[asterisk-commits] r108137 - svn:log

[SVN commits to the Asterisk project]

Author: russell
Revision: 108137
Modified property: svn:log

Modified: svn:log at Wed Mar 12 15:02:58 2008
------------------------------------------------------------------------------
--- svn:log (original)
+++ svn:log Wed Mar 12 15:02:58 2008
@@ -1,0 +1,49 @@
+Merged revisions 108135 via svnmerge from 
+https://origsvn.digium.com/svn/asterisk/branches/1.4
+
+........
+r108135 | russell | 2008-03-12 14:57:42 -0500 (Wed, 12 Mar 2008) | 40 lines
+
+(closes issue #12187, reported by atis, fixed by me after some brainstorming
+ on the issue with mmichelson)
+
+- Update copyright info on app_chanspy.
+
+- Fix a race condition that caused app_chanspy to crash.  The issue was that
+  the chanspy datastore magic that was used to ensure that spyee channels did
+  not disappear out from under the code did not completely solve the problem.
+  It was actually possible for chanspy to acquire a channel reference out of
+  its datastore to a channel that was in the middle of being destroyed.  That
+  was because datastore destruction in ast_channel_free() was done near the
+  end.  So, this left the code in app_chanspy accessing a channel that was
+  partially, or completely invalid because it was in the process of being free'd
+  by another thread.  The following sort of shows the code path where the race 
+  occurred:
+
+  =============================================================================
+  Thread 1 (PBX thread for spyee chan)  ||   Thread 2 (chanspy)
+  --------------------------------------||-------------------------------------
+  ast_channel_free()                    ||
+    - remove channel from channel list  ||
+    - lock/unlock the channel to ensure ||
+      that no references retrieved from ||
+      the channel list exist.           ||
+  --------------------------------------||-------------------------------------
+                                        || channel_spy()
+    - destroy some channel data         ||  - Lock chanspy datastore
+                                        ||  - Retrieve reference to channel
+                                        ||  - lock channel
+                                        ||  - Unlock chanspy datastore
+  --------------------------------------||-------------------------------------
+     - destroy channel datastores       ||
+        - call chanspy datastore d'tor  ||  
+          which NULL's out the ds'      ||  - Operate on the channel ...
+          reference to the channel      ||     
+                                        ||
+    - free the channel                  || 
+                                        ||
+                                        ||  - unlock the channel
+  --------------------------------------||-------------------------------------
+  =============================================================================
+
+........