audiobridge: fix double free of buffered packet in participant thread - #3
Open
spscream wants to merge 1 commit into
Open
audiobridge: fix double free of buffered packet in participant thread#3spscream wants to merge 1 commit into
spscream wants to merge 1 commit into
Conversation
jitter_buffer_get() only assigns jbp.data when it actually returns a packet, so a failed read leaves there the pointer to the buffered packet that was already freed at the end of a previous iteration. The PLC branch then passed that dangling bpkt to janus_audiobridge_buffer_packet_destroy() whenever it saw participant->decoder == NULL, i.e. exactly when the participant was being cleaned up concurrently: the packet got freed a second time and the process crashed inside the allocator. There is nothing to free in that branch, so drop the call; clear bpkt after every destroy and reset jbp.data before each read so that a stale pointer cannot be used again.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Что чинит
Падение janus 1.4.2 (сборка
d7811fe) сSIGSEGVвнутри аллокатора musl. Разбор core dump: креш вjanus_audiobridge_participant_threadнаg_free()изjanus_audiobridge_buffer_packet_destroy()— двойное освобождение буферизованного пакета.Механика
jitter_buffer_get()записываетpacket->dataтолько при успешном чтении (jitter.c:601). На всех неуспешных путях (в частностиjitter.c:500-504, когда буфер сброшен и в нём ничего нет) полеdataостаётся нетронутым — там лежит указатель на пакет, освобождённый в одной из предыдущих итераций цикла, потому чтоbpktпослеdestroyнигде не обнулялся.Дальше PLC-ветка, увидев
participant->decoder == NULL, звалаjanus_audiobridge_buffer_packet_destroy(bpkt)по этому висячему указателю. Условиеdecoder == NULLвозникает ровно тогда, когда параллельно идёт очистка участника (janus_audiobridge_hangup_media_internal), так что ветка гарантированно попадает в гонку.Состояние в core, подтверждающее сценарий:
jbp = {data = <освобождённый указатель>, len = 0, timestamp = 0, span = 0}—span = 0невозможен при успешном чтении (там было бы 960);jitter->reset_state = 1, всеpackets[i].data == NULL,lost_count = 0— последнее чтение ушло в ветку сброса;participant->decoder == NULL,room == NULL,muted == TRUE,encoder == NULL,display == NULL— участник в состоянии после hangup;lost_packets_gap = 14— PLC-ветка отработала ~280 мс подряд.Изменения
janus_audiobridge_buffer_packet_destroy(bpkt)в PLC-ветке — освобождать там нечего по построению;bpkt = NULLпосле каждогоdestroy;jbp.data = NULLперед каждымjitter_buffer_get().Баг присутствует и в upstream master (
4602fcc5), там не исправлен.