Merged revisions 206707 via svnmerge from

https://origsvn.digium.com/svn/asterisk/trunk

................
  r206707 | rmudgett | 2009-07-15 16:14:41 -0500 (Wed, 15 Jul 2009) | 33 lines

  Merged revisions 206706 via svnmerge from
  https://origsvn.digium.com/svn/asterisk/branches/1.4

  ................
    r206706 | rmudgett | 2009-07-15 15:44:55 -0500 (Wed, 15 Jul 2009) | 26 lines

    Merged revision 206700 from
    https://origsvn.digium.com/svn/asterisk/be/branches/C.2-...

    ..........
      Fixed chan_misdn crash because mISDNuser library is not thread safe.

      With Asterisk the mISDNuser library is driven by two threads concurrently:
      1. channels/misdn/isdn_lib.c::manager_event_handler()
      2. channels/misdn/isdn_lib.c::misdn_lib_isdn_event_catcher()

      Calls into the library are done concurrently and recursively from
      isdn_lib.c.

      Both threads can fiddle with the master/child layer3_proc_t lists.  One
      thread may traverse the list when the other interrupts it and then removes
      the list element which the first thread was currently handling.  This is
      exactly what caused the crash.  About 60 calls were needed to a Gigaset
      CX475 before it occurred once.

      This patch adds locking when calling into the mISDNuser library.
      This also fixes some cb_log calls with wrong port parameter.

      JIRA ABE-1913
          Patches: misdn-locking.patch (Modified with mostly cosmetic changes)
    ..........
  ................
................

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.1@206764 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/misdn/isdn_lib.c b/channels/misdn/isdn_lib.c
index 9a89cc923b0f9280a26433c735c098fb091a0b9d..617355df61480e13a60731b393d0f01d174a3cc0 100644 (file)
--- a/channels/misdn/isdn_lib.c
+++ b/channels/misdn/isdn_lib.c
@@ -803,9 +803,10 @@ static int misdn_lib_get_l2_down(struct misdn_stack *stack)
                /* L2 */
                dmsg = create_l2msg(DL_RELEASE| REQUEST, 0, 0);
                
+               pthread_mutex_lock(&stack->nstlock);
                if (stack->nst.manager_l3(&stack->nst, dmsg))
                        free_msg(dmsg);
-               
+               pthread_mutex_unlock(&stack->nstlock);
        } else {
                iframe_t act;
                
@@ -844,9 +845,10 @@ int misdn_lib_get_l2_up(struct misdn_stack *stack)
                /* L2 */
                dmsg = create_l2msg(DL_ESTABLISH | REQUEST, 0, 0);
                
+               pthread_mutex_lock(&stack->nstlock);
                if (stack->nst.manager_l3(&stack->nst, dmsg))
                        free_msg(dmsg);
-               
+               pthread_mutex_unlock(&stack->nstlock);
        } else {
                iframe_t act;
                
@@ -1346,6 +1348,7 @@ struct misdn_stack* stack_init( int midev, int port, int ptp )
                        stack->nst.l2_id = stack->upper_id;
                        
                        msg_queue_init(&stack->nst.down_queue);
+                       pthread_mutex_init(&stack->nstlock, NULL);
                        
                        Isdnl2Init(&stack->nst);
                        Isdnl3Init(&stack->nst);
@@ -1387,6 +1390,7 @@ void stack_destroy(struct misdn_stack* stack)
        if (!stack) return;
 
        if (stack->nt) {
+               pthread_mutex_destroy(&stack->nstlock);
                cleanup_Isdnl2(&stack->nst);
                cleanup_Isdnl3(&stack->nst);
        }
@@ -1823,17 +1827,22 @@ handle_event_nt(void *dat, void *arg)
        manager_t *mgr = (manager_t *)dat;
        msg_t *msg = (msg_t *)arg;
        mISDNuser_head_t *hh;
+       struct misdn_stack *stack;
        int reject=0;
 
-       struct misdn_stack *stack=find_stack_by_mgr(mgr);
-       int port;
-
        if (!msg || !mgr)
                return(-EINVAL);
 
+       stack = find_stack_by_mgr(mgr);
        hh=(mISDNuser_head_t*)msg->data;
-       port=stack->port;
-       
+
+       /*
+        * When we are called from the mISDNuser lib, the nstlock is held and it
+        * must be held when we return.  We unlock here because the lib may be
+        * entered again recursively.
+        */
+       pthread_mutex_unlock(&stack->nstlock);
+
        cb_log(5, stack->port, " --> lib: prim %x dinfo %x\n",hh->prim, hh->dinfo);
        {
                switch(hh->prim){
@@ -1852,6 +1861,7 @@ handle_event_nt(void *dat, void *arg)
                                msg_t *dmsg;
                                cb_log(4, stack->port, "Patch from MEIDANIS:Sending RELEASE_COMPLETE %x (No free Chan for you..)\n", hh->dinfo);
                                dmsg = create_l3msg(CC_RELEASE_COMPLETE | REQUEST,MT_RELEASE_COMPLETE, hh->dinfo,sizeof(RELEASE_COMPLETE_t), 1);
+                               pthread_mutex_lock(&stack->nstlock);
                                stack->nst.manager_l3(&stack->nst, dmsg);
                                free_msg(msg);
                                return 0;
@@ -1883,12 +1893,16 @@ handle_event_nt(void *dat, void *arg)
                        int l3id = *((int *)(((u_char *)msg->data)+ mISDNUSER_HEAD_SIZE));
                        cb_log(4, stack->port, " --> lib: Event_ind:SETUP CONFIRM [NT] : new L3ID  is %x\n",l3id );
        
