From 4bf395e81e91f12809ef9900ef6716d4cb1a2fd5 Mon Sep 17 00:00:00 2001
From: Matt Jordan <mjordan@digium.com>
Date: Tue, 6 Oct 2015 20:43:58 -0500
Subject: [PATCH] res/res_rtp_asterisk: Fix assignment after ao2 decrement

When we decide we will no longer schedule an RTCP write, we remove the
reference to the RTP instance, then assign -1 to the stored scheduler ID
in case something else comes along and wants to see if anything is scheduled.

That scheduler ID is on the RTP instance. After 60a9172d7ef2 was merged to
fix the regression introduced by 3cf0f29310, this improper assignment on a
potentially destroyed object started getting tripped on the build agents.

Frankly, this should have been crashing a lot more often earlier. I can only
assume that the timing was changed just enough by both changes to start
actually hitting this problem.

As it is, simply moving the assignment prior to the ao2 deference is sufficient
to keep the RTP instance from being referenced when it is very, truly,
aboslutely dead.

(Note that it is still good practice to assign -1 to the scheduler ID when we
know we won't be scheduling it again, as the ao2 deref *may* not always destroy
the ao2 object.)

ASTERISK-25449

Change-Id: Ie6d3cb4adc7b1a6c078b1c38c19fc84cf787cda7
---
 res/res_rtp_asterisk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index 2e285ebefc..bc9fc017d1 100644
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -3199,8 +3199,8 @@ static int ast_rtcp_write(const void *data)
 		/*
 		 * Not being rescheduled.
 		 */
-		ao2_ref(instance, -1);
 		rtp->rtcp->schedid = -1;
+		ao2_ref(instance, -1);
 	}
 
 	return res;
-- 
GitLab