Give zombies a safe channel driver to use.

Recent crashes from zombie channels suggests that they need a safe home to
goto.  When a masquerade happens, the physical part of the zombie channel
is hungup.  The hangup normally sets the channel private pointer to NULL.
If someone then blindly does a callback to the channel driver, a crash is
likely because the private pointer is NULL.

The masquerade now sets the channel technology of zombie channels to the
kill channel driver.

Related to the following issues:
(issue #19116)
(issue #19310)

Review: https://reviewboard.asterisk.org/r/1224/

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@320796 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/include/asterisk/channel.h b/include/asterisk/channel.h
index 72404574b05a3872ebb73ca743864e574199347e..f887ca913d09341a97f727ca1e710286c188866f 100644 (file)
--- a/include/asterisk/channel.h
+++ b/include/asterisk/channel.h
@@ -629,6 +629,9 @@ struct ast_channel_tech {
        int (* cc_callback)(struct ast_channel *inbound, const char *dest, ast_cc_callback_fn callback);
 };
 
+/*! Kill the channel channel driver technology descriptor. */
+extern const struct ast_channel_tech ast_kill_tech;
+
 struct ast_epoll_data;
 
 /*!

diff --git a/main/channel.c b/main/channel.c
index 3396baf25446517f0595a7fa7dcb89554e42ca02..a2b8a4a9e0f966f804fc367295b86f938820c379 100644 (file)
--- a/main/channel.c
+++ b/main/channel.c
@@ -612,6 +612,56 @@ static struct ast_cli_entry cli_channel[] = {
        AST_CLI_DEFINE(handle_cli_core_show_channeltype,  "Give more details on that channel type")
 };
 
+static struct ast_frame *kill_read(struct ast_channel *chan)
+{
+       /* Hangup channel. */
+       return NULL;
+}
+
+static struct ast_frame *kill_exception(struct ast_channel *chan)
+{
+       /* Hangup channel. */
+       return NULL;
+}
+
+static int kill_write(struct ast_channel *chan, struct ast_frame *frame)
+{
+       /* Hangup channel. */
+       return -1;
+}
+
+static int kill_fixup(struct ast_channel *oldchan, struct ast_channel *newchan)
+{
+       /* No problem fixing up the channel. */
+       return 0;
+}
+
+static int kill_hangup(struct ast_channel *chan)
+{
+       chan->tech_pvt = NULL;
+       return 0;
+}
+
+/*!
+ * \brief Kill the channel channel driver technology descriptor.
+ *
+ * \details
+ * The purpose of this channel technology is to encourage the
+ * channel to hangup as quickly as possible.
+ *
+ * \note Used by DTMF atxfer and zombie channels.
+ */
+const struct ast_channel_tech ast_kill_tech = {
+       .type = "Kill",
+       .description = "Kill channel (should not see this)",
+       .capabilities = -1,
+       .read = kill_read,
+       .exception = kill_exception,
+       .write = kill_write,
+       .fixup = kill_fixup,
+       .hangup = kill_hangup,
+};
+
 #ifdef CHANNEL_TRACE
 /*! \brief Destructor for the channel trace datastore */
 static void ast_chan_trace_destroy_cb(void *data)
@@ -6415,6 +6465,12 @@ int ast_do_masquerade(struct ast_channel *original)
                goto done;
        }
 
+       /*
+        * We just hung up the physical side of the channel.  Set the
+        * new zombie to use the kill channel driver for safety.
+        */
+       clonechan->tech = &ast_kill_tech;
+
        /* Mangle the name of the clone channel */
        snprintf(zombn, sizeof(zombn), "%s<ZOMBIE>", orig); /* quick, hide the brains! */
        __ast_change_name_nolink(clonechan, zombn);

diff --git a/main/features.c b/main/features.c
index b20d5b41e8c83e0cc2b835db2b1dc04b48e8f8eb..07af47eece5261a26dbdc8a4d49e34bfb466066d 100644 (file)
--- a/main/features.c
+++ b/main/features.c
@@ -469,59 +469,16 @@ struct ast_dial_features {
        int is_caller;
 };
 
-#if defined(ATXFER_NULL_TECH)
-static struct ast_frame *null_read(struct ast_channel *chan)
-{
-       /* Hangup channel. */
-       return NULL;
-}
-
-static struct ast_frame *null_exception(struct ast_channel *chan)
-{
-       /* Hangup channel. */
-       return NULL;
-}
-
-static int null_write(struct ast_channel *chan, struct ast_frame *frame)
-{
-       /* Hangup channel. */
-       return -1;
-}
-
-static int null_fixup(struct ast_channel *oldchan, struct ast_channel *newchan)
-{
-       /* No problem fixing up the channel. */
-       return 0;
-}
-
-static int null_hangup(struct ast_channel *chan)
-{
-       chan->tech_pvt = NULL;
-       return 0;
-}
-
-static const struct ast_channel_tech null_tech = {
-       .type = "NULL",
-       .description = "NULL channel driver for atxfer",
-       .capabilities = -1,
-       .read = null_read,
-       .exception = null_exception,
-       .write = null_write,
-       .fixup = null_fixup,
-       .hangup = null_hangup,
-};
-#endif /* defined(ATXFER_NULL_TECH) */
-
 #if defined(ATXFER_NULL_TECH)
 /*!
  * \internal
- * \brief Set the channel technology to the NULL technology.
+ * \brief Set the channel technology to the kill technology.
  *
  * \param chan Channel to change technology.
  *
  * \return Nothing
  */
-static void set_null_chan_tech(struct ast_channel *chan)
+static void set_kill_chan_tech(struct ast_channel *chan)
 {
        int idx;
 
@@ -538,8 +495,8 @@ static void set_null_chan_tech(struct ast_channel *chan)
                chan->tech_pvt = NULL;
        }
 
-       /* Install the NULL technology and wake up anyone waiting on it. */
-       chan->tech = &null_tech;
+       /* Install the kill technology and wake up anyone waiting on it. */
+       chan->tech = &ast_kill_tech;
        for (idx = 0; idx < AST_MAX_FDS; ++idx) {
                switch (idx) {
                case AST_ALERT_FD:
@@ -3115,7 +3072,7 @@ static struct ast_channel *feature_request_and_dial(struct ast_channel *caller,
                                 * Get rid of caller's physical technology so it is free for
                                 * other calls.
                                 */
-                               set_null_chan_tech(caller);
+                               set_kill_chan_tech(caller);
 #endif /* defined(ATXFER_NULL_TECH) */
                        } else {
                                /* caller is not hungup so monitor it. */