Skip to content
Snippets Groups Projects
  • Richard Mudgett's avatar
    c87e7dd9
    autochan/mixmonitor/chanspy: Fix unsafe channel locking and references. · c87e7dd9
    Richard Mudgett authored
    Dereferencing struct ast_autochan.chan without first calling
    ast_autochan_channel_lock() is unsafe because the pointer could change at
    any time due to a masquerade.  Unfortunately, ast_autochan_channel_lock()
    itself uses struct ast_autochan.chan unsafely and can result in a deadlock
    if the original channel happens to get destroyed after a masquerade in
    addition to the pointer getting changed.
    
    The problem is more likely to happen with v11 and earlier because
    masquerades are used to optimize out local channels on those versions.
    However, it could still happen on newer versions if the channel is
    executing a dialplan application when the channel is transferred or
    redirected.  In this situation a masquerade still must be used.
    
    * Added a lock to struct ast_autochan to safely be able to use
    ast_autochan.chan while trying to get the channel lock in
    ast_autochan_channel_lock().  The locking order is the channel lock then
    the autochan lock.  Locking in the other direction requires deadlock
    avoidance.
    
    * Fix unsafe ast_autochan.chan usages in app_mixmonitor.c.
    
    * Fix unsafe ast_autochan.chan usages in app_chanspy.c.
    
    * app_chanspy.c: Removed unused autochan parameter from next_channel().
    
    ASTERISK-26867
    
    Change-Id: Id29dd22bc0f369b44e23ca423d2f3657187cc592
    c87e7dd9
    History
    autochan/mixmonitor/chanspy: Fix unsafe channel locking and references.
    Richard Mudgett authored
    Dereferencing struct ast_autochan.chan without first calling
    ast_autochan_channel_lock() is unsafe because the pointer could change at
    any time due to a masquerade.  Unfortunately, ast_autochan_channel_lock()
    itself uses struct ast_autochan.chan unsafely and can result in a deadlock
    if the original channel happens to get destroyed after a masquerade in
    addition to the pointer getting changed.
    
    The problem is more likely to happen with v11 and earlier because
    masquerades are used to optimize out local channels on those versions.
    However, it could still happen on newer versions if the channel is
    executing a dialplan application when the channel is transferred or
    redirected.  In this situation a masquerade still must be used.
    
    * Added a lock to struct ast_autochan to safely be able to use
    ast_autochan.chan while trying to get the channel lock in
    ast_autochan_channel_lock().  The locking order is the channel lock then
    the autochan lock.  Locking in the other direction requires deadlock
    avoidance.
    
    * Fix unsafe ast_autochan.chan usages in app_mixmonitor.c.
    
    * Fix unsafe ast_autochan.chan usages in app_chanspy.c.
    
    * app_chanspy.c: Removed unused autochan parameter from next_channel().
    
    ASTERISK-26867
    
    Change-Id: Id29dd22bc0f369b44e23ca423d2f3657187cc592