lock channel during datastore removal

On channel destruction the channel's datastores are removed and
destroyed.  Since there are public API calls to find and remove
datastores on a channel, a lock should be held whenever datastores are
removed and destroyed.  This resolves a crash caused by a race
condition in app_chanspy.c.

(closes issue #16678)
Reported by: tim_ringenbach
Patches:
      datastore_destroy_race.diff uploaded by tim ringenbach (license 540)
Tested by: dvossel

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@246545 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/main/channel.c b/main/channel.c
index 8addc0d629b9e4d15baf9f8101db2eb192dfd0ec..a4ffd629d3ee51aae154b9edb3db0026f7bbc61a 100644 (file)
--- a/main/channel.c
+++ b/main/channel.c
@@ -1286,9 +1286,11 @@ void ast_channel_free(struct ast_channel *chan)
        }
 
        /* Get rid of each of the data stores on the channel */
+       ast_channel_lock(chan);
        while ((datastore = AST_LIST_REMOVE_HEAD(&chan->datastores, entry)))
                /* Free the data store */
                ast_channel_datastore_free(datastore);
+       ast_channel_unlock(chan);
 
        /* Lock and unlock the channel just to be sure nobody has it locked still
           due to a reference that was stored in a datastore. (i.e. app_chanspy) */