Opened 12 years ago

Closed 12 years ago

Last modified 12 years ago

#1604 closed defect (fixed)

Crash caused by double destructions of ICE stream transport

Reported by: nanang Owned by: bennylp
Priority: normal Milestone: release-2.1
Component: pjnath Version: trunk
Keywords: Cc:
Backport to 1.x milestone: release-1.16 Backported: yes

Description (last modified by nanang)

The double destructions can happen when two threads, executing pj_ice_strans_destroy() and ICE stream transport's sess_dec_ref(), at the same time.

Scenario:

  1. Thread 1 (worker thread) is entering sess_dec_ref() and successfully decreases the counter to zero, context switched to thread 2 before evaluating the destroy condition.
  2. Thread 2 is entering pj_ice_strans_destroy() and setting destroy_req flag to TRUE, context switched back to thread 1 again.
  3. Thread 1 sees destroy_req==TRUE, so ICE stream transport gets destroyed.
  4. Thread 2 destroy the ICE stream transport again.

Thanks Itay Bianco for the report.

Change History (4)

comment:1 Changed 12 years ago by nanang

  • Resolution set to fixed
  • Status changed from new to closed

In 4314:

Fix #1604: crash caused by double destructions in ICE stream transport.

comment:2 Changed 12 years ago by nanang

  • Description modified (diff)

comment:3 Changed 12 years ago by riza

In 4409:

Re #1604: backported to 1.x

comment:4 Changed 12 years ago by riza

  • Backported set
Note: See TracTickets for help on using tickets.