<p>Holger Hans Peter Freyther has uploaded this change for <strong>review</strong>.</p><p><a href="https://gerrit.asterisk.org/c/asterisk/+/11254">View Change</a></p><pre style="font-family: monospace,monospace; white-space: pre-wrap;">stasis: Cancel the callback when joining the bridge fails<br><br>After a bridge has been deleted the stasis control will depart<br>the channel and might attempt to re-add it to the dial bridge.<br><br>The later can fail and this can lead to a situation that the stasis<br>control is unlinked but the after_bridge_cb_failed cb is executed trying<br>to access a dangling control object.<br><br>Fix it by discarding the callback when the imparting into the dial<br>bridge can fail. This is avoiding a crash and understanding why it can't<br>be added to the dial bridge (is it still there?) is next.<br><br>ASTERISK-26718<br><br>bridge_impart_internal: Channel PJSIP/endpoint-00000004 has a PBX thread<br>and cannot be imparted into bridge<br><br>==18524== Invalid read of size 8<br>==18524== at 0x17AC35F1: dial_bridge_after_cb_failed (control.c:1044)<br>==18524== by 0x18D287: after_bridge_cb_failed (bridge_after.c:70)<br>==18524== by 0x18D287: after_bridge_cb_run_discard (bridge_after.c:99)<br>==18524== by 0x18D287: after_bridge_cb_destroy (bridge_after.c:117)<br>==18524== by 0x1E6CCB: ast_datastore_free (datastore.c:74)<br>==18524== by 0x1B3985: ast_channel_destructor (channel.c:2243)<br>==18524== by 0x171CBF: __ao2_ref (astobj2.c:614)<br>==18524== by 0x1BB9CDEC: hangup_data_destroy (chan_pjsip.c:2313)<br>==18524== by 0x171CBF: __ao2_ref (astobj2.c:614)<br>==18524== by 0x1BBA172F: hangup (chan_pjsip.c:2355)<br>==18524== by 0x2B54B7: ast_taskprocessor_execute (taskprocessor.c:1185)<br>==18524== by 0x2BC24F: execute_tasks (threadpool.c:1354)<br>==18524== by 0x2B54B7: ast_taskprocessor_execute (taskprocessor.c:1185)<br>==18524== by 0x2BCAB3: threadpool_execute (threadpool.c:367)<br>==18524== by 0x2BCAB3: worker_active (threadpool.c:1137)<br>==18524== by 0x2BCAB3: worker_start (threadpool.c:1056)<br>==18524== Address 0xeb0ae08 is 120 bytes inside a block of size 352 free'd<br>==18524== at 0x4C2CDDB: free (vg_replace_malloc.c:530)<br>==18524== by 0x171FFE: __ao2_ref (astobj2.c:631)<br>==18524== by 0x17AB9468: control_unlink (res_stasis.c:765)<br>==18524== by 0x17AB9468: stasis_app_exec (res_stasis.c:1607)<br>==18524== by 0x184E4B75: app_exec (app_stasis.c:105)<br>==18524== by 0x24E168: pbx_exec (pbx_app.c:492)<br>==18524== by 0x2411D6: pbx_extension_helper.constprop.42 (pbx.c:2927)<br>==18524== by 0x2435C1: ast_spawn_extension (pbx.c:4177)<br>==18524== by 0x2435C1: __ast_pbx_run (pbx.c:4351)<br>==18524== by 0x244C1A: pbx_thread (pbx.c:4673)<br>==18524== by 0x2C4E7B: dummy_start (utils.c:1249)<br>==18524== by 0x6EA64A3: start_thread (pthread_create.c:456)<br>==18524== by 0x82DCD0E: clone (clone.S:97)<br><br>Change-Id: Ib4e8f70d7a21bd54afe3cb51cc6717ef7c355496<br>---<br>M res/stasis/control.c<br>1 file changed, 1 insertion(+), 0 deletions(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;">git pull ssh://gerrit.asterisk.org:29418/asterisk refs/changes/54/11254/1</pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/res/stasis/control.c b/res/stasis/control.c</span><br><span>index 866b58e..ffac8d4 100644</span><br><span>--- a/res/stasis/control.c</span><br><span>+++ b/res/stasis/control.c</span><br><span>@@ -1065,6 +1065,7 @@</span><br><span> control->bridge = bridge;</span><br><span> ast_bridge_set_after_callback(chan, dial_bridge_after_cb, dial_bridge_after_cb_failed, control);</span><br><span> if (ast_bridge_impart(bridge, chan, NULL, NULL, AST_BRIDGE_IMPART_CHAN_DEPARTABLE)) {</span><br><span style="color: hsl(120, 100%, 40%);">+ ast_bridge_discard_after_callback(chan, AST_BRIDGE_AFTER_CB_REASON_IMPART_FAILED);</span><br><span> control->bridge = NULL;</span><br><span> ao2_ref(bridge, -1);</span><br><span> return -1;</span><br><span></span><br></pre><p>To view, visit <a href="https://gerrit.asterisk.org/c/asterisk/+/11254">change 11254</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://gerrit.asterisk.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.asterisk.org/c/asterisk/+/11254"/><meta itemprop="name" content="View Change"/></div></div>
<div style="display:none"> Gerrit-Project: asterisk </div>
<div style="display:none"> Gerrit-Branch: 16.3 </div>
<div style="display:none"> Gerrit-Change-Id: Ib4e8f70d7a21bd54afe3cb51cc6717ef7c355496 </div>
<div style="display:none"> Gerrit-Change-Number: 11254 </div>
<div style="display:none"> Gerrit-PatchSet: 1 </div>
<div style="display:none"> Gerrit-Owner: Holger Hans Peter Freyther <automatic@freyther.de> </div>
<div style="display:none"> Gerrit-MessageType: newchange </div>