id,summary,reporter,owner,description,type,status,priority,milestone,component,version,resolution,keywords,cc,backport_to_milestone,backported 1877,Race condition between stopping ICE and sending data in ICE stream transport,ming,bennylp,"Race condition between pj_ice_strans_stop_ice() and pj_ice_strans_sendto() Example scenario: {{{ 45:31.546 28834 D PJSIP: 45:31.556 pjsua_media.c .....Call 1: updating media.. 45:31.546 28834 D PJSIP: 45:31.563 pjsua_media.c ......Call 1: stream #0 (audio) unchanged. 45:31.546 28834 D PJSIP: 45:31.563 icetp00 ......Stopping ICE, reason=Remote answer doesn't support ICE 45:31.546 28834 D PJSIP: 45:31.563 icetp00 ......Destroying ICE session 0x76595fd4 }}} Called from {{{transport_ice.c: transport_media_start() -> set_no_ice() -> pj_ice_strans_stop_ice()}}} Then there's a call to {{{pj_ice_strans_sendto()}}}, backtrace below: {{{ 45:31.996 1064 1064 I DEBUG : #00 pc 00329e6e /system/lib/PJSIP.so (pj_ice_sess_send_data+25) 45:31.996 1064 1064 I DEBUG : #01 pc 0032b371 /system/lib/PJSIP.so (pj_ice_strans_sendto+76) ... 45:31.996 1064 1064 I DEBUG : #06 pc 0033f33f /system/lib/PJSIP.so (ioqueue_dispatch_read_event+290) 45:31.996 1064 1064 I DEBUG : #07 pc 0033fd9f /system/lib/PJSIP.so (pj_ioqueue_poll+448) }}} {{{pj_ice_strans_sendto()}}} tries to access the already destroyed ice session, hence resulting in crash. ",defect,closed,normal,release-2.4.5,pjnath,trunk,fixed,,,,0