------------ r79174 | file | 2007-08-13 09:18:04 -0500 (Mon, 13 Aug 2007) | 4 lines (closes issue #10437) Reported by: haklin Don't set the callerid name and number a second time on a newly created channel. ast_channel_alloc itself already sets it and setting it twice would cause a memory leak. ------------------------------------------------------------------------ r79214 | russell | 2007-08-13 10:28:13 -0500 (Mon, 13 Aug 2007) | 4 lines Fix a potential deadlock in socket_process. check_provisioning can eventually call find_callno. You can't hold a pvt lock while calling find_callno because it goes through and locks every single one looking for a match. ------------------------------------------------------------------------ r79272 | russell | 2007-08-13 14:27:39 -0500 (Mon, 13 Aug 2007) | 9 lines I am fighting deadlocks in chan_iax2. I have tracked them down to a single core issue. You can not call find_callno() while holding a pvt lock as this function has to lock another (every) other pvt lock. Doing so can lead to a classic deadlock. So, I am tracking down all of the code paths where this can happen and fixing them. The fix I committed earlier today was along the same theme. This patch fixes some code down the path of authenticate_reply. ------------------------------------------------------------------------ r79274 | russell | 2007-08-13 15:02:57 -0500 (Mon, 13 Aug 2007) | 3 lines Don't call find_peer within update_registry with a pvt lock held. This can cause a deadlock as the code will eventually call find_callno. ------------------------------------------------------------------------ r79276 | russell | 2007-08-13 15:18:30 -0500 (Mon, 13 Aug 2007) | 4 lines Release the pvt lock before calling find_peer in register_verify to avoid a deadlock. Also, remove some unnecessary locking in auth_fail that was only done recursively. ------------------------------------------------------------------------ r79301 | russell | 2007-08-13 15:37:50 -0500 (Mon, 13 Aug 2007) | 3 lines Don't call find_peer in registry_authrequest with the pvt lock held to avoid a deadlock. ------------------------------------------------------------------------ r79436 | russell | 2007-08-14 12:31:39 -0500 (Tue, 14 Aug 2007) | 3 lines Fix some memory leaks throughout chan_iax2 related to the use of realtime. I found these while working on iax2_peer object reference tracking. ------------------------------------------------------------------------ r79470 | russell | 2007-08-14 13:49:10 -0500 (Tue, 14 Aug 2007) | 2 lines Fix another spot where an iax2_peer would be leaked if realtime was in use. ------------------------------------------------------------------------ r79756 | russell | 2007-08-16 16:29:24 -0500 (Thu, 16 Aug 2007) | 11 lines Fix more deadlocks in chan_iax2 that were introduced by making frame handling and scheduling multi-threaded. Unfortunately, we have to do some expensive deadlock avoidance when queueing frames on to the ast_channel owner of the IAX2 pvt struct. This was already handled for regular frames, but ast_queue_hangup and ast_queue_control were still used directly. Making these changes introduced even more places where the IAX2 pvt struct can disappear in the context of a function holding its lock due to calling a function that has to unlock/lock it to avoid deadlocks. I went through and fixed all of these places to account for this possibility. (issue #10362, patch by me) ------------------------------------------------------------------------ r80362 | russell | 2007-08-22 15:21:36 -0500 (Wed, 22 Aug 2007) | 34 lines Merge changes from team/russell/iax_refcount. This set of changes fixes problems with the handling of iax2_user and iax2_peer objects. It was very possible for a thread to still hold a reference to one of these objects while a reload operation tries to delete them. The fix here is to ensure that all references to these objects are tracked so that they can't go away while still in use. To accomplish this, I used the astobj2 reference counted object model. This code has been in one of Luigi Rizzo's branches for a long time and was primarily developed by one of his students, Marta Carbone. I wanted to go ahead and bring this in to 1.4 because there are other problems similar to the ones fixed by these changes, so we might as well go ahead and use the new astobj if we're going to go through all of the work necessary to fix the problems. As a nice side benefit of these changes, peer and user handling got more efficient. Using astobj2 lets us not hold the container lock for peers or users nearly as long while iterating. Also, by changing a define at the top of chan_iax2.c, the objects will be distributed in a hash table, drastically increasing lookup speed in these containers, which will have a very big impact on systems that have a large number of users or peers. The use of the hash table will be made the default in trunk. It is not the default in 1.4 because it changes the behavior slightly. Previously, since peers and users were stored in memory in the same order they were specified in the configuration file, you could influence peer and user matching order based on the order they are specified in the configuration. The hash table does not guarantee any order in the container, so this behavior will be going away. It just means that you have to be a little more careful ensuring that peers and users are matched explicitly and not forcing chan_iax2 to have to guess which user is the right one based on secret, host, and access list settings, instead of simply using the username. If you have any questions, feel free to ask on the asterisk-dev list. ------------------------------------------------------------------------ r80497 | russell | 2007-08-23 11:53:52 -0500 (Thu, 23 Aug 2007) | 5 lines This is a hack to maintain old behavior of chan_iax2. This ensures that if the peers and users are being stored in a linked list, that they go in the list in the same order that the older code used. This is necessary to maintain the behavior of which peers and users get matched when traversing the container. ------------------------------------------------------------------------ r80499 | russell | 2007-08-23 12:02:50 -0500 (Thu, 23 Aug 2007) | 3 lines Fix some code where it was possible for a reference to a peer to not get released when it should. Thank you to Marta Carbone for pointing this out! ------------------------------------------------------------------------ r80849 | russell | 2007-08-24 16:22:50 -0500 (Fri, 24 Aug 2007) | 5 lines If dnsmgr is in use, and no DNS servers are available when Asterisk first starts, then don't give up on poking peers. Allow the poke to get rescheduled so that it will work once the dnsmgr is able to resolve the host. (closes issue #10521, patch by jamesgolovich) ------------------------------------------------------------------------ r80895 | russell | 2007-08-25 12:37:39 -0500 (Sat, 25 Aug 2007) | 7 lines Fix some issues with the handling of the scheduler in chan_iax2. Most of the places that scheduled items to be executed by the scheduler thread did not signal the scheduler thread to wake up so that it could recalculate the time until the next action. These changes will make the scheduler thread more responsive and ensure that actions get executed as close to when intended as possible instead of it being possible for very long delays. ------------------------------------------------------------------------ r80932 | russell | 2007-08-26 13:11:26 -0500 (Sun, 26 Aug 2007) | 3 lines Remove an extra signal_condition() for the scheduler thread. (closes issue #10564, patch from casper) ------------------------------------------------------------------------ r81291 | russell | 2007-08-28 16:38:26 -0500 (Tue, 28 Aug 2007) | 3 lines Change the message about receiving a mini-frame before the first full voice frame to a DEBUG message. ------------------------------------------------------------------------ r81433 | russell | 2007-09-03 13:57:53 -0500 (Mon, 03 Sep 2007) | 5 lines Remove a couple of calls to ast_string_field_free_pools() on peers in error handling blocks in the code for building peers. The peer object destructor does this and doing it twice will cause a crash. (closes issue #10625, reported by and patched by pnlarsson) ------------------------------------------------------------------------ r81439 | file | 2007-09-04 09:23:18 -0500 (Tue, 04 Sep 2007) | 6 lines (closes issue #10632) Reported by: jamesgolovich Patches: asterisk-iaxfirmwareleak.diff.txt uploaded by jamesgolovich (license 176) Fix memory leak when unloading chan_iax2. The firmware files were not being freed. ------------------------------------------------------------------------ r81448 | russell | 2007-09-04 13:37:44 -0500 (Tue, 04 Sep 2007) | 4 lines Remove the typedefs on ao2_container and ao2_iterator. This is simply because we don't typedef objects anywhere else in Asterisk, so we might as well make this follow the same convention. ------------------------------------------------------------------------ r82590 | kpfleming | 2007-09-17 11:33:30 -0500 (Mon, 17 Sep 2007) | 2 