Bridging: Use a ref to bridge_channel's channel to prevent crash.

There's a race condition with bridging where a bridge can be torn down
causing the bridge_channel's ast_channel to become NULL when it's still
needed. This particular case happened with attended transfers, but the
crash occurred when trying to publish a stasis message. Now, the
bridge_channel is locked, a ref to the ast_channel is obtained, and that
ref is passed down the chain.

Change-Id: Ic48715c0c041615d17d286790ae3e8c61bb28814

diff --git a/include/asterisk/bridge_channel.h b/include/asterisk/bridge_channel.h
index 4504d6bcb7da0fb3fffb6e80dc69244c97677aa4..fb2fd4f6f31fd3f5cb46194ce71d404f706ea62e 100644 (file)
--- a/include/asterisk/bridge_channel.h
+++ b/include/asterisk/bridge_channel.h
@@ -193,6 +193,20 @@ struct ast_bridge_channel {
        } stream_map;
 };
 
+/*!
+ * \brief Get a ref to the bridge_channel's ast_channel
+ *
+ * \param bridge_channel The bridge channel
+ *
+ * \note The returned channel NEEDS to be unref'd once you are done with it. In general, this
+ * function is best used when accessing the bridge_channel chan from outside of a bridging
+ * thread.
+ *
+ * \retval ref'd ast_channel on success
+ * \retval NULL otherwise
+ */
+struct ast_channel *ast_bridge_channel_get_chan(struct ast_bridge_channel *bridge_channel);
+
 /*!
  * \brief Try locking the bridge_channel.
  *

diff --git a/main/bridge.c b/main/bridge.c
index add586c3ca224300ba355fa265bdaad5047f2029..ea15d1b7a3010e64339b47e55bb4803af0a0f5da 100644 (file)
--- a/main/bridge.c
+++ b/main/bridge.c
@@ -1729,7 +1729,10 @@ int ast_bridge_join(struct ast_bridge *bridge,
        ast_channel_lock(chan);
        ast_channel_internal_bridge_channel_set(chan, NULL);
        ast_channel_unlock(chan);
+       /* Due to a race condition, we lock the bridge channel here for ast_bridge_channel_get_chan */
+       ao2_lock(bridge_channel);
        bridge_channel->chan = NULL;
+       ao2_unlock(bridge_channel);
        /* If bridge_channel->swap is not NULL then the join failed. */
        ao2_t_cleanup(bridge_channel->swap, "Bridge complete: join failed");
        bridge_channel->swap = NULL;
@@ -1798,7 +1801,10 @@ static void *bridge_channel_ind_thread(void *data)
        ast_channel_lock(chan);
        ast_channel_internal_bridge_channel_set(chan, NULL);
        ast_channel_unlock(chan);
+       /* Lock here for ast_bridge_channel_get_chan */
+       ao2_lock(bridge_channel);
        bridge_channel->chan = NULL;
+       ao2_unlock(bridge_channel);
        /* If bridge_channel->swap is not NULL then the join failed. */
        ao2_t_cleanup(bridge_channel->swap, "Bridge complete: Independent impart join failed");
        bridge_channel->swap = NULL;
@@ -1899,7 +1905,10 @@ static int bridge_impart_internal(struct ast_bridge *bridge,
                ast_channel_lock(chan);
                ast_channel_internal_bridge_channel_set(chan, NULL);
                ast_channel_unlock(chan);
+               /* Lock here for ast_bridge_channel_get_chan */
+               ao2_lock(bridge_channel);
                bridge_channel->chan = NULL;
+               ao2_unlock(bridge_channel);
                ao2_t_cleanup(bridge_channel->swap, "Bridge complete: Impart failed");
                bridge_channel->swap = NULL;
                ast_bridge_features_destroy(bridge_channel->features);
@@ -4752,14 +4761,22 @@ enum ast_transfer_result ast_bridge_transfer_attended(struct ast_channel *to_tra
 
        if (to_transferee_bridge_channel) {
                /* Take off hold if they are on hold. */
-               ast_bridge_channel_write_unhold(to_transferee_bridge_channel);
+               if (ast_bridge_channel_write_unhold(to_transferee_bridge_channel)) {
+                       ast_log(LOG_ERROR, "Transferee channel disappeared during transfer!\n");
+                       res = AST_BRIDGE_TRANSFER_FAIL;
+                       goto end;
+               }
        }
 
        if (to_target_bridge_channel) {
                const char *target_complete_sound;
 
                /* Take off hold if they are on hold. */
-               ast_bridge_channel_write_unhold(to_target_bridge_channel);
+               if (ast_bridge_channel_write_unhold(to_target_bridge_channel)) {
+                       ast_log(LOG_ERROR, "Target channel disappeared during transfer!\n");
+                       res = AST_BRIDGE_TRANSFER_FAIL;
+                       goto end;
+               }
 
                /* Is there a courtesy sound to play to the target? */
                ast_channel_lock(to_transfer_target);

diff --git a/main/bridge_channel.c b/main/bridge_channel.c
index ade98fd4f395033a9b5aedba809b46ada2c64710..3c5e87b574a5b519f073e238a6325d8c0184a25f 100644 (file)
--- a/main/bridge_channel.c
+++ b/main/bridge_channel.c
@@ -208,6 +208,17 @@ static void bridge_sync_signal(struct bridge_sync *sync_struct)
        ast_sem_post(&sync_struct->sem);
 }
 
+struct ast_channel *ast_bridge_channel_get_chan(struct ast_bridge_channel *bridge_channel)
+{
+       struct ast_channel *chan;
+
+       ao2_lock(bridge_channel);
+       chan = ao2_bump(bridge_channel->chan);
+       ao2_unlock(bridge_channel);
+
+       return chan;
+}
+
 void ast_bridge_channel_lock_bridge(struct ast_bridge_channel *bridge_channel)
 {
        struct ast_bridge *bridge;
@@ -1177,7 +1188,14 @@ int ast_bridge_channel_write_hold(struct ast_bridge_channel *bridge_channel, con
 
 int ast_bridge_channel_write_unhold(struct ast_bridge_channel *bridge_channel)
 {
-       ast_channel_publish_cached_blob(bridge_channel->chan, ast_channel_unhold_type(), NULL);
+       struct ast_channel *chan = ast_bridge_channel_get_chan(bridge_channel);
+
+       if (!chan) {
+               return -1;
+       }
+
+       ast_channel_publish_cached_blob(chan, ast_channel_unhold_type(), NULL);
+       ao2_ref(chan, -1);
 
        return ast_bridge_channel_write_control_data(bridge_channel, AST_CONTROL_UNHOLD, NULL, 0);
 }