[asterisk-commits] mmichelson: branch group/CCSS r219893 - /team/group/CCSS/main/ccss.c

[SVN commits to the Asterisk project]

Author: mmichelson
Date: Wed Sep 23 10:33:55 2009
New Revision: 219893

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=219893
Log:
Fix some potential refcount bugs.

There is no way to cancel a taskprocessor task, and so there
is no way of preventing a taskprocessor task which has a pointer
to a freed monitor from running. The fix is to bump the refcount
of the monitor up before pushing the task, and then unreffing
when the task has completed.


Modified:
    team/group/CCSS/main/ccss.c

Modified: team/group/CCSS/main/ccss.c
URL: http://svnview.digium.com/svn/asterisk/team/group/CCSS/main/ccss.c?view=diff&rev=219893&r1=219892&r2=219893
==============================================================================
--- team/group/CCSS/main/ccss.c (original)
+++ team/group/CCSS/main/ccss.c Wed Sep 23 10:33:55 2009
@@ -1125,7 +1125,9 @@
 	struct ast_cc_monitor_link *link = monitor->saved_link;
 
 	if (link && !link->is_suspended) {
-		return pass_availability_up(link->parent, link->core_id);
+		pass_availability_up(link->parent, link->core_id);
+		ao2_t_ref(monitor, -1, "Kill reference from ast_cc_monitor_announce_availabilty");
+		return 0;
 	}
 
 	/* Dang, we need to find the lowest weighted unsuspended
@@ -1148,12 +1150,15 @@
 		   monitor, we'll be able to report this state upstream
 		   as soon as one of the links becomes unsuspended.
 		 */
+		ao2_t_ref(monitor, -1, "Kill reference from ast_cc_monitor_announce_availabilty");
 		return 0;
 	}
 
 	/* We found a link to report on. Yay */
 	monitor->saved_link = link;
-	return pass_availability_up(link->parent, link->core_id);
+	pass_availability_up(link->parent, link->core_id);
+	ao2_t_ref(monitor, -1, "Kill reference from ast_cc_monitor_announce_availabilty");
+	return 0;
 }
 
 static int cc_do_state_change(void *datap)
@@ -1547,6 +1552,7 @@
 	if (new_state == AST_DEVICE_NOT_INUSE) {
 		ast_cc_monitor_announce_availability(monitor);
 	}
+	ao2_t_ref(monitor, -1, "Kill reference from generic_monitor_devstate_cb");
 	ast_free(gtcd);
 	return 0;
 }
@@ -1565,6 +1571,7 @@
 		return;
 	}
 
+	ao2_t_ref(monitor, +1, "Keep reference until taskprocessor callback executes");
 	gtcd->monitor = monitor;
 	gtcd->new_state = ast_event_get_ie_uint(event, AST_EVENT_IE_STATE);
 
@@ -1750,6 +1757,7 @@
 }
 
 int ast_cc_monitor_announce_availability(struct ast_cc_monitor *monitor) {
+	ao2_t_ref(monitor, +1, "Bump reference count until cc_devstate_change executes");
 	return ast_taskprocessor_push(cc_core_taskprocessor, cc_devstate_change, monitor);
 }