lines fix a couple of places where a logical member name (if specified) was not used, but instead the direct interface was listed ------------------------------------------------------------------------ r82592 | kpfleming | 2007-09-17 11:40:12 -0500 (Mon, 17 Sep 2007) | 2 lines revert a change that wasn't supposed to be committed... doh! ------------------------------------------------------------------------ r83175 | russell | 2007-09-19 14:13:29 -0500 (Wed, 19 Sep 2007) | 8 lines When handling a reload of chan_iax2, don't use an ao2_callback() to POKE all peers. Instead, use an iterator. By using an iterator, the peers container is not locked while the POKE is being done. It can cause a deadlock if the peers container is locked because poking a peer will try to lock pvt structs, while there is a lot of other code that will hold a pvt lock when trying to go lock the peers container. (reported to me directly by Loic Didelot. Thank you for the debug info!) ------------------------------------------------------------------------ r83432 | russell | 2007-09-21 09:37:20 -0500 (Fri, 21 Sep 2007) | 4 lines gcc 4.2 has a new set of warnings dealing with cosnt pointers. This set of changes gets all of Asterisk (minus chan_alsa for now) to compile with gcc 4.2. (closes issue #10774, patch from qwell) ------------------------------------------------------------------------ r86371 | russell | 2007-10-18 16:14:15 -0500 (Thu, 18 Oct 2007) | 2 lines Add support for setting the maximum trunk size for IAX2 trunking ------------------------------------------------------------------------ r86372 | russell | 2007-10-18 16:16:47 -0500 (Thu, 18 Oct 2007) | 2 lines Revert erroneous commit. ------------------------------------------------------------------------ r87686 | russell | 2007-10-30 16:19:09 -0500 (Tue, 30 Oct 2007) | 11 lines Merge the changes from team/russell/iax2_poke_fix and iax2-poke-fix-trunk There was a race condition related to the handling of POKEing peers. Essentially, a reference to a peer is held by the scheduler when there are pending callbacks, but the reference count didn't reflect it. So, it was possible for a peer to hit a reference count of zero and have its destructor begin to be called at the same time that the scheduler thread ran a POKE related callback. If that happened, a crash would likely occur. (closes issue #11082, closes issue #11094) ------------------------------------------------------------------------ r88471 | rizzo | 2007-11-04 16:38:13 -0600 (Sun, 04 Nov 2007) | 9 lines Rename ast_string_field_free_pool to ast_string_field_free_memory, and ast_string_field_free_all to ast_string_field_reset_all to avoid misuse (due to too similar names and an error in documentation). Fix two related memory leaks in app_meetme. No need to merge to trunk, different fix already applied there. Not applicable to 1.2 ------------------------------------------------------------------------ r89254 | qwell | 2007-11-13 15:07:08 -0600 (Tue, 13 Nov 2007) | 4 lines Fix building on newer systems which require a third arg to open() when using O_CREAT. Issue 11238, reported by puzzled. ------------------------------------------------------------------------ r89298 | tilghman | 2007-11-15 12:05:56 -0600 (Thu, 15 Nov 2007) | 5 lines Yet another memory corruption issue. Reported by: atis Patch by: tilghman Fixes issue #10923 ------------------------------------------------------------------------ r90348 | russell | 2007-11-30 13:26:04 -0600 (Fri, 30 Nov 2007) | 8 lines Change the behavior of ao2_link(). Previously, in inherited a reference. Now, it automatically increases the reference count to reflect the reference that is now held by the container. This was done to be more consistent with ao2_unlink(), which automatically releases the reference held by the container. It also makes it so it is no longer possible for a pointer to be invalid after ao2_link() returns. ------------------------------------------------------------------------ r90546 | qwell | 2007-12-03 12:20:49 -0600 (Mon, 03 Dec 2007) | 4 lines Only log debug messages if debug is enabled. Closes issue #11416, patch by casper. ------------------------------------------------------------------------ r92696 | qwell | 2007-12-12 18:11:09 -0600 (Wed, 12 Dec 2007) | 7 lines If a typo is found in a config file, we previous continued on with what was already loaded. We do not want to do this (see bug below for details). This makes it so that if a [ is found without a ], the entire config will fail, and nothing in it will be loaded. Isue #10690. ------------------------------------------------------------------------ r93182 | oej | 2007-12-17 01:15:13 -0600 (Mon, 17 Dec 2007) | 8 lines Issue 11574: Add dependencies on res_monitor and res_features. I wonder if Asterisk can run at all without res_features. My guess is that there's propably a lot of more modules and the core that depends on it. Reported by: caio1982 (closes issue #11574) ------------------------------------------------------------------------ r93668 | tilghman | 2007-12-18 12:29:39 -0600 (Tue, 18 Dec 2007) | 10 lines Merged revisions 93667 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.2 ........ r93667 | tilghman | 2007-12-18 12:23:06 -0600 (Tue, 18 Dec 2007) | 2 lines Fixing AST-2007-027 (Closes issue #11119) ........ ------------------------------------------------------------------------ r93949 | tilghman | 2007-12-19 11:04:13 -0600 (Wed, 19 Dec 2007) | 3 lines Avoid segfault in chan_iax when peer isn't defined (Closes issue #11602) ------------------------------------------------------------------------ r93955 | file | 2007-12-19 11:29:20 -0600 (Wed, 19 Dec 2007) | 2 lines Make the 1.4 builders happy, ensure var is NULL. ------------------------------------------------------------------------ r94256 | russell | 2007-12-20 14:22:22 -0600 (Thu, 20 Dec 2007) | 13 lines Merged revisions 94255 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.2 ........ r94255 | russell | 2007-12-20 14:21:41 -0600 (Thu, 20 Dec 2007) | 5 lines Fix another potential seg fault ... (closes issue #11606) Reported by: dimas ........ ------------------------------------------------------------------------ r96394 | russell | 2008-01-03 16:44:22 -0600 (Thu, 03 Jan 2008) | 3 lines Don't crash if the iax2 pvt structure has been destroyed before we get to this point (closes issue #11672, reported by snuffy, patched by me) ------------------------------------------------------------------------ r98943 | russell | 2008-01-15 17:26:52 -0600 (Tue, 15 Jan 2008) | 25 lines Commit a fix for some memory access errors pointed out by the valgrind2.txt output on issue #11698. The issue here is that it is possible for an instance of a translator to get destroyed while the frame allocated as a part of the translator is still being processed. Specifically, this is possible anywhere between a call to ast_read() and ast_frame_free(), which is _a lot_ of places in the code. The reason this happens is that the channel might get masqueraded during this time. During a masquerade, existing translation paths get destroyed. So, this patch fixes the issue in an API and ABI compatible way. (This one is for you, paravoid!) It changes an int in ast_frame to be used as flag bits. The 1 bit is still used to indicate that the frame contains timing information. Also, a second flag has been added to indicate that the frame came from a translator. When a frame with this flag gets released and has this flag, a function is called in translate.c to let it know that this frame is doing being processed. At this point, the flag gets cleared. Also, if the translator was requested to be destroyed while its internal frame still had this flag set, its destruction has been deffered until it finds out that the frame is no longer being processed. Admittedly, this feels like a hack. But, it does fix the issue, and I was not able to think of a better solution ... ------------------------------------------------------------------------ r98966 | file | 2008-01-16 11:50:10 -0600 (Wed, 16 Jan 2008) | 6 lines Add missing NULLs at end of two ast_load_realtimes. (closes issue #11769) Reported by: tequ Patches: chaniax.patch uploaded by dimas (license 88) ------------------------------------------------------------------------ r99004 | russell | 2008-01-17 16:37:22 -0600 (Thu, 17 Jan 2008) | 10 lines Have IAX2 optimize the codec translation path just like chan_sip does it. If the caller's codec is in our codec list, move it to the top to avoid transcoding. (closes issue #10500) Reported by: stevedavies Patches: iax-prefer-current-codec.patch uploaded by stevedavies (license 184) iax-prefer-current-codec.1.4.patch uploaded by stevedavies (license 184) Tested by: stevedavies, pj, sheldonh ------------------------------------------------------------------------ r100465 | tilghman | 2008-01-27 15:59:53 -0600 (Sun, 27 Jan 2008) | 11 lines When deleting a task from the scheduler, ignoring the return value could possibly cause memory to be accessed after it is freed, which causes all sorts of random memory corruption. Instead, if a deletion fails, wait