diff options
| author | mnicholson <mnicholson@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-09-17 14:58:39 +0000 |
|---|---|---|
| committer | mnicholson <mnicholson@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-09-17 14:58:39 +0000 |
| commit | a464816f6c27b208cbaf997a3dd24add3fa6bac3 (patch) | |
| tree | 37966b79e2f86dffd64ad6718586e932d97149af /main | |
| parent | a4ba40ed053eeace7aeec7ea7677cfe4ab6b1af2 (diff) | |
Prevent a potential race condition and crash when hanging up a channel by removing the channel from the channel list before begining channel tear down.
This fix may potentially cause problems with CDR backends that access the channel a CDR is associated with via the channel list. This fix makes the channel unavabile at the time when the CDR backend is invoked. This has been documented in include/asterisk/cdr.h.
(closes issue #15316)
Reported by: vmarrone
Tested by: mnicholson
Review: https://reviewboard.asterisk.org/r/362/
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@219136 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'main')
| -rw-r--r-- | main/channel.c | 34 |
1 files changed, 26 insertions, 8 deletions
diff --git a/main/channel.c b/main/channel.c index db4fd62c8..a674e0a16 100644 --- a/main/channel.c +++ b/main/channel.c @@ -868,6 +868,8 @@ alertpipe_failed: tmp->tech = &null_tech; + ast_set_flag(tmp, AST_FLAG_IN_CHANNEL_LIST); + AST_LIST_LOCK(&channels); AST_LIST_INSERT_HEAD(&channels, tmp, chan_list); AST_LIST_UNLOCK(&channels); @@ -1247,17 +1249,22 @@ void ast_channel_free(struct ast_channel *chan) struct varshead *headp; struct ast_datastore *datastore = NULL; char name[AST_CHANNEL_NAME], *dashptr; + int inlist; headp=&chan->varshead; - AST_LIST_LOCK(&channels); - if (!AST_LIST_REMOVE(&channels, chan, chan_list)) { - ast_log(LOG_ERROR, "Unable to find channel in list to free. Assuming it has already been done.\n"); + inlist = ast_test_flag(chan, AST_FLAG_IN_CHANNEL_LIST); + if (inlist) { + AST_LIST_LOCK(&channels); + if (!AST_LIST_REMOVE(&channels, chan, chan_list)) { + if (option_debug) + ast_log(LOG_DEBUG, "Unable to find channel in list to free. Assuming it has already been done.\n"); + } + /* Lock and unlock the channel just to be sure nobody has it locked still + due to a reference retrieved from the channel list. */ + ast_channel_lock(chan); + ast_channel_unlock(chan); } - /* Lock and unlock the channel just to be sure nobody has it locked still - due to a reference retrieved from the channel list. */ - ast_channel_lock(chan); - ast_channel_unlock(chan); /* Get rid of each of the data stores on the channel */ while ((datastore = AST_LIST_REMOVE_HEAD(&chan->datastores, entry))) @@ -1328,7 +1335,8 @@ void ast_channel_free(struct ast_channel *chan) ast_string_field_free_memory(chan); free(chan); - AST_LIST_UNLOCK(&channels); + if (inlist) + AST_LIST_UNLOCK(&channels); ast_device_state_changed_literal(name); } @@ -1515,6 +1523,16 @@ int ast_hangup(struct ast_channel *chan) ast_channel_unlock(chan); return 0; } + ast_channel_unlock(chan); + + AST_LIST_LOCK(&channels); + if (!AST_LIST_REMOVE(&channels, chan, chan_list)) { + ast_log(LOG_ERROR, "Unable to find channel in list to free. Assuming it has already been done.\n"); + } + ast_clear_flag(chan, AST_FLAG_IN_CHANNEL_LIST); + AST_LIST_UNLOCK(&channels); + + ast_channel_lock(chan); free_translation(chan); /* Close audio stream */ if (chan->stream) { |