Opened 7 years ago

Closed 7 years ago

#2009 closed defect (fixed)

Crash in TURN server resolution callback when ICE objects already destroyed

Reported by: nanang Owned by: bennylp
Priority: normal Milestone: release-2.7
Component: pjnath Version: trunk
Keywords: Cc:
Backport to 1.x milestone: Backported: no

Description (last modified by nanang)

There are two synchronization issues in ICE:

  1. ICE objects are destroyed while DNS resolution of TURN server is on progress, so crash will happen when the resolution callback is invoked. Stack trace:
    Exception Type:  SIGSEGV
    Exception Codes: SEGV_MAPERR at 0x321e07eb52803ca1
    Thread 17 Crashed:
    0   0x30303363 null
    1   0x10124bb40 sess_init_update + 528
    2   0x10124f9d8 turn_on_state + 1520
    3   0x101262374 turn_on_state + 112
    4   0x10125ef74 set_state + 216
    5   0x10125f74c dns_srv_resolver_cb + 64
    6   0x1011ae078 dns_callback + 3272
    7   0x1011a698c on_read_complete + 1308
  1. Race condition between PJMEDIA transport ICE's pjmedia_transport_close() and ICE stream transport's sess_init_update():
    1. sess_init_update() thread is suspended after evaluating destroy_req that is equal to PJ_FALSE
    2. pjmedia_transport_close() is invoked (from another thread, e.g: SIP or UI thread), then transport ICE is destroyed
    3. when sess_init_update() thread is resumed and invoking callback to transport ICE, crash occurs as transport ICE is destroyed already.

Thanks Qinxi Chen and Alexei Kolomiets for the report.

Change History (3)

comment:1 Changed 7 years ago by nanang

In 5583:

Re #2009: Avoid premature destroy in TURN session by incrementing group lock ref before performing async DNS resolution.

comment:2 Changed 7 years ago by nanang

  • Description modified (diff)

comment:3 Changed 7 years ago by nanang

  • Resolution set to fixed
  • Status changed from new to closed

In 5604:

Close #2009: Fixed issue no 2:

  • Synchronizing PJMEDIA transport ICE and ICE stream transport lifetime using group lock.
  • Zeroing callback pointer in ICE stream transport destructor.
  • Added few pointer validity checks.
Note: See TracTickets for help on using tickets.