When a SIP channel is being auto-destroyed, it's possible for it to still be

in bridge code.  When that happens, we crash.  Delay the RTP destruction until
the bridge is ended.
(closes issue #11960)
 Reported by: norman
 Patches:
       20080215__bug11960__2.diff.txt uploaded by Corydon76 (license 14)
 Tested by: norman

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@103780 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index d3baa8d3f3f460d17e215289465b6cb8c9f0a865..9e038b8cf227535fffcb9fd22b5c0dce62e6810f 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -3064,6 +3064,21 @@ static void __sip_destroy(struct sip_pvt *p, int lockowner)
                        ast_log(LOG_DEBUG, "This call did not properly clean up call limits. Call ID %s\n", p->callid);
        }
 
+       /* Unlink us from the owner if we have one */
+       if (p->owner) {
+               if (lockowner)
+                       ast_channel_lock(p->owner);
+               if (option_debug)
+                       ast_log(LOG_DEBUG, "Detaching from %s\n", p->owner->name);
+               p->owner->tech_pvt = NULL;
+               /* Make sure that the channel knows its backend is going away */
+               p->owner->_softhangup |= AST_SOFTHANGUP_DEV;
+               if (lockowner)
+                       ast_channel_unlock(p->owner);
+               /* Give the channel a chance to react before deallocation */
+               usleep(1);
+       }
+
        /* Remove link from peer to subscription of MWI */
        if (p->relatedpeer && p->relatedpeer->mwipvt)
                p->relatedpeer->mwipvt = NULL;
@@ -3080,10 +3095,17 @@ static void __sip_destroy(struct sip_pvt *p, int lockowner)
        AST_SCHED_DEL(sched, p->waitid);
        AST_SCHED_DEL(sched, p->autokillid);
 
-       if (p->rtp)
+       /* We absolutely cannot destroy the rtp struct while a bridge is active or we WILL crash */
+       if (p->rtp) {
+               while (ast_rtp_get_bridged(p->rtp))
+                       usleep(1);
                ast_rtp_destroy(p->rtp);
-       if (p->vrtp)
+       }
+       if (p->vrtp) {
+               while (ast_rtp_get_bridged(p->vrtp))
+                       usleep(1);
                ast_rtp_destroy(p->vrtp);
+       }
        if (p->udptl)
                ast_udptl_destroy(p->udptl);
        if (p->refer)
@@ -3098,16 +3120,6 @@ static void __sip_destroy(struct sip_pvt *p, int lockowner)
                ASTOBJ_UNREF(p->registry, sip_registry_destroy);
        }
 
-       /* Unlink us from the owner if we have one */
-       if (p->owner) {
-               if (lockowner)
-                       ast_channel_lock(p->owner);
-               if (option_debug)
-                       ast_log(LOG_DEBUG, "Detaching from %s\n", p->owner->name);
-               p->owner->tech_pvt = NULL;
-               if (lockowner)
-                       ast_channel_unlock(p->owner);
-       }
        /* Clear history */
        if (p->history) {
                struct sip_history *hist;

diff --git a/main/rtp.c b/main/rtp.c
index 949dd1cc82716abf4029e6e0d9fd8997c78cdeba..a1aa2985f33cddbf199c115a1d2adb3c1c354e65 100644 (file)
--- a/main/rtp.c
+++ b/main/rtp.c
@@ -3266,6 +3266,14 @@ enum ast_bridge_result ast_rtp_bridge(struct ast_channel *c0, struct ast_channel
                ast_channel_lock(c0);
        }
 
+       /* Ensure neither channel got hungup during lock avoidance */
+       if (ast_check_hangup(c0) || ast_check_hangup(c1)) {
+               ast_log(LOG_WARNING, "Got hangup while attempting to bridge '%s' and '%s'\n", c0->name, c1->name);
+               ast_channel_unlock(c0);
+               ast_channel_unlock(c1);
+               return AST_BRIDGE_FAILED;
+       }
+               
        /* Find channel driver interfaces */
        if (!(pr0 = get_proto(c0))) {
                ast_log(LOG_WARNING, "Can't find native functions for channel '%s'\n", c0->name);