-
Notifications
You must be signed in to change notification settings - Fork 2.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
janus crashed in janus_ice_nacked_packet_cleanup #2381
Comments
we setup janus server in chain, and customer connect the server in Europe for test. |
IIRC we fixed a similar (maybe the same) issue months ago. |
Any update? |
@atoppi, i used v0.9.3, but i checked the the code of recent version too, it's easy to find the PR if we review the code of ice.c line 2718 as i described above.
|
I understand what can go wrong in the described scenario but we still need a trace from master or freshly tagged version. |
Also don't forget to provide a libasan trace (that will catch any use after free before a SIGSEGV). |
What's libasan trace? do you mean coredump file with master version to reproduce it? : ) |
Got it, i solve this issue on my own branch, i will consider provide libasan trace follow the guide when i have spare time, BTW we can review MASTER version of this project to check it and skip so much work on reproduce. |
If you have a fix, please consider submitting a pull request. |
@zhiyong0804 any update on this? |
sorry for late update. |
@zhiyong0804 are you using static |
yes, i config event_loops=8, janus_ice_nacked_packet_cleanup function refrence ice handle, but donot increase ice handle ref, so when ice handle freed, when nack timer timeout and call janus_ice_nacked_packet_cleanup, it will core dump since wild pointer. |
Ok, this explains why a loop is still active after a handle detach, now it's starting to make sense: when using static event loops, the loops are never actually stopped. |
@zhiyong0804 do you have some instructions on how to replicate the problem? Meanwhile, would you please also provide a libasan call stack from janus master ? |
@atoppi i got you said, we setup janus server in chain, and some develop guys connect Janus from Europe, and attach videoroom plugin to share desktop with my team member, and there is very low probability to reproduce it, i advise you disconnect janus when packet loss to reproduce it. our Europe dev guys leave my team so i am hard to provide libasam call stack, maybe you can send test tool to me, and i try to connect your janus server to reproduce it via your test tool. |
I don't think it will be of much help. |
@zhiyong0804 could you please enable refcount debugging by un-commenting |
@zhiyong0804 any update? |
closing for lack of feedback, feel free to re-open if you have further details. |
janus crashed since ice handle freed, but the nack cleanup timer try to clean nack packets after 5 sec with wild pointer of ice handle
ice.c line 2718 : create nack packets clean timer, malloc janus_ice_nacked_packet packet, and reference ice handle, but under weak network, after ice handle freed 5 sec, the janus_ice_nacked_packet_cleanup function still use ice handle to free nack packe with wild pointer.
The text was updated successfully, but these errors were encountered: