Merged revisions 100465 via svnmerge from

https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r100465 | tilghman | 2008-01-27 15:59:53 -0600 (Sun, 27 Jan 2008) | 11 lines

When deleting a task from the scheduler, ignoring the return value could
possibly cause memory to be accessed after it is freed, which causes all
sorts of random memory corruption.  Instead, if a deletion fails, wait a
bit and try again (noting that another thread could change our taskid
value).
(closes issue #11386)
 Reported by: flujan
 Patches: 
       20080124__bug11386.diff.txt uploaded by Corydon76 (license 14)
 Tested by: Corydon76, flujan, stuarth`

........


git-svn-id: http://svn.digium.com/svn/asterisk/trunk@100488 f38db490-d61c-443f-a65b-d21fe96a405b

5 files changed, 91 insertions, 148 deletions

diff --git a/channels/chan_h323.c b/channels/chan_h323.c
index 61dc7c25f..bba205e91 100644
--- a/channels/chan_h323.c
+++ b/channels/chan_h323.c
@@ -368,14 +368,12 @@ static void __oh323_update_info(struct ast_channel *c, struct oh323_pvt *pvt)
 		if (pvt->newdigit == ' ') {		/* signalUpdate message */
 			f.subclass = pvt->curDTMF;
 			if (pvt->DTMFsched >= 0) {
-				ast_sched_del(sched, pvt->DTMFsched);
-				pvt->DTMFsched = -1;
+				AST_SCHED_DEL(sched, pvt->DTMFsched);
 			}
 		} else {						/* Regular input or signal message */
 			if (pvt->newduration) {		/* This is a signal, signalUpdate follows */
 				f.frametype = AST_FRAME_DTMF_BEGIN;
-				if (pvt->DTMFsched >= 0)
-					ast_sched_del(sched, pvt->DTMFsched);
+				AST_SCHED_DEL(sched, pvt->DTMFsched);
 				pvt->DTMFsched = ast_sched_add(sched, pvt->newduration, oh323_simulate_dtmf_end, pvt);
 				if (h323debug)
 					ast_log(LOG_DTMF, "Scheduled DTMF END simulation for %d ms, id=%d\n", pvt->newduration, pvt->DTMFsched);
@@ -448,10 +446,7 @@ static void __oh323_destroy(struct oh323_pvt *pvt)
 {
 	struct oh323_pvt *cur, *prev = NULL;
 
-	if (pvt->DTMFsched >= 0) {
-		ast_sched_del(sched, pvt->DTMFsched);
-		pvt->DTMFsched = -1;
-	}
+	AST_SCHED_DEL(sched, pvt->DTMFsched);
 
 	if (pvt->rtp) {
 		ast_rtp_destroy(pvt->rtp);
@@ -1846,15 +1841,11 @@ static int receive_digit(unsigned call_reference, char digit, const char *token,
 			};
 			if (digit == ' ') {		/* signalUpdate message */
 				f.subclass = pvt->curDTMF;
-				if (pvt->DTMFsched >= 0) {
-					ast_sched_del(sched, pvt->DTMFsched);
-					pvt->DTMFsched = -1;
-				}
+				AST_SCHED_DEL(sched, pvt->DTMFsched);
 			} else {				/* Regular input or signal message */
 				if (pvt->DTMFsched >= 0) {
 					/* We still don't send DTMF END from previous event, send it now */
-					ast_sched_del(sched, pvt->DTMFsched);
-					pvt->DTMFsched = -1;
+					AST_SCHED_DEL(sched, pvt->DTMFsched);
 					f.subclass = pvt->curDTMF;
 					f.samples = f.len = 0;
 					ast_queue_frame(pvt->owner, &f);
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index 200a7a17e..b2a04b502 100644
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -1155,7 +1155,7 @@ static void __send_lagrq(const void *data)
 	int callno = (long)data;
 	/* Ping only if it's real not if it's bridged */
 	ast_mutex_lock(&iaxsl[callno]);
-	if (iaxs[callno] && iaxs[callno]->lagid != -1) {
+	if (iaxs[callno] && iaxs[callno]->lagid > -1) {
 		send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_LAGRQ, 0, NULL, 0, -1);
 		iaxs[callno]->lagid = iax2_sched_add(sched, lagrq_time * 1000, send_lagrq, data);
 	}
@@ -1568,8 +1568,7 @@ static int find_callno(unsigned short callno, unsigned short dcallno, struct soc
 
 static void iax2_frame_free(struct iax_frame *fr)
 {
-	if (fr->retrans > -1)
-		ast_sched_del(sched, fr->retrans);
+	AST_SCHED_DEL(sched, fr->retrans);
 	iax_frame_free(fr);
 }
 
@@ -2040,24 +2039,12 @@ static void iax2_destroy_helper(struct chan_iax2_pvt *pvt)
 		ast_clear_flag(pvt, IAX_MAXAUTHREQ);
 	}
 	/* No more pings or lagrq's */
-	if (pvt->pingid > -1)
-		ast_sched_del(sched, pvt->pingid);
-	pvt->pingid = -1;
-	if (pvt->lagid > -1)
-		ast_sched_del(sched, pvt->lagid);
-	pvt->lagid = -1;
-	if (pvt->autoid > -1)
-		ast_sched_del(sched, pvt->autoid);
-	pvt->autoid = -1;
-	if (pvt->authid > -1)
-		ast_sched_del(sched, pvt->authid);
-	pvt->authid = -1;
-	if (pvt->initid > -1)
-		ast_sched_del(sched, pvt->initid);
-	pvt->initid = -1;
-	if (pvt->jbid > -1)
-		ast_sched_del(sched, pvt->jbid);
-	pvt->jbid = -1;
+	AST_SCHED_DEL(sched, pvt->pingid);
+	AST_SCHED_DEL(sched, pvt->lagid);
+	AST_SCHED_DEL(sched, pvt->autoid);
+	AST_SCHED_DEL(sched, pvt->authid);
+	AST_SCHED_DEL(sched, pvt->initid);
+	AST_SCHED_DEL(sched, pvt->jbid);
 }
 
 /*!
@@ -2693,8 +2680,8 @@ static void update_jbsched(struct chan_iax2_pvt *pvt)
 	when = ast_tvdiff_ms(ast_tvnow(), pvt->rxcore);
 	
 	when = jb_next(pvt->jb) - when;
-	
-	if(when <= 0) {
+
+	if (when <= 0) {
 		/* XXX should really just empty until when > 0.. */
 		when = 1;
 	}
@@ -2847,10 +2834,7 @@ static int schedule_delivery(struct iax_frame *fr, int updatehistory, int fromtr
 
 		jb_reset(iaxs[fr->callno]->jb);
 
-		if (iaxs[fr->callno]->jbid > -1)
-			ast_sched_del(sched, iaxs[fr->callno]->jbid);
-
-		iaxs[fr->callno]->jbid = -1;
+		AST_SCHED_DEL(sched, iaxs[fr->callno]->jbid);
 
 		/* deliver this frame now */
 		if (tsout)
@@ -7988,11 +7972,7 @@ retryowner:
 			}
 		}
 		if (f.frametype == AST_FRAME_IAX) {
-			if (iaxs[fr->callno]->initid > -1) {
-				/* Don't auto congest anymore since we've gotten something usefulb ack */
-				ast_sched_del(sched, iaxs[fr->callno]->initid);
-				iaxs[fr->callno]->initid = -1;
-			}
+			AST_SCHED_DEL(sched, iaxs[fr->callno]->initid);
 			/* Handle the IAX pseudo frame itself */
 			if (iaxdebug)
 				ast_debug(1, "IAX subclass %d received\n", f.subclass);
@@ -9966,9 +9946,7 @@ static struct iax2_peer *build_peer(const char *name, struct ast_variable *v, st
 					}
 				} else {
 					/* Non-dynamic.  Make sure we become that way if we're not */
-					if (peer->expire > -1)
-						ast_sched_del(sched, peer->expire);
-					peer->expire = -1;
+					AST_SCHED_DEL(sched, peer->expire);
 					ast_clear_flag(peer, IAX_DYNAMIC);
 					if (ast_dnsmgr_lookup(v->value, &peer->addr.sin_addr, &peer->dnsmgr))
 						return peer_unref(peer);
@@ -10347,8 +10325,7 @@ static void delete_users(void)
 
 	AST_LIST_LOCK(&registrations);
 	while ((reg = AST_LIST_REMOVE_HEAD(&registrations, entry))) {
-		if (reg->expire > -1)
-			ast_sched_del(sched, reg->expire);
+		AST_SCHED_DEL(sched, reg->expire);
 		if (reg->callno) {
 			ast_mutex_lock(&iaxsl[reg->callno]);
 			if (iaxs[reg->callno]) {
diff --git a/channels/chan_mgcp.c b/channels/chan_mgcp.c
index 526e8e266..3e9af5734 100644
--- a/channels/chan_mgcp.c
+++ b/channels/chan_mgcp.c
@@ -3355,9 +3355,8 @@ static int mgcpsock_read(int *id, int fd, short events, void *ignore)
 			}
 
 			/* stop retrans timer if the queue is empty */
-			if (!gw->msgs && (gw->retransid != -1)) {
-				ast_sched_del(sched, gw->retransid);
-				gw->retransid = -1;
+			if (!gw->msgs) {
+				AST_SCHED_DEL(sched, gw->retransid);
 			}
 
 			ast_mutex_unlock(&gw->msgs_lock);
@@ -3609,9 +3608,7 @@ static struct mgcp_gateway *build_gateway(char *cat, struct ast_variable *v)
 					}
 				} else {
 					/* Non-dynamic.  Make sure we become that way if we're not */
-					if (gw->expire > -1)
-						ast_sched_del(sched, gw->expire);
-					gw->expire = -1;
+					AST_SCHED_DEL(sched, gw->expire);
 					gw->dynamic = 0;
 					if (ast_get_ip(&gw->addr, v->value)) {
 						if (!gw_reload) {
diff --git a/channels/chan_misdn.c b/channels/chan_misdn.c
index a0153ef4d..ca3918620 100644
--- a/channels/chan_misdn.c
+++ b/channels/chan_misdn.c
@@ -652,7 +652,7 @@ static int misdn_tasks_add_variable (int timeout, ast_sched_cb callback, const v
 
 static void misdn_tasks_remove (int task_id)
 {
-	ast_sched_del(misdn_tasks, task_id);
+	AST_SCHED_DEL(misdn_tasks, task_id);
 }
 
 static int misdn_l1_task (const void *data)
diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 8a8ae8150..046d4abfb 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -1726,7 +1726,7 @@ static struct sip_pvt *sip_alloc(ast_string_field callid, struct sockaddr_in *si
 				 int useglobal_nat, const int intended_method);
 static int __sip_autodestruct(const void *data);
 static void sip_scheddestroy(struct sip_pvt *p, int ms);
-static void sip_cancel_destroy(struct sip_pvt *p);
+static int sip_cancel_destroy(struct sip_pvt *p);
 static struct sip_pvt *sip_destroy(struct sip_pvt *p);
 static void __sip_destroy(struct sip_pvt *p, int lockowner, int lockdialoglist);
 static void __sip_ack(struct sip_pvt *p, int seqno, int resp, int sipmethod);
@@ -2819,11 +2819,12 @@ static enum sip_result __sip_reliable_xmit(struct sip_pvt *p, int seqno, int res
 
 	if (xmitres == XMIT_ERROR) {	/* Serious network trouble, no need to try again */
 		append_history(pkt->owner, "XmitErr", "%s", pkt->is_fatal ? "(Critical)" : "(Non-critical)");
-		ast_sched_del(sched, pkt->retransid);	/* No more retransmission */
-		pkt->retransid = -1;
 		return AST_FAILURE;
-	} else
+	} else {
+		/* Schedule retransmission */
+		pkt->retransid = ast_sched_add_variable(sched, siptimer_a, retrans_pkt, pkt, 1);
 		return AST_SUCCESS;
+	}
 }
 
 /*! \brief Kill a SIP dialog (called only by the scheduler)
@@ -2889,7 +2890,9 @@ static void sip_scheddestroy(struct sip_pvt *p, int ms)
 	}
 	if (sip_debug_test_pvt(p))
 		ast_verbose("Scheduling destruction of SIP dialog '%s' in %d ms (Method: %s)\n", p->callid, ms, sip_methods[p->method].text);
-	sip_cancel_destroy(p);
+	if (sip_cancel_destroy(p))
+		ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
+
 	if (p->do_history)
 		append_history(p, "SchedDestroy", "%d ms", ms);
 	p->autokillid = ast_sched_add(sched, ms, __sip_autodestruct, dialog_ref(p));
@@ -2902,14 +2905,17 @@ static void sip_scheddestroy(struct sip_pvt *p, int ms)
  * Be careful as this also absorbs the reference - if you call it
  * from within the scheduler, this might be the last reference.
  */
-static void sip_cancel_destroy(struct sip_pvt *p)
+static int sip_cancel_destroy(struct sip_pvt *p)
 {
+	int res = 0;
 	if (p->autokillid > -1) {
-		ast_sched_del(sched, p->autokillid);
-		append_history(p, "CancelDestroy", "");
-		p->autokillid = -1;
+		if (!(res = ast_sched_del(sched, p->autokillid))) {
+			append_history(p, "CancelDestroy", "");
+			p->autokillid = -1;
+		}
 		dialog_unref(p);
 	}
+	return res;
 }
 
 /*! \brief Acknowledges receipt of a packet and stops retransmission */
@@ -2940,8 +2946,6 @@ static void __sip_ack(struct sip_pvt *p, int seqno, int resp, int sipmethod)
 			if (cur->retransid > -1) {
 				if (sipdebug)
 					ast_debug(4, "** SIP TIMER: Cancelling retransmit of packet (reply received) Retransid #%d\n", cur->retransid);
-				ast_sched_del(sched, cur->retransid);
-				cur->retransid = -1;
 			}
 			UNLINK(cur, p->packets, prev);
 			dialog_unref(cur->owner);
@@ -2985,9 +2989,8 @@ static int __sip_semi_ack(struct sip_pvt *p, int seqno, int resp, int sipmethod)
 			if (cur->retransid > -1) {
 				if (sipdebug)
 					ast_debug(4, "*** SIP TIMER: Cancelling retransmission #%d - %s (got response)\n", cur->retransid, sip_methods[sipmethod].text);
-				ast_sched_del(sched, cur->retransid);
-				cur->retransid = -1;
 			}
+			AST_SCHED_DEL(sched, cur->retransid);
 			res = 0;
 			break;
 		}
@@ -3400,10 +3403,8 @@ static void sip_destroy_peer(struct sip_peer *peer)
 	 *
 	 * NOTE: once peer is refcounted, this probably is no longer necessary.
 	 */
-	while (peer->expire > -1 && ast_sched_del(sched, peer->expire))
-		usleep(1);
-	while (peer->pokeexpire > -1 && ast_sched_del(sched, peer->pokeexpire))
-		usleep(1);
+	AST_SCHED_DEL(sched, peer->expire);
+	AST_SCHED_DEL(sched, peer->pokeexpire);
 
 	register_peer_exten(peer, FALSE);
 	ast_free_ha(peer->ha);
@@ -4105,10 +4106,8 @@ static void sip_registry_destroy(struct sip_registry *reg)
 		ast_debug(3, "Destroying active SIP dialog for registry %s@%s\n", reg->username, reg->hostname);
 		reg->call = sip_destroy(reg->call);
 	}
-	if (reg->expire > -1)
-		ast_sched_del(sched, reg->expire);
-	if (reg->timeout > -1)
-		ast_sched_del(sched, reg->timeout);
+	AST_SCHED_DEL(sched, reg->expire);
+	AST_SCHED_DEL(sched, reg->timeout);
 	ast_string_field_free_memory(reg);
 	regobjs--;
 	ast_free(reg);
@@ -4141,12 +4140,9 @@ static void __sip_destroy(struct sip_pvt *p, int lockowner, int lockdialoglist)
 
 	if (p->stateid > -1)
 		ast_extension_state_del(p->stateid, NULL);
-	if (p->initid > -1)
-		ast_sched_del(sched, p->initid);
-	if (p->waitid > -1)
-		ast_sched_del(sched, p->waitid);
-	if (p->autokillid > -1)
-		ast_sched_del(sched, p->autokillid);
+	AST_SCHED_DEL(sched, p->initid);
+	AST_SCHED_DEL(sched, p->waitid);
+	AST_SCHED_DEL(sched, p->autokillid);
 
 	if (p->rtp)
 		ast_rtp_destroy(p->rtp);
@@ -4214,8 +4210,7 @@ static void __sip_destroy(struct sip_pvt *p, int lockowner, int lockdialoglist)
 	/* remove all current packets in this dialog */
 	while((cp = p->packets)) {
 		p->packets = p->packets->next;
-		if (cp->retransid > -1)
-			ast_sched_del(sched, cp->retransid);
+		AST_SCHED_DEL(sched, cp->retransid);
 		dialog_unref(cp->owner);
 		ast_free(cp);
 	}
@@ -4544,8 +4539,8 @@ static int sip_hangup(struct ast_channel *ast)
 			update_call_counter(p, DEC_CALL_LIMIT);
 		}
 		ast_debug(4, "SIP Transfer: Not hanging up right now... Rescheduling hangup for %s.\n", p->callid);
-		if (p->autokillid > -1)
-			sip_cancel_destroy(p);
+		if (p->autokillid > -1 && sip_cancel_destroy(p))
+			ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 		sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);
 		ast_clear_flag(&p->flags[0], SIP_DEFER_BYE_ON_TRANSFER);	/* Really hang up next time */
 		p->needdestroy = 0;
@@ -4675,10 +4670,9 @@ static int sip_hangup(struct ast_channel *ast)
 				   but we can't send one while we have "INVITE" outstanding. */
 				ast_set_flag(&p->flags[0], SIP_PENDINGBYE);	
 				ast_clear_flag(&p->flags[0], SIP_NEEDREINVITE);	
-				if (p->waitid)
-					ast_sched_del(sched, p->waitid);
-				p->waitid = -1;
-				sip_cancel_destroy(p);
+				AST_SCHED_DEL(sched, p->waitid);
+				if (sip_cancel_destroy(p))
+					ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 			}
 		}
 	}
@@ -8989,7 +8983,7 @@ static int transmit_register(struct sip_registry *r, int sipmethod, const char *
 					global_reg_timeout * 1000, sip_reg_timeout, r);
 				ast_log(LOG_WARNING, "Still have a registration timeout for %s@%s (create_addr() error), %d\n", r->username, r->hostname, r->timeout);
 			} else {
-				r->timeout = ast_sched_add(sched, global_reg_timeout*1000, sip_reg_timeout, r);
+				r->timeout = ast_sched_add(sched, global_reg_timeout * 1000, sip_reg_timeout, r);
 				ast_log(LOG_WARNING, "Probably a DNS error for registration to %s@%s, trying REGISTER again (after %d seconds)\n", r->username, r->hostname, global_reg_timeout);
 			}
 			r->regattempts++;
@@ -9551,9 +9545,7 @@ static enum parse_register_result parse_register_contact(struct sip_pvt *pvt, st
 	} else if (!strcasecmp(curi, "*") || !expiry) {	/* Unregister this peer */
 		/* This means remove all registrations and return OK */
 		memset(&peer->addr, 0, sizeof(peer->addr));
-		if (peer->expire > -1)
-			ast_sched_del(sched, peer->expire);
-		peer->expire = -1;
+		AST_SCHED_DEL(sched, peer->expire);
 
 		destroy_association(peer);
 		
@@ -9610,10 +9602,7 @@ static enum parse_register_result parse_register_contact(struct sip_pvt *pvt, st
 	if (!ast_strlen_zero(curi) && ast_strlen_zero(peer->username))
 		ast_copy_string(peer->username, curi, sizeof(peer->username));
 
-	if (peer->expire > -1) {
-		ast_sched_del(sched, peer->expire);
-		peer->expire = -1;
-	}
+	AST_SCHED_DEL(sched, peer->expire);
 	if (expiry > max_expiry)
 		expiry = max_expiry;
 	if (expiry < min_expiry)
@@ -9983,8 +9972,8 @@ static int cb_extensionstate(char *context, char* exten, int state, void *data)
 	switch(state) {
 	case AST_EXTENSION_DEACTIVATED:	/* Retry after a while */
 	case AST_EXTENSION_REMOVED:	/* Extension is gone */
-		if (p->autokillid > -1)
-			sip_cancel_destroy(p);	/* Remove subscription expiry for renewals */
+		if (p->autokillid > -1 && sip_cancel_destroy(p))	/* Remove subscription expiry for renewals */
+			ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 		sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);	/* Delete subscription in 32 secs */
 		ast_verb(2, "Extension state: Watcher for hint %s %s. Notify User %s\n", exten, state == AST_EXTENSION_DEACTIVATED ? "deactivated" : "removed", p->username);
 		p->stateid = -1;
@@ -10113,7 +10102,8 @@ static enum check_auth_result register_verify(struct sip_pvt *p, struct sockaddr
 			if (ast_test_flag(&p->flags[1], SIP_PAGE2_REGISTERTRYING))
 				transmit_response(p, "100 Trying", req);
 			if (!(res = check_auth(p, req, peer->name, peer->secret, peer->md5secret, SIP_REGISTER, uri, XMIT_UNRELIABLE, req->ignore))) {
-				sip_cancel_destroy(p);
+				if (sip_cancel_destroy(p))
+					ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 
 				/* We have a successful registration attempt with proper authentication,
 				   now, update the peer */
@@ -10146,7 +10136,8 @@ static enum check_auth_result register_verify(struct sip_pvt *p, struct sockaddr
 		peer = temp_peer(name);
 		if (peer) {
 			ASTOBJ_CONTAINER_LINK(&peerl, peer);
-			sip_cancel_destroy(p);
+			if (sip_cancel_destroy(p))
+				ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 			switch (parse_register_contact(p, peer, req)) {
 			case PARSE_REGISTER_FAILED:
 				ast_log(LOG_WARNING, "Failed to parse contact info\n");
@@ -14252,11 +14243,8 @@ static void handle_response_invite(struct sip_pvt *p, int resp, char *rest, stru
 	}
 
 	/* Acknowledge sequence number - This only happens on INVITE from SIP-call */
-	if (p->initid > -1) {
-		/* Don't auto congest anymore since we've gotten something useful back */
-		ast_sched_del(sched, p->initid);
-		p->initid = -1;
-	}
+	/* Don't auto congest anymore since we've gotten something useful back */
+	AST_SCHED_DEL(sched, p->initid);
 
 	/* RFC3261 says we must treat every 1xx response (but not 100)
 	   that we don't recognize as if it was 183.
@@ -14276,15 +14264,15 @@ static void handle_response_invite(struct sip_pvt *p, int resp, char *rest, stru
 	switch (resp) {
 	case 100:	/* Trying */
 	case 101:	/* Dialog establishment */
-		if (!req->ignore && p->invitestate != INV_CANCELLED)
-			sip_cancel_destroy(p);
+		if (!req->ignore && p->invitestate != INV_CANCELLED && sip_cancel_destroy(p))
+			ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 		check_pendings(p);
 		break;
 
 	case 180:	/* 180 Ringing */
 	case 182:       /* 182 Queued */
-		if (!req->ignore && p->invitestate != INV_CANCELLED)
-			sip_cancel_destroy(p);
+		if (!req->ignore && p->invitestate != INV_CANCELLED && sip_cancel_destroy(p))
+			ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 		if (!req->ignore && p->owner) {
 			ast_queue_control(p->owner, AST_CONTROL_RINGING);
 			if (p->owner->_state != AST_STATE_UP) {
@@ -14304,8 +14292,8 @@ static void handle_response_invite(struct sip_pvt *p, int resp, char *rest, stru
 		break;
 
 	case 183:	/* Session progress */
-		if (!req->ignore && (p->invitestate != INV_CANCELLED))
-			sip_cancel_destroy(p);
+		if (!req->ignore && (p->invitestate != INV_CANCELLED) && sip_cancel_destroy(p))
+			ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 		/* Ignore 183 Session progress without SDP */
 		if (find_sdp(req)) {
 			if (p->invitestate != INV_CANCELLED)
@@ -14320,8 +14308,8 @@ static void handle_response_invite(struct sip_pvt *p, int resp, char *rest, stru
 		break;
 
 	case 200:	/* 200 OK on invite - someone's answering our call */
-		if (!req->ignore && (p->invitestate != INV_CANCELLED))
-			sip_cancel_destroy(p);
+		if (!req->ignore && (p->invitestate != INV_CANCELLED) && sip_cancel_destroy(p))
+			ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 		p->authtries = 0;
 		if (find_sdp(req)) {
 			if ((res = process_sdp(p, req)) && !req->ignore)
@@ -14670,8 +14658,7 @@ static int handle_response_register(struct sip_pvt *p, int resp, char *rest, str
 		break;
 	case 403:	/* Forbidden */
 		ast_log(LOG_WARNING, "Forbidden - wrong password on authentication for REGISTER for '%s' to '%s'\n", p->registry->username, p->registry->hostname);
-		ast_sched_del(sched, r->timeout);
-		r->timeout = -1;
+		AST_SCHED_DEL(sched, r->timeout);
 		r->regstate = REG_STATE_NOAUTH;
 		p->needdestroy = 1;
 		break;
@@ -14680,8 +14667,7 @@ static int handle_response_register(struct sip_pvt *p, int resp, char *rest, str
 		p->needdestroy = 1;
 		r->call = NULL;
 		r->regstate = REG_STATE_REJECTED;
-		ast_sched_del(sched, r->timeout);
-		r->timeout = -1;
+		AST_SCHED_DEL(sched, r->timeout);
 		break;
 	case 407:	/* Proxy auth */
 		if (p->authtries == MAX_AUTHTRIES || do_register_auth(p, req, resp)) {
@@ -14694,8 +14680,7 @@ static int handle_response_register(struct sip_pvt *p, int resp, char *rest, str
 			p->registry->regattempts = global_regattempts_max+1;
 		p->needdestroy = 1;
 		r->call = NULL;
-		ast_sched_del(sched, r->timeout);
-		r->timeout = -1;
+		AST_SCHED_DEL(sched, r->timeout);
 		break;
 	case 423:	/* Interval too brief */
 		r->expiry = atoi(get_header(req, "Min-Expires"));
@@ -14721,8 +14706,7 @@ static int handle_response_register(struct sip_pvt *p, int resp, char *rest, str
 		p->needdestroy = 1;
 		r->call = NULL;
 		r->regstate = REG_STATE_REJECTED;
-		ast_sched_del(sched, r->timeout);
-		r->timeout = -1;
+		AST_SCHED_DEL(sched, r->timeout);
 		break;
 	case 200:	/* 200 OK */
 		if (!r) {
@@ -14738,9 +14722,8 @@ static int handle_response_register(struct sip_pvt *p, int resp, char *rest, str
 		ast_debug(1, "Registration successful\n");
 		if (r->timeout > -1) {
 			ast_debug(1, "Cancelling timeout %d\n", r->timeout);
-			ast_sched_del(sched, r->timeout);
 		}
-		r->timeout=-1;
+		AST_SCHED_DEL(sched, r->timeout);
 		r->call = NULL;
 		p->registry = NULL;
 		/* Let this one hang around until we have all the responses */
@@ -14749,8 +14732,7 @@ static int handle_response_register(struct sip_pvt *p, int resp, char *rest, str
 
