<p><a href="https://gerrit.asterisk.org/c/asterisk/+/15130">View Change</a></p><p>2 comments:</p><ul style="list-style: none; padding: 0;"><li style="margin: 0; padding: 0;"><p><a href="https://gerrit.asterisk.org/c/asterisk/+/15130/3/res/res_pjsip_outbound_registration.c">File res/res_pjsip_outbound_registration.c:</a></p><ul style="list-style: none; padding: 0;"><li style="margin: 0; padding: 0 0 0 16px;"><p style="margin-bottom: 4px;"><a href="https://gerrit.asterisk.org/c/asterisk/+/15130/3/res/res_pjsip_outbound_registration.c@535">Patch Set #3, Line 535:</a> </p><p><blockquote style="border-left: 1px solid #aaa; margin: 10px 0; padding: 0 10px;"><pre style="font-family: monospace,monospace; white-space: pre-wrap;">            ast_sip_sched_task_cancel(client_state->sched_task);<br>               ao2_cleanup(client_state->sched_task);<br>             client_state->sched_task = NULL;<br></pre></blockquote></p><blockquote style="border-left: 1px solid #aaa; margin: 10px 0; padding: 0 10px;"><p style="white-space: pre-wrap; word-wrap: break-word;">this removes the task, and potential destroys the task object. If so then at that time the task_data object is also de-referenced. Does that mean client_state here could possibly be "cleaned up"/freed also? Thus causing badness when calling client_state->... next?</p></blockquote><p style="white-space: pre-wrap; word-wrap: break-word;">ast_sip_sched_task_cancel only removes the reference that was added when the task was scheduled.  cancel_registration is always called while at least "state" is holding a reference. if you look at where it's used, there are always usages of client_state after the call to cancel_registration.  There's just no way for client_state to be destroyed here.</p></li><li style="margin: 0; padding: 0 0 0 16px;"><p style="margin-bottom: 4px;"><a href="https://gerrit.asterisk.org/c/asterisk/+/15130/3/res/res_pjsip_outbound_registration.c@534">Patch Set #3, Line 534:</a> </p><p><blockquote style="border-left: 1px solid #aaa; margin: 10px 0; padding: 0 10px;"><pre style="font-family: monospace,monospace; white-space: pre-wrap;">        if (client_state->sched_task) {<br>            ast_sip_sched_task_cancel(client_state->sched_task);<br>               ao2_cleanup(client_state->sched_task);<br>             client_state->sched_task = NULL;<br>   }<br></pre></blockquote></p><blockquote style="border-left: 1px solid #aaa; margin: 10px 0; padding: 0 10px;"><p style="white-space: pre-wrap; word-wrap: break-word;">Should this be surrounded by a lock? Is it possible for another thread to enter here while it's being canceled by another thread? If so then without a lock it could be canceled twice.</p></blockquote><p style="white-space: pre-wrap; word-wrap: break-word;">cancel_registration is protected by the fact that it's always called from the registration's serializer.</p></li></ul></li></ul><p>To view, visit <a href="https://gerrit.asterisk.org/c/asterisk/+/15130">change 15130</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://gerrit.asterisk.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.asterisk.org/c/asterisk/+/15130"/><meta itemprop="name" content="View Change"/></div></div>

<div style="display:none"> Gerrit-Project: asterisk </div>
<div style="display:none"> Gerrit-Branch: 16 </div>
<div style="display:none"> Gerrit-Change-Id: I4534a0fc78c7cb69f23b7b449dda9748c90daca2 </div>
<div style="display:none"> Gerrit-Change-Number: 15130 </div>
<div style="display:none"> Gerrit-PatchSet: 3 </div>
<div style="display:none"> Gerrit-Owner: George Joseph <gjoseph@digium.com> </div>
<div style="display:none"> Gerrit-Reviewer: Friendly Automation </div>
<div style="display:none"> Gerrit-Reviewer: Kevin Harwell <kharwell@digium.com> </div>
<div style="display:none"> Gerrit-Comment-Date: Thu, 05 Nov 2020 13:32:35 +0000 </div>
<div style="display:none"> Gerrit-HasComments: Yes </div>
<div style="display:none"> Gerrit-Has-Labels: No </div>
<div style="display:none"> Comment-In-Reply-To: Kevin Harwell <kharwell@digium.com> </div>
<div style="display:none"> Gerrit-MessageType: comment </div>