When a SIP channel is being auto-destroyed, it's possible for it to still be

in bridge code.  When that happens, we crash.  Delay the RTP destruction until
the bridge is ended.
(closes issue #11960)
 Reported by: norman
 Patches: 
       20080215__bug11960__2.diff.txt uploaded by Corydon76 (license 14)
 Tested by: norman


git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@103780 f38db490-d61c-443f-a65b-d21fe96a405b

2 files changed, 32 insertions, 12 deletions

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index d3baa8d3f..9e038b8cf 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -3064,6 +3064,21 @@ static void __sip_destroy(struct sip_pvt *p, int lockowner)
 			ast_log(LOG_DEBUG, "This call did not properly clean up call limits. Call ID %s\n", p->callid);
 	}
 
+	/* Unlink us from the owner if we have one */
+	if (p->owner) {
+		if (lockowner)
+			ast_channel_lock(p->owner);
+		if (option_debug)
+			ast_log(LOG_DEBUG, "Detaching from %s\n", p->owner->name);
+		p->owner->tech_pvt = NULL;
+		/* Make sure that the channel knows its backend is going away */
+		p->owner->_softhangup |= AST_SOFTHANGUP_DEV;
+		if (lockowner)
+			ast_channel_unlock(p->owner);
+		/* Give the channel a chance to react before deallocation */
+		usleep(1);
+	}
+
 	/* Remove link from peer to subscription of MWI */
 	if (p->relatedpeer && p->relatedpeer->mwipvt)
 		p->relatedpeer->mwipvt = NULL;
@@ -3080,10 +3095,17 @@ static void __sip_destroy(struct sip_pvt *p, int lockowner)
 	AST_SCHED_DEL(sched, p->waitid);
 	AST_SCHED_DEL(sched, p->autokillid);
 
-	if (p->rtp)
+	/* We absolutely cannot destroy the rtp struct while a bridge is active or we WILL crash */
+	if (p->rtp) {
+		while (ast_rtp_get_bridged(p->rtp))
+			usleep(1);
 		ast_rtp_destroy(p->rtp);
-	if (p->vrtp)
+	}
+	if (p->vrtp) {
+		while (ast_rtp_get_bridged(p->vrtp))
+			usleep(1);
 		ast_rtp_destroy(p->vrtp);
+	}
 	if (p->udptl)
 		ast_udptl_destroy(p->udptl);
 	if (p->refer)
@@ -3098,16 +3120,6 @@ static void __sip_destroy(struct sip_pvt *p, int lockowner)
 		ASTOBJ_UNREF(p->registry, sip_registry_destroy);
 	}
 
-	/* Unlink us from the owner if we have one */
-	if (p->owner) {
-		if (lockowner)
-			ast_channel_lock(p->owner);
-		if (option_debug)
-			ast_log(LOG_DEBUG, "Detaching from %s\n", p->owner->name);
-		p->owner->tech_pvt = NULL;
-		if (lockowner)
-			ast_channel_unlock(p->owner);
-	}
 	/* Clear history */
 	if (p->history) {
 		struct sip_history *hist;
diff --git a/main/rtp.c b/main/rtp.c
index 949dd1cc8..a1aa2985f 100644
--- a/main/rtp.c
+++ b/main/rtp.c
@@ -3266,6 +3266,14 @@ enum ast_bridge_result ast_rtp_bridge(struct ast_channel *c0, struct ast_channel
 		ast_channel_lock(c0);
 	}
 
+	/* Ensure neither channel got hungup during lock avoidance */
+	if (ast_check_hangup(c0) || ast_check_hangup(c1)) {
+		ast_log(LOG_WARNING, "Got hangup while attempting to bridge '%s' and '%s'\n", c0->name, c1->name);
+		ast_channel_unlock(c0);
+		ast_channel_unlock(c1);
+		return AST_BRIDGE_FAILED;
+	}
+		
 	/* Find channel driver interfaces */
 	if (!(pr0 = get_proto(c0))) {
 		ast_log(LOG_WARNING, "Can't find native functions for channel '%s'\n", c0->name);