res_fax.c: Fix deadlock in fax_gateway_indicate_t38().

fax_gateway_indicate_t38() calls ast_indicate_data() which cannot be
called with any channel locks already held.  A deadlock can happen if the
function is operating on a local channel.

* Made fax_gateway_indicate_t38() unlock the channel before calling
ast_indicate_data() since fax_gateway_indicate_t38() is always called with
the channel locked.

* Made fax_gateway_indicate_t38() return void since nothing cared about
its return value.

ASTERISK-26203
Reported by: Etienne Lessard

ASTERISK-24822
Reported by: David Brillert

ASTERISK-22732
Reported by: Richard Mudgett

Change-Id: I701ff2d26c5fc23e0d5a48a3fd98759a9fd09407

diff --git a/res/res_fax.c b/res/res_fax.c
index 0890174c729435d21b684218db81b3d1f724e571..979b683505e2804017a2e69de45db0f0aeb366aa 100644 (file)
--- a/res/res_fax.c
+++ b/res/res_fax.c
@@ -2694,12 +2694,15 @@ static struct ast_frame *fax_gateway_detect_v21(struct fax_gateway *gateway, str
        return f;
 }
 
-static int fax_gateway_indicate_t38(struct ast_channel *chan, struct ast_channel *active, struct ast_control_t38_parameters *control_params)
+/*! \pre chan is locked on entry */
+static void fax_gateway_indicate_t38(struct ast_channel *chan, struct ast_channel *active, struct ast_control_t38_parameters *control_params)
 {
        if (active == chan) {
-               return ast_indicate_data(chan, AST_CONTROL_T38_PARAMETERS, control_params, sizeof(*control_params));
+               ast_channel_unlock(chan);
+               ast_indicate_data(chan, AST_CONTROL_T38_PARAMETERS, control_params, sizeof(*control_params));
+               ast_channel_lock(chan);
        } else {
-               return ast_queue_control_data(chan, AST_CONTROL_T38_PARAMETERS, control_params, sizeof(*control_params));
+               ast_queue_control_data(chan, AST_CONTROL_T38_PARAMETERS, control_params, sizeof(*control_params));
        }
 }