[Asterisk-code-review] res pjsip distributor: Get a reference to dialog serializer. (asterisk[master])

[Mark Michelson]

Mark Michelson has uploaded a new change for review.

  https://gerrit.asterisk.org/1285

Change subject: res_pjsip_distributor: Get a reference to dialog serializer.
......................................................................

res_pjsip_distributor: Get a reference to dialog serializer.

There have been crashes seen where a taskprocessor's listener is NULL
unexpectedly.

Looking at backtraces, the problem was specifically seen in PJSIP
serializers.

The distributor code grabs the dialog that the incoming message belongs
to. From there, the distributor gets the serializer off the dialog in
order to distribute the task. The problem is that the distributor only
gets a bare pointer to the serializer rather than a reference. The
result is that between when the distributor gets its pointer and when
the task is pushed to the serializer, the serializer may get destroyed.

The fix for this is to have the distributor grab a reference to the
taskprocessor instead of a bare pointer.

Change-Id: I14563093f8320f79063b65792461f18f06c07a77
---
M res/res_pjsip/pjsip_distributor.c
1 file changed, 3 insertions(+), 5 deletions(-)


  git pull ssh://gerrit.asterisk.org:29418/asterisk refs/changes/85/1285/1

diff --git a/res/res_pjsip/pjsip_distributor.c b/res/res_pjsip/pjsip_distributor.c
index 9b05260..5164695 100644
--- a/res/res_pjsip/pjsip_distributor.c
+++ b/res/res_pjsip/pjsip_distributor.c
@@ -251,21 +251,19 @@
 	pjsip_dialog *dlg = find_dialog(rdata);
 	struct distributor_dialog_data *dist = NULL;
 	struct ast_taskprocessor *serializer = NULL;
-	struct ast_taskprocessor *req_serializer = NULL;
 	pjsip_rx_data *clone;
 
 	if (dlg) {
 		dist = pjsip_dlg_get_mod_data(dlg, distributor_mod.id);
 		if (dist) {
-			serializer = dist->serializer;
+			serializer = ao2_bump(dist->serializer);
 		}
 	}
 
 	if (serializer) {
 		/* We have a serializer so we know where to send the message. */
 	} else if (rdata->msg_info.msg->type == PJSIP_RESPONSE_MSG) {
-		req_serializer = find_request_serializer(rdata);
-		serializer = req_serializer;
+		serializer = find_request_serializer(rdata);
 	} else if (!pjsip_method_cmp(&rdata->msg_info.msg->line.req.method, &pjsip_cancel_method)
 		|| !pjsip_method_cmp(&rdata->msg_info.msg->line.req.method, &pjsip_bye_method)) {
 		/* We have a BYE or CANCEL request without a serializer. */
@@ -286,7 +284,7 @@
 	if (dlg) {
 		pjsip_dlg_dec_lock(dlg);
 	}
-	ast_taskprocessor_unreference(req_serializer);
+	ast_taskprocessor_unreference(serializer);
 
 	return PJ_TRUE;
 }

-- 
To view, visit https://gerrit.asterisk.org/1285
To unsubscribe, visit https://gerrit.asterisk.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I14563093f8320f79063b65792461f18f06c07a77
Gerrit-PatchSet: 1
Gerrit-Project: asterisk
Gerrit-Branch: master
Gerrit-Owner: Mark Michelson <mmichelson at digium.com>