diff --git a/include/asterisk/bridge_channel.h b/include/asterisk/bridge_channel.h index 4504d6bcb7da0fb3fffb6e80dc69244c97677aa4..fb2fd4f6f31fd3f5cb46194ce71d404f706ea62e 100644 --- a/include/asterisk/bridge_channel.h +++ b/include/asterisk/bridge_channel.h @@ -193,6 +193,20 @@ struct ast_bridge_channel { } stream_map; }; +/*! + * \brief Get a ref to the bridge_channel's ast_channel + * + * \param bridge_channel The bridge channel + * + * \note The returned channel NEEDS to be unref'd once you are done with it. In general, this + * function is best used when accessing the bridge_channel chan from outside of a bridging + * thread. + * + * \retval ref'd ast_channel on success + * \retval NULL otherwise + */ +struct ast_channel *ast_bridge_channel_get_chan(struct ast_bridge_channel *bridge_channel); + /*! * \brief Try locking the bridge_channel. * diff --git a/main/bridge.c b/main/bridge.c index add586c3ca224300ba355fa265bdaad5047f2029..ea15d1b7a3010e64339b47e55bb4803af0a0f5da 100644 --- a/main/bridge.c +++ b/main/bridge.c @@ -1729,7 +1729,10 @@ int ast_bridge_join(struct ast_bridge *bridge, ast_channel_lock(chan); ast_channel_internal_bridge_channel_set(chan, NULL); ast_channel_unlock(chan); + /* Due to a race condition, we lock the bridge channel here for ast_bridge_channel_get_chan */ + ao2_lock(bridge_channel); bridge_channel->chan = NULL; + ao2_unlock(bridge_channel); /* If bridge_channel->swap is not NULL then the join failed. */ ao2_t_cleanup(bridge_channel->swap, "Bridge complete: join failed"); bridge_channel->swap = NULL; @@ -1798,7 +1801,10 @@ static void *bridge_channel_ind_thread(void *data) ast_channel_lock(chan); ast_channel_internal_bridge_channel_set(chan, NULL); ast_channel_unlock(chan); + /* Lock here for ast_bridge_channel_get_chan */ + ao2_lock(bridge_channel); bridge_channel->chan = NULL; + ao2_unlock(bridge_channel); /* If bridge_channel->swap is not NULL then the join failed. */ ao2_t_cleanup(bridge_channel->swap, "Bridge complete: Independent impart join failed"); bridge_channel->swap = NULL; @@ -1899,7 +1905,10 @@ static int bridge_impart_internal(struct ast_bridge *bridge, ast_channel_lock(chan); ast_channel_internal_bridge_channel_set(chan, NULL); ast_channel_unlock(chan); + /* Lock here for ast_bridge_channel_get_chan */ + ao2_lock(bridge_channel); bridge_channel->chan = NULL; + ao2_unlock(bridge_channel); ao2_t_cleanup(bridge_channel->swap, "Bridge complete: Impart failed"); bridge_channel->swap = NULL; ast_bridge_features_destroy(bridge_channel->features); @@ -4752,14 +4761,22 @@ enum ast_transfer_result ast_bridge_transfer_attended(struct ast_channel *to_tra if (to_transferee_bridge_channel) { /* Take off hold if they are on hold. */ - ast_bridge_channel_write_unhold(to_transferee_bridge_channel); + if (ast_bridge_channel_write_unhold(to_transferee_bridge_channel)) { + ast_log(LOG_ERROR, "Transferee channel disappeared during transfer!\n"); + res = AST_BRIDGE_TRANSFER_FAIL; + goto end; + } } if (to_target_bridge_channel) { const char *target_complete_sound; /* Take off hold if they are on hold. */ - ast_bridge_channel_write_unhold(to_target_bridge_channel); + if (ast_bridge_channel_write_unhold(to_target_bridge_channel)) { + ast_log(LOG_ERROR, "Target channel disappeared during transfer!\n"); + res = AST_BRIDGE_TRANSFER_FAIL; + goto end; + } /* Is there a courtesy sound to play to the target? */ ast_channel_lock(to_transfer_target); diff --git a/main/bridge_channel.c b/main/bridge_channel.c index ade98fd4f395033a9b5aedba809b46ada2c64710..3c5e87b574a5b519f073e238a6325d8c0184a25f 100644 --- a/main/bridge_channel.c +++ b/main/bridge_channel.c @@ -208,6 +208,17 @@ static void bridge_sync_signal(struct bridge_sync *sync_struct) ast_sem_post(&sync_struct->sem); } +struct ast_channel *ast_bridge_channel_get_chan(struct ast_bridge_channel *bridge_channel) +{ + struct ast_channel *chan; + + ao2_lock(bridge_channel); + chan = ao2_bump(bridge_channel->chan); + ao2_unlock(bridge_channel); + + return chan; +} + void ast_bridge_channel_lock_bridge(struct ast_bridge_channel *bridge_channel) { struct ast_bridge *bridge; @@ -1177,7 +1188,14 @@ int ast_bridge_channel_write_hold(struct ast_bridge_channel *bridge_channel, con int ast_bridge_channel_write_unhold(struct ast_bridge_channel *bridge_channel) { - ast_channel_publish_cached_blob(bridge_channel->chan, ast_channel_unhold_type(), NULL); + struct ast_channel *chan = ast_bridge_channel_get_chan(bridge_channel); + + if (!chan) { + return -1; + } + + ast_channel_publish_cached_blob(chan, ast_channel_unhold_type(), NULL); + ao2_ref(chan, -1); return ast_bridge_channel_write_control_data(bridge_channel, AST_CONTROL_UNHOLD, NULL, 0); }