 		/* set us up for re-registering */
 		/* figure out how long we got registered for */
-		if (r->expire > -1)
-			ast_sched_del(sched, r->expire);
+		AST_SCHED_DEL(sched, r->expire);
 		/* according to section 6.13 of RFC, contact headers override
 		   expires headers, so check those first */
 		expires = 0;
@@ -15133,8 +15115,8 @@ static void handle_response(struct sip_pvt *p, int resp, char *rest, struct sip_
 					p->needdestroy = 1;
 			} else if ((resp >= 100) && (resp < 200)) {
 				if (sipmethod == SIP_INVITE) {
-					if (!req->ignore)
-						sip_cancel_destroy(p);
+					if (!req->ignore && sip_cancel_destroy(p))
+						ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 					if (find_sdp(req))
 						process_sdp(p, req);
 					if (p->owner) {
@@ -15232,8 +15214,8 @@ static void handle_response(struct sip_pvt *p, int resp, char *rest, struct sip_
 		default:	/* Errors without handlers */
 			if ((resp >= 100) && (resp < 200)) {
 				if (sipmethod == SIP_INVITE) { 	/* re-invite */
-					if (!req->ignore)
-						sip_cancel_destroy(p);
+					if (!req->ignore && sip_cancel_destroy(p))
+						ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 				}
 			}
 			if ((resp >= 300) && (resp < 700)) {
@@ -15246,9 +15228,9 @@ static void handle_response(struct sip_pvt *p, int resp, char *rest, struct sip_
 				case 503: /* Service Unavailable */
 				case 504: /* Server timeout */
 
-					if (sipmethod == SIP_INVITE) {	/* re-invite failed */
-						sip_cancel_destroy(p);
-					}
+					/* re-invite failed */
+					if (sipmethod == SIP_INVITE && sip_cancel_destroy(p))
+						ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 					break;
 				}
 			}
@@ -16048,7 +16030,8 @@ static int handle_request_invite(struct sip_pvt *p, struct sip_request *req, int
 	if (!req->ignore) {
 		int newcall = (p->initreq.headers ? TRUE : FALSE);
 
-		sip_cancel_destroy(p);
+		if (sip_cancel_destroy(p))
+			ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 		/* This also counts as a pending invite */
 		p->pendinginvite = seqno;
 		check_via(p, req);
@@ -17427,8 +17410,8 @@ static int handle_request_subscribe(struct sip_pvt *p, struct sip_request *req,
 			else
 				ast_debug(2, "Adding subscription for extension %s context %s for peer %s\n", p->exten, p->context, p->username);
 		}
-		if (p->autokillid > -1)
-			sip_cancel_destroy(p);	/* Remove subscription expiry for renewals */
+		if (p->autokillid > -1 && sip_cancel_destroy(p))	/* Remove subscription expiry for renewals */
+			ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 		if (p->expiry > 0)
 			sip_scheddestroy(p, (p->expiry + 10) * 1000);	/* Set timer for destruction of call at expiration */
 
@@ -18578,10 +18561,8 @@ static int sip_poke_peer(struct sip_peer *peer)
 	if (!peer->maxms || !peer->addr.sin_addr.s_addr) {
 		/* IF we have no IP, or this isn't to be monitored, return
 		  immediately after clearing things out */
-		if (peer->pokeexpire > -1)
-			ast_sched_del(sched, peer->pokeexpire);
+		AST_SCHED_DEL(sched, peer->pokeexpire);
 		peer->lastms = 0;
-		peer->pokeexpire = -1;
 		peer->call = NULL;
 		return 0;
 	}
@@ -18613,8 +18594,7 @@ static int sip_poke_peer(struct sip_peer *peer)
 	build_via(p);
 	build_callid_pvt(p);
 
-	if (peer->pokeexpire > -1)
-		ast_sched_del(sched, peer->pokeexpire);
+	AST_SCHED_DEL(sched, peer->pokeexpire);
 	p->relatedpeer = peer;
 	ast_set_flag(&p->flags[0], SIP_OUTGOING);
 #ifdef VOCAL_DATA_HACK
@@ -19563,9 +19543,7 @@ static struct sip_peer *build_peer(const char *name, struct ast_variable *v, str
 				peer->host_dynamic = TRUE;
 			} else {
 				/* Non-dynamic.  Make sure we become that way if we're not */
-				if (peer->expire > -1)
-					ast_sched_del(sched, peer->expire);
-				peer->expire = -1;
+				AST_SCHED_DEL(sched, peer->expire);
 				peer->host_dynamic = FALSE;
 				srvlookup = v->value;
 			}