diff options
| author | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-06-03 16:10:53 +0000 |
|---|---|---|
| committer | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-06-03 16:10:53 +0000 |
| commit | 6fb5bda2e3df09a0bfa64659e631a4dc42c4dda9 (patch) | |
| tree | 0e14f1a17fd6ed223fb8e07882fa4e06b060cf85 | |
| parent | 6d60ab3b11042e52ca4492fd83c8430b2a4efa55 (diff) | |
Save the callno when we're poking, because our peer structure could change
during destruction (and thus we unlock the wrong callno, causing a
cascade failure).
(closes issue #12717)
Reported by: gewfie
Patches:
20080525__bug12717.diff.txt uploaded by Corydon76 (license 14)
Tested by: gewfie
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@120001 f38db490-d61c-443f-a65b-d21fe96a405b
| -rw-r--r-- | channels/chan_iax2.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index 738f3b729..1691f49db 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -8842,6 +8842,7 @@ static int iax2_poke_peer_cb(void *obj, void *arg, int flags) static int iax2_poke_peer(struct iax2_peer *peer, int heldcall) { + int callno; if (!peer->maxms || (!peer->addr.sin_addr.s_addr && !peer->dnsmgr)) { /* IF we have no IP without dnsmgr, or this isn't to be monitored, return immediately after clearing things out */ @@ -8851,11 +8852,13 @@ static int iax2_poke_peer(struct iax2_peer *peer, int heldcall) peer->callno = 0; return 0; } - if (peer->callno > 0) { + + /* The peer could change the callno inside iax2_destroy, since we do deadlock avoidance */ + if ((callno = peer->callno) > 0) { ast_log(LOG_NOTICE, "Still have a callno...\n"); - ast_mutex_lock(&iaxsl[peer->callno]); - iax2_destroy(peer->callno); - ast_mutex_unlock(&iaxsl[peer->callno]); + ast_mutex_lock(&iaxsl[callno]); + iax2_destroy(callno); + ast_mutex_unlock(&iaxsl[callno]); } if (heldcall) ast_mutex_unlock(&iaxsl[heldcall]); |