a bit and try again (noting that another thread could change our taskid value). (closes issue #11386) Reported by: flujan Patches: 20080124__bug11386.diff.txt uploaded by Corydon76 (license 14) Tested by: Corydon76, flujan, stuarth` ------------------------------------------------------------------------ r101482 | qwell | 2008-01-31 13:52:49 -0600 (Thu, 31 Jan 2008) | 4 lines Solaris compat fixes for struct in_addr funkiness. Issue #11885, patch by snuffy. ------------------------------------------------------------------------ r101693 | russell | 2008-01-31 18:32:49 -0600 (Thu, 31 Jan 2008) | 8 lines Add some more sanity checking on IAX2 dial strings for the case that no peer or hostname was provided, which is the one part of the dial string that is absolutely required. If it's not there, bail out. (closes issue #11897) Reported by sokhapkin Patch by me ------------------------------------------------------------------------ r102968 | file | 2008-02-08 09:08:20 -0600 (Fri, 08 Feb 2008) | 4 lines Make sure the presence of dbsecret is factored into user scoring. (closes issue #11952) Reported by: bbhoss ------------------------------------------------------------------------ r103070 | mmichelson | 2008-02-08 12:00:38 -0600 (Fri, 08 Feb 2008) | 6 lines Yield the thread and return -1 if the ioctl fails for Zaptel timing device. (closes issue #11891) Reported by: tzafrir ------------------------------------------------------------------------ r103741 | russell | 2008-02-15 17:31:39 -0600 (Fri, 15 Feb 2008) | 8 lines Fix a crash in chan_iax2 due to a race condition (closes issue #11780) Reported by: guillecabeza Patches: bug_iax2_jb_1.4.patch uploaded by guillecabeza (license 380) bug_iax2_jb_trunk.patch uploaded by guillecabeza (license 380) ------------------------------------------------------------------------ r106237 | russell | 2008-03-05 16:37:09 -0600 (Wed, 05 Mar 2008) | 3 lines Fix a potential deadlock and a few different potential crashes. (closes issue #12145, reported by thiagarcia, patched by me) ------------------------------------------------------------------------ r110336 | russell | 2008-03-20 16:54:58 -0500 (Thu, 20 Mar 2008) | 14 lines Merged revisions 110335 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.2 ........ r110335 | russell | 2008-03-20 16:53:27 -0500 (Thu, 20 Mar 2008) | 6 lines Fix some very broken code that was introduced in 1.2.26 as a part of the security fix. The dnsmgr is not appropriate here. The dnsmgr takes a pointer to an address structure that a background thread continuously updates. However, in these cases, a stack variable was passed. That means that the dnsmgr thread would be continuously writing to bogus memory. ........ ------------------------------------------------------------------------ r110614 | russell | 2008-03-24 12:34:56 -0500 (Mon, 24 Mar 2008) | 2 lines Turn a NOTICE into a DEBUG message. ------------------------------------------------------------------------ r111014 | file | 2008-03-26 13:41:29 -0500 (Wed, 26 Mar 2008) | 6 lines Make sure that full video frames are sent whenever the 15 bit timestamp rolls over. (closes issue #11923) Reported by: mihai Patches: asterisk-fullvideo.patch uploaded by mihai (license 94) ------------------------------------------------------------------------ r113596 | twilson | 2008-04-08 20:34:25 -0500 (Tue, 08 Apr 2008) | 2 lines Initialize fr->cacheable to make valgrind happy ------------------------------------------------------------------------ r113784 | file | 2008-04-09 11:50:45 -0500 (Wed, 09 Apr 2008) | 4 lines If we receive an AUTHREQ from the remote server and we are unable to reply (for example they have a secret configured, but we do not) then queue a hangup frame on the Asterisk channel. This will cause the channel to hangup and a HANGUP to be sent via IAX2 to the remote side which is the proper thing to do in this scenario. (closes issue #12385) Reported by: viraptor ------------------------------------------------------------------------ r114083 | twilson | 2008-04-11 17:32:51 -0500 (Fri, 11 Apr 2008) | 7 lines Several places in the code called find_callno() (which releases the lock on the pvt structure) and then immediately locked the call and did things with it. Unfortunately, the call can disappear between the find_callno and the lock, causing Bad Stuff(tm) to happen. Added find_callno_locked() function to return the callno withtout unlocking for instances that it is needed. (issue #12400) Reported by: ztel ------------------------------------------------------------------------