kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-03 19:16:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Bridging: Use a ref to bridge_channel's channel to prevent crash.

Browse Source 
There's a race condition with bridging where a bridge can be torn down
causing the bridge_channel's ast_channel to become NULL when it's still
needed. This particular case happened with attended transfers, but the
crash occurred when trying to publish a stasis message. Now, the
bridge_channel is locked, a ref to the ast_channel is obtained, and that
ref is passed down the chain.

Change-Id: Ic48715c0c041615d17d286790ae3e8c61bb28814
This commit is contained in:
Ben Ford
2020-08-31 11:14:20 -05:00
committed by Friendly Automation
parent f589985840
commit 7eaae4e7b6
3 changed files with 52 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
main/bridge.c
View File

@@ -1729,7 +1729,10 @@ int ast_bridge_join(struct ast_bridge *bridge,
ast_channel_lock(chan);
ast_channel_internal_bridge_channel_set(chan, NULL);
ast_channel_unlock(chan);
/* Due to a race condition, we lock the bridge channel here for ast_bridge_channel_get_chan */
ao2_lock(bridge_channel);
bridge_channel->chan = NULL;
ao2_unlock(bridge_channel);
/* If bridge_channel->swap is not NULL then the join failed. */
ao2_t_cleanup(bridge_channel->swap, "Bridge complete: join failed");
bridge_channel->swap = NULL;
@@ -1798,7 +1801,10 @@ static void *bridge_channel_ind_thread(void *data)
ast_channel_lock(chan);
ast_channel_internal_bridge_channel_set(chan, NULL);
ast_channel_unlock(chan);
/* Lock here for ast_bridge_channel_get_chan */
ao2_lock(bridge_channel);
bridge_channel->chan = NULL;
ao2_unlock(bridge_channel);
/* If bridge_channel->swap is not NULL then the join failed. */
ao2_t_cleanup(bridge_channel->swap, "Bridge complete: Independent impart join failed");
bridge_channel->swap = NULL;
@@ -1899,7 +1905,10 @@ static int bridge_impart_internal(struct ast_bridge *bridge,
ast_channel_lock(chan);
ast_channel_internal_bridge_channel_set(chan, NULL);
ast_channel_unlock(chan);
/* Lock here for ast_bridge_channel_get_chan */
ao2_lock(bridge_channel);
bridge_channel->chan = NULL;
ao2_unlock(bridge_channel);
ao2_t_cleanup(bridge_channel->swap, "Bridge complete: Impart failed");
bridge_channel->swap = NULL;
ast_bridge_features_destroy(bridge_channel->features);
@@ -4752,14 +4761,22 @@ enum ast_transfer_result ast_bridge_transfer_attended(struct ast_channel *to_tra
if (to_transferee_bridge_channel) {
/* Take off hold if they are on hold. */
ast_bridge_channel_write_unhold(to_transferee_bridge_channel);
if (ast_bridge_channel_write_unhold(to_transferee_bridge_channel)) {
ast_log(LOG_ERROR, "Transferee channel disappeared during transfer!\n");
res = AST_BRIDGE_TRANSFER_FAIL;
goto end;
}
}
if (to_target_bridge_channel) {
const char *target_complete_sound;
/* Take off hold if they are on hold. */
ast_bridge_channel_write_unhold(to_target_bridge_channel);
if (ast_bridge_channel_write_unhold(to_target_bridge_channel)) {
ast_log(LOG_ERROR, "Target channel disappeared during transfer!\n");
res = AST_BRIDGE_TRANSFER_FAIL;
goto end;
}
/* Is there a courtesy sound to play to the target? */
ast_channel_lock(to_transfer_target);