chan_voter: Segfault in voter_xmit if suspended too long

When getting a backtrace of a running Asterisk process using /var/lib/asterisk/scripts/ast_coredumper --RUNNING, chan_voter itself will cause a segfault and crash, suggesting that chan_voter is not tolerant of being suspended for too long. This happens consistently. Offending line appears to be AST_LIST_TRAVERSE(&p->txq, f1, frame_list) n++;.

Thread 1 (Thread 0x7f4e7614c700 (LWP 2384906)):
#0  0x00007f4e7b3c4f50 in voter_xmit (data=0x7f4eb4007040) at chan_voter.c:1659
        p = 0x7f4eb4007040
        i = 32590
        n = 1
        x = 0
        mx = 0
        dummybuf1 = {0 <repeats 16 times>, -19456, 30228, 32590, 0, 3, 0, 0, 0, -15851, -13975, 21943, 0, -19136, -17497, 32590, 0, -19136, 30228, 32590, 0, 29480, -17519, 32590, 0, -15856, -13975, 21943, 0, 3, 0, 0, 0, 3432, 0>
        xmtbuf1 = {0 <repeats 1920 times>}
        xmtbuf = {0 <repeats 160 times>}
        dummybuf2 = {0 <repeats 160 times>}
        xmtbuf2 = {0 <repeats 160 times>}
        l = 21943
        fr = {frametype = 0, subclass = {integer = 0, {format = 0x0, topology = 0x0}, frame_ending = 0}, datalen = 0, samples = 0, mallocd = 0, mallocd_hdr_len = 0, offset = 0, src = 0x0, data = {ptr = 0x0, uint32 = 0, pad = "0>
        f1 = 0xdeaddeaddeaddead
        f2 = 0x0
        f3 = 0x7f4e7614bde0
        wf1 = {frametype = 0, subclass = {integer = 0, {format = 0x0, topology = 0x0}, frame_ending = 0}, datalen = 0, samples = 0, mallocd = 0, mallocd_hdr_len = 0, offset = 0, src = 0x0, data = {ptr = 0x0, uint32 = 0, pad = ">
        client = 0x0
        client1 = 0x1ab00000020
        tv = {tv_sec = 1704320904, tv_usec = 139334}
        audiopacket = {vp = {curtime = {vtime_sec = 2296354149, vtime_nsec = 2003173376}, challenge = "314177075", digest = 826626340, payload_type = 512}, rssi = 0 '000', audio = '000' <repeats 162 times>}
        proxy_audiopacket = {vp = {curtime = {vtime_sec = 0, vtime_nsec = 0}, challenge = "000000000000000000000000000", digest = 0, payload_type = 0}, vprox = {ipaddr = 0, port = 0, payload_type = 0, flags = 0 '000', challenge>
        pingpacket = {vp = {curtime = {vtime_sec = 0, vtime_nsec = 0}, challenge = "000000000000000000000000000", digest = 0, payload_type = 0}, seqno = 0, txtime = {tv_sec = 0, tv_usec = 0}, starttime = {tv_sec = 0, tv_usec = >
        __PRETTY_FUNCTION__ = "voter_xmit"
        __FUNCTION__ = "voter_xmit"

Attempt to unlock a mutex that is now dead:

Thread 1 (Thread 0x7fb6a1b63700 (LWP 2701291)):
#0  __GI___pthread_mutex_lock (mutex=0xdeaddeaddeadea1d) at ../nptl/pthread_mutex_lock.c:67
        type = <optimized out>
        __PRETTY_FUNCTION__ = "__pthread_mutex_lock"
        id = <optimized out>
#1  0x00005639e75fb553 in ast_reentrancy_lock (lt=0xdeaddeaddeaddead) at /usr/src/asterisk-20.5.0/include/asterisk/lock.h:446
        res = 0
#2  0x00005639e75fc519 in __ast_pthread_mutex_unlock (filename=0x7fb6a6e7208c "chan_voter.c", lineno=1651, func=0x7fb6a6e75c40 <__PRETTY_FUNCTION__.30> "voter_xmit", mutex_name=0x7f>
        res = -1073656272
        lt = 0xdeaddeaddeaddead
        canlog = 1
        bt = 0x0
        __FUNCTION__ = "__ast_pthread_mutex_unlock"
#3  0x00007fb6a6e58ed7 in voter_xmit (data=0x7fb6c4011440) at chan_voter.c:1651

Possibly related - maybe not?

Thread 1 (Thread 0x7f44fd2e6700 (LWP 2634179)):
#0  framein (pvt=0x7f450c01cf30, f=0x7f44fd2e5cb0) at translate.c:410
        __FUNCTION__ = "framein"
#1  0x000055cd26a87256 in ast_translate (path=0x7f450c01cf30, f=0x7f44fd2e5cb0, consume=0) at translate.c:618
        current = 0x7f44fd2e5cb0
        p = 0x7f450c01cf30
        out = 0x7f44fd2e5cb0
        delivery = {tv_sec = 0, tv_usec = 0}
        has_timing_info = 0
        ts = 0
        len = 0
        seqno = 0
        __FUNCTION__ = "ast_translate"
#2  0x00007f45395da3d5 in voter_mix_and_send (p=0x7f450c00cbe0, maxclient=0x0, maxrssi=0) at chan_voter.c:1231
        i = 0
        j = 0
        k = 1
        x = 0
        maxprio = 21965
        haslastaudio = 0
        fr = {frametype = AST_FRAME_VOICE, subclass = {integer = 0, {format = 0x55cd2713b8f8, topology = 0x55cd2713b8f8}, frame_ending = 0}, datalen = 160, samples = 160, mallocd = 0, mallocd_hdr_len = 0, offset =>
        f1 = 0x100000000
        f2 = 0x8395f508c
        client = 0x55cd28094510
        silbuf = {-29040, 13312, 32581, 0, -8594, 22395, 32764, 0, 23456, -722, 32580, 0, -14632, 9896, 21965, 0, -15474, 26006, 0, 0, -3386, 0, 0, 0, 23552, -722, 32580, 0, -2536, 9896, 21965, 0, 24448, -722, 325>
        __FUNCTION__ = "voter_mix_and_send"
        __PRETTY_FUNCTION__ = "voter_mix_and_send"
#3  0x00007f45395ec9a1 in voter_timer (data=0x0) at chan_voter.c:3281
        timeout = -1
        t = 1704379278
        p = 0x7f450c00cbe0
        client = 0x0
        client1 = 0x0
        tv = {tv_sec = 1704379278, tv_usec = 41264}
        timingfd = 21
        __FUNCTION__ = "voter_timer"
        __PRETTY_FUNCTION__ = "voter_timer"
#4  0x000055cd26a90b3c in dummy_start (data=0x55cd27308f90) at utils.c:1607

AllStarLink / app_rpt

chan_voter: Segfault in voter_xmit if suspended too long #266