Save the callno when we're poking, because our peer structure could change

during destruction (and thus we unlock the wrong callno, causing a
cascade failure).
(closes issue #12717)
 Reported by: gewfie
 Patches:
       20080525__bug12717.diff.txt uploaded by Corydon76 (license 14)
 Tested by: gewfie

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@120001 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index 738f3b729f5e8c133c556389736184dda6419ae5..1691f49db0e6db4b5d4d0c925f7800ffe8d8247a 100644 (file)
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -8842,6 +8842,7 @@ static int iax2_poke_peer_cb(void *obj, void *arg, int flags)
 
 static int iax2_poke_peer(struct iax2_peer *peer, int heldcall)
 {
+       int callno;
        if (!peer->maxms || (!peer->addr.sin_addr.s_addr && !peer->dnsmgr)) {
                /* IF we have no IP without dnsmgr, or this isn't to be monitored, return
                  immediately after clearing things out */
@@ -8851,11 +8852,13 @@ static int iax2_poke_peer(struct iax2_peer *peer, int heldcall)
                peer->callno = 0;
                return 0;
        }
-       if (peer->callno > 0) {
+
+       /* The peer could change the callno inside iax2_destroy, since we do deadlock avoidance */
+       if ((callno = peer->callno) > 0) {
                ast_log(LOG_NOTICE, "Still have a callno...\n");
-               ast_mutex_lock(&iaxsl[peer->callno]);
-               iax2_destroy(peer->callno);
-               ast_mutex_unlock(&iaxsl[peer->callno]);
+               ast_mutex_lock(&iaxsl[callno]);
+               iax2_destroy(callno);
+               ast_mutex_unlock(&iaxsl[callno]);
        }
        if (heldcall)
                ast_mutex_unlock(&iaxsl[heldcall]);