[asterisk-bugs] [Asterisk 0018716]: manager_park can deadlock with ast_channel_free, for channel 1 of the park operation (channel list v channel lock)

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=18716 
====================================================================== 
Reported By:                davidw
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   18716
Category:                   Channels/General
Reproducibility:            have not tried
Severity:                   major
Priority:                   normal
Status:                     acknowledged
Asterisk Version:           SVN 
JIRA:                       SWP-3023 
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): 1.6.2 
SVN Revision (number only!): 305082 
Request Review:              
====================================================================== 
Date Submitted:             2011-01-31 10:48 CST
Last Modified:              2011-02-01 12:48 CST
====================================================================== 
Summary:                    manager_park can deadlock with ast_channel_free, for
channel 1 of the park operation (channel list v channel lock)
Description: 
manager_park (in features.c) does ast_get_channel_by_name_locked on both
channels that it is given.  This locks the list of channels during its
processing, meaning that the manager thread ends up locking channel 1, and
then the list of channels.

ast_channel_free write locks the list of channels, then temporarily locks
the channel it is freeing, meaning it applies lock in the reverse order!

A real deadlock has been observed with manager_park waiting for channel
list and ast_channel_free waiting for the channel.
======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
related to          0015316 [patch] Segfault after Manager Bridge
====================================================================== 

---------------------------------------------------------------------- 
 (0131362) davidw (reporter) - 2011-02-01 12:48
 https://issues.asterisk.org/view.php?id=18716#c131362 
---------------------------------------------------------------------- 
We made this reproducible by strategically placed calls to sleep.  We then
tried an avoidance technique, as we didn't want the channel2 functionality
of manager_park (and it was ineffective anyway, which is another story), so
we could force it to be passed into the main parking logic as NULL.

Unfortunately, we then hit the same deadlock combination, when
masq_park_call called ast_channel_alloc.  I doubt there is a simple
avoidance technique for this second deadlock point.

I don't have time to do the detailed analysis and verify that this is
still true in 1.6.2, until tomorrow. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2011-02-01 12:48 davidw         Note Added: 0131362                          
======================================================================