chan_sip: Destroy peers without holding peers container lock.

Due to the use of stasis_unsubscribe_and_join in the peer destructor
it is possible for a deadlock to occur when an event callback is
occurring at the same time.

This happens because the peer may be destroyed while holding the
peers container lock. If this occurs the event callback will never
be able to acquire the container lock and the unsubscribe will
never complete.

This change makes it so the peers that have been removed from the
peers container are not destroyed with the container lock held.

ASTERISK-25163 #close

Change-Id: Ic6bf1d9da4310142a4d196c45ddefb99317d9a33

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 4112e00a37489f0cf194964840a8114ad6a1b895..b29bcdc05af33e6688e3e5ffdc70950aebce9b66 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -3179,10 +3179,24 @@ static int match_and_cleanup_peer_sched(void *peerobj, void *arg, int flags)
 
 static void unlink_peers_from_tables(peer_unlink_flag_t flag)
 {
-       ao2_t_callback(peers, OBJ_NODATA | OBJ_UNLINK | OBJ_MULTIPLE,
+       struct ao2_iterator *peers_iter;
+
+       /*
+        * We must remove the ref outside of the peers container to prevent
+        * a deadlock condition when unsubscribing from stasis while it is
+        * invoking a subscription event callback.
+        */
+       peers_iter = ao2_t_callback(peers, OBJ_UNLINK | OBJ_MULTIPLE,
                match_and_cleanup_peer_sched, &flag, "initiating callback to remove marked peers");
-       ao2_t_callback(peers_by_ip, OBJ_NODATA | OBJ_UNLINK | OBJ_MULTIPLE,
+       if (peers_iter) {
+               ao2_iterator_destroy(peers_iter);
+       }
+
+       peers_iter = ao2_t_callback(peers_by_ip, OBJ_UNLINK | OBJ_MULTIPLE,
                match_and_cleanup_peer_sched, &flag, "initiating callback to remove marked peers_by_ip");
+       if (peers_iter) {
+               ao2_iterator_destroy(peers_iter);
+       }
 }
 
 /* \brief Unlink all marked peers from ao2 containers */