-                       if (!bc) { cb_log(4, stack->port, "Bc Not found (after SETUP CONFIRM)\n"); return 0; }
-                       cb_log (2,bc->port,"I IND :CC_SETUP|CONFIRM: old l3id:%x new l3id:%x\n", bc->l3_id, l3id);
-                       bc->l3_id=l3id;
-                       cb_event(EVENT_NEW_L3ID, bc, glob_mgr->user_data);
+                       if (bc) {
+                               cb_log (2, bc->port, "I IND :CC_SETUP|CONFIRM: old l3id:%x new l3id:%x\n", bc->l3_id, l3id);
+                               bc->l3_id = l3id;
+                               cb_event(EVENT_NEW_L3ID, bc, glob_mgr->user_data);
+                       } else {
+                               cb_log(4, stack->port, "Bc Not found (after SETUP CONFIRM)\n");
+                       }
                }
                free_msg(msg);
+               pthread_mutex_lock(&stack->nstlock);
                return 0;
       
                case CC_SETUP|INDICATION:
@@ -1900,6 +1914,7 @@ handle_event_nt(void *dat, void *arg)
                                msg_t *dmsg;
                                cb_log(4, stack->port, "Patch from MEIDANIS:Sending RELEASE_COMPLETE %x (No free Chan for you..)\n", hh->dinfo);
                                dmsg = create_l3msg(CC_RELEASE_COMPLETE | REQUEST,MT_RELEASE_COMPLETE, hh->dinfo,sizeof(RELEASE_COMPLETE_t), 1);
+                               pthread_mutex_lock(&stack->nstlock);
                                stack->nst.manager_l3(&stack->nst, dmsg);
                                free_msg(msg);
                                return 0;
@@ -1956,6 +1971,7 @@ handle_event_nt(void *dat, void *arg)
                        msg_t *dmsg;
                        cb_log(4, stack->port, " --> Got Suspend, sending Reject for now\n");
                        dmsg = create_l3msg(CC_SUSPEND_REJECT | REQUEST,MT_SUSPEND_REJECT, hh->dinfo,sizeof(RELEASE_COMPLETE_t), 1);
+                       pthread_mutex_lock(&stack->nstlock);
                        stack->nst.manager_l3(&stack->nst, dmsg);
                        free_msg(msg);
                        return 0;
@@ -1981,6 +1997,7 @@ handle_event_nt(void *dat, void *arg)
                case CC_RELEASE_CR|INDICATION:
                        release_cr(stack, hh);
                        free_msg(msg);
+                       pthread_mutex_lock(&stack->nstlock);
                        return 0 ;
                break;
       
@@ -1990,7 +2007,11 @@ handle_event_nt(void *dat, void *arg)
                {
                        struct misdn_bchannel *bc=find_bc_by_l3id(stack, hh->dinfo);
                        int l3id = *((int *)(((u_char *)msg->data)+ mISDNUSER_HEAD_SIZE));
-                       if (!bc) { cb_log(0, stack->port, " --> In NEW_CR: didn't found bc ??\n"); return -1;};
+                       if (!bc) {
+                               cb_log(0, stack->port, " --> In NEW_CR: didn't found bc ??\n");
+                               pthread_mutex_lock(&stack->nstlock);
+                               return -1;
+                       }
                        if (((l3id&0xff00)!=0xff00) && ((bc->l3_id&0xff00)==0xff00)) {
                                cb_log(4, stack->port, " --> Removing Process Id:%x on this port.\n", 0xff&bc->l3_id);
                                stack->procids[bc->l3_id&0xff] = 0 ;
@@ -2001,6 +2022,7 @@ handle_event_nt(void *dat, void *arg)
                        cb_event(EVENT_NEW_L3ID, bc, glob_mgr->user_data);
        
                        free_msg(msg);
+                       pthread_mutex_lock(&stack->nstlock);
                        return 0;
                }
       
@@ -2027,6 +2049,7 @@ handle_event_nt(void *dat, void *arg)
                        stack->l2upcnt=0;
                        
                        free_msg(msg);
+                       pthread_mutex_lock(&stack->nstlock);
                        return 0;
                }
                break;
@@ -2055,6 +2078,7 @@ handle_event_nt(void *dat, void *arg)
                        
