[Asterisk-code-review] chan sip: Address runaway when realtime peers subscribe to ... (asterisk[13])

[Corey Farrell]

Corey Farrell has posted comments on this change.

Change subject: chan_sip:  Address runaway when realtime peers subscribe to mailboxes
......................................................................


Patch Set 1:

(2 comments)

https://gerrit.asterisk.org/#/c/3962/1/channels/chan_sip.c
File channels/chan_sip.c:

Your diff is nowhere near clear_peer_mailboxes, but I think we need to add peer locking to it.  I think peer needs to be locked for AST_LIST_REMOVE_HEAD(&peer->mailboxes, entry) but unlocked for destroy_mailbox(peer).

We're protecting against:
Thread 1: sip_destroy_peer -> clear_peer_mailboxes
Thread 2: mwi_event_cb -> sip_send_mwi_to_peer -> get_cached_mwi


Line 17206: 		sip_send_mwi_to_peer(peer, 0);
> The destruction still does an unsubscribe_and_join which ensures the peer i
I understand.  Slightly concerned that it's invalid for sip_send_mwi_to_peer to bump the reference for peer.  I've traced the possible uses of peer and nothing grabs a reference.  Can we get a comment on sip_send_mwi_to_peer saying that peer might already be in destruction?


-- 
To view, visit https://gerrit.asterisk.org/3962
To unsubscribe, visit https://gerrit.asterisk.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: I07519ef7f092629e1e844f855abd279d6475cdd0
Gerrit-PatchSet: 1
Gerrit-Project: asterisk
Gerrit-Branch: 13
Gerrit-Owner: George Joseph <gjoseph at digium.com>
Gerrit-Reviewer: Anonymous Coward #1000019
Gerrit-Reviewer: Corey Farrell <git at cfware.com>
Gerrit-Reviewer: George Joseph <gjoseph at digium.com>
Gerrit-Reviewer: Joshua Colp <jcolp at digium.com>
Gerrit-HasComments: Yes