[asterisk-commits] file: trunk r404554 - in /trunk: ./ res/res_pjsip_pubsub.c

[SVN commits to the Asterisk project]

Author: file
Date: Mon Dec 23 20:20:18 2013
New Revision: 404554

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=404554
Log:
res_pjsip_pubsub: Ensure dialog manipulation happens on proper thread.

When destroying a subscription we remove the serializer from its dialog
and decrease its reference count. Depending on which thread dropped the
subscription reference count to 0 it was possible for this to occur in
a thread where it is not possible.

(closes issue ASTERISK-22952)
Reported by: Matt Jordan
........

Merged revisions 404553 from http://svn.asterisk.org/svn/asterisk/branches/12

Modified:
    trunk/   (props changed)
    trunk/res/res_pjsip_pubsub.c

Propchange: trunk/
------------------------------------------------------------------------------
--- branch-12-merged (original)
+++ branch-12-merged Mon Dec 23 20:20:18 2013
@@ -1,1 +1,1 @@
-/branches/12:1-398558,398560-398577,398579-399305,399307-401390,401392-403290,403292-403778,403781-404509,404531
+/branches/12:1-398558,398560-398577,398579-399305,399307-401390,401392-403290,403292-403778,403781-404509,404531,404553

Modified: trunk/res/res_pjsip_pubsub.c
URL: http://svnview.digium.com/svn/asterisk/trunk/res/res_pjsip_pubsub.c?view=diff&rev=404554&r1=404553&r2=404554
==============================================================================
--- trunk/res/res_pjsip_pubsub.c (original)
+++ trunk/res/res_pjsip_pubsub.c Mon Dec 23 20:20:18 2013
@@ -303,6 +303,25 @@
 	return strcmp(datastore1->uid, uid2) ? 0 : CMP_MATCH | CMP_STOP;
 }
 
+static int subscription_remove_serializer(void *obj)
+{
+	struct ast_sip_subscription *sub = obj;
+
+	/* This is why we keep the dialog on the subscription. When the subscription
+	 * is destroyed, there is no guarantee that the underlying dialog is ready
+	 * to be destroyed. Furthermore, there's no guarantee in the opposite direction
+	 * either. The dialog could be destroyed before our subscription is. We fix
+	 * this problem by keeping a reference to the dialog until it is time to
+	 * destroy the subscription. We need to have the dialog available when the
+	 * subscription is destroyed so that we can guarantee that our attempt to
+	 * remove the serializer will be successful.
+	 */
+	ast_sip_dialog_set_serializer(sub->dlg, NULL);
+	pjsip_dlg_dec_session(sub->dlg, &pubsub_module);
+
+	return 0;
+}
+
 static void subscription_destructor(void *obj)
 {
 	struct ast_sip_subscription *sub = obj;
@@ -314,17 +333,7 @@
 	ao2_cleanup(sub->endpoint);
 
 	if (sub->dlg) {
-		/* This is why we keep the dialog on the subscription. When the subscription
-		 * is destroyed, there is no guarantee that the underlying dialog is ready
-		 * to be destroyed. Furthermore, there's no guarantee in the opposite direction
-		 * either. The dialog could be destroyed before our subscription is. We fix
-		 * this problem by keeping a reference to the dialog until it is time to
-		 * destroy the subscription. We need to have the dialog available when the
-		 * subscription is destroyed so that we can guarantee that our attempt to
-		 * remove the serializer will be successful.
-		 */
-		ast_sip_dialog_set_serializer(sub->dlg, NULL);
-		pjsip_dlg_dec_session(sub->dlg, &pubsub_module);
+		ast_sip_push_task_synchronous(NULL, subscription_remove_serializer, sub);
 	}
 	ast_taskprocessor_unreference(sub->serializer);
 }