                        stack->l2link = 0;
                        free_msg(msg);
+                       pthread_mutex_lock(&stack->nstlock);
                        return 0;
                }
                break;
@@ -2128,6 +2152,7 @@ handle_event_nt(void *dat, void *arg)
        }
 
 
+       pthread_mutex_lock(&stack->nstlock);
        return 0;
 }
 
@@ -2170,7 +2195,9 @@ static int handle_timers(msg_t* msg)
                                ret = mISDN_write_frame(stack->midev, msg->data, frm->addr,
                                                        MGR_TIMER | RESPONSE, 0, 0, NULL, TIMEOUT_1SEC);
                                test_and_clear_bit(FLG_TIMER_RUNING, (long unsigned int *)&it->Flags);
+                               pthread_mutex_lock(&stack->nstlock);
                                ret = it->function(it->data);
+                               pthread_mutex_unlock(&stack->nstlock);
                                free_msg(msg);
                                return 1;
                        }
@@ -2586,8 +2613,9 @@ static int handle_frm_nt(msg_t *msg)
        }
 
        
+       pthread_mutex_lock(&stack->nstlock);
        if ((err=stack->nst.l1_l2(&stack->nst,msg))) {
-    
+               pthread_mutex_unlock(&stack->nstlock);
                if (nt_err_cnt > 0 ) {
                        if (nt_err_cnt < 100) {
                                nt_err_cnt++; 
@@ -2599,9 +2627,8 @@ static int handle_frm_nt(msg_t *msg)
                }
                free_msg(msg);
                return 1;
-               
        }
-       
+       pthread_mutex_unlock(&stack->nstlock);
        return 1;
 }
 
@@ -2779,8 +2806,10 @@ static int handle_l1(msg_t *msg)
                
                if (stack->nt) {
                        
+                       pthread_mutex_lock(&stack->nstlock);
                        if (stack->nst.l1_l2(&stack->nst, msg))
                                free_msg(msg);
+                       pthread_mutex_unlock(&stack->nstlock);
 
                        if (stack->ptp)
                                misdn_lib_get_l2_up(stack);
@@ -2821,8 +2850,10 @@ static int handle_l1(msg_t *msg)
 #endif
                
                if (stack->nt) {
+                       pthread_mutex_lock(&stack->nstlock);
                        if (stack->nst.l1_l2(&stack->nst, msg))
                                free_msg(msg);
+                       pthread_mutex_unlock(&stack->nstlock);
                } else {
                        free_msg(msg);
                }
@@ -2911,16 +2942,16 @@ static int handle_mgmt(msg_t *msg)
        switch(frm->prim) {
        case MGR_SHORTSTATUS | INDICATION:
        case MGR_SHORTSTATUS | CONFIRM:
-               cb_log(5, 0, "MGMT: Short status dinfo %x\n",frm->dinfo);
+               cb_log(5, stack->port, "MGMT: Short status dinfo %x\n",frm->dinfo);
                
                switch (frm->dinfo) {
                case SSTATUS_L1_ACTIVATED:
-                       cb_log(3, 0, "MGMT: SSTATUS: L1_ACTIVATED \n");
+                       cb_log(3, stack->port, "MGMT: SSTATUS: L1_ACTIVATED \n");
                        stack->l1link=1;
                
                        break;
                case SSTATUS_L1_DEACTIVATED:
-                       cb_log(3, 0, "MGMT: SSTATUS: L1_DEACTIVATED \n");
+                       cb_log(3, stack->port, "MGMT: SSTATUS: L1_DEACTIVATED \n");
                        stack->l1link=0;
 #if 0
                        clear_l3(stack);
@@ -3921,9 +3952,10 @@ static void manager_event_handler(void *arg)
                     
                        while ( (msg=msg_dequeue(&stack->downqueue)) ) {
                                if (stack->nt ) {
+                                       pthread_mutex_lock(&stack->nstlock);
                                        if (stack->nst.manager_l3(&stack->nst, msg))
                                                cb_log(0, stack->port, "Error@ Sending Message in NT-Stack.\n");
-         
+                                       pthread_mutex_unlock(&stack->nstlock);
                                } else {
                                        iframe_t *frm = (iframe_t *)msg->data;
                                        struct misdn_bchannel *bc = find_bc_by_l3id(stack, frm->dinfo);

diff --git a/channels/misdn/isdn_lib_intern.h b/channels/misdn/isdn_lib_intern.h
index 725ef963f236c147bd82f7a6caaeefe69e0d7ac6..0a0804caad6c8b47928e87d5618be14c812a2ec9 100644 (file)
--- a/channels/misdn/isdn_lib_intern.h
+++ b/channels/misdn/isdn_lib_intern.h
@@ -57,6 +57,7 @@ struct misdn_stack {
        /** is first element because &nst equals &mISDNlist **/
        net_stack_t nst;
        manager_t mgr;
+       pthread_mutex_t nstlock;
   
        int d_stid;