Merge "thirdparty/pjproject: fix deadlock in response retransmissions"

third-party/pjproject/patches/0110_fix_tdata_rexmit_deadlock.patch

+From 3c9ad14b32ddb881559c05ea742aba3153a8cb8f Mon Sep 17 00:00:00 2001
+From: Riza Sulistyo <riza@teluu.com>
+Date: Wed, 1 Aug 2018 10:49:51 -0500
+Subject: [PATCH] r5851 svn backport sip_inv.c: Fix race condition in 183
+ re-transmission deadlock
+
+Fixed #2137: Race condition in 183 re-transmission can result in a deadlock.
+
+The tdata containing the response can be shared by both the dialog
+object and the tsx object.  In order to prevent the race condition
+between the tsx retransmission and the dialog sending a response,
+clone the tdata before modifying it for the dialog send response.
+
+ASTERISK-27966
+---
+ pjsip/include/pjsip/sip_transport.h | 16 +++++++++++++
+ pjsip/src/pjsip-ua/sip_100rel.c     | 43 +--------------------------------
+ pjsip/src/pjsip-ua/sip_inv.c        | 14 ++++++++++-
+ pjsip/src/pjsip/sip_transport.c     | 47 +++++++++++++++++++++++++++++++++++++
+ 4 files changed, 77 insertions(+), 43 deletions(-)
+
+diff --git a/pjsip/include/pjsip/sip_transport.h b/pjsip/include/pjsip/sip_transport.h
+index 10a50ef..36581dc 100644
+--- a/pjsip/include/pjsip/sip_transport.h
++++ b/pjsip/include/pjsip/sip_transport.h
+@@ -721,6 +721,22 @@ PJ_DECL(char*) pjsip_tx_data_get_info( pjsip_tx_data *tdata );
+ PJ_DECL(pj_status_t) pjsip_tx_data_set_transport(pjsip_tx_data *tdata,
+ 						 const pjsip_tpselector *sel);
+ 
++/**
++ * Clone pjsip_tx_data. This will duplicate the message contents of
++ * pjsip_tx_data (pjsip_tx_data.msg) and add reference count to the tdata.
++ * Once application has finished using the cloned pjsip_tx_data,
++ * it must release it by calling  #pjsip_tx_data_dec_ref().
++ * Currently, this will only clone response message.
++ *
++ * @param src	    The source to be cloned.
++ * @param flags	    Optional flags. Must be zero for now.
++ * @param p_rdata   Pointer to receive the cloned tdata.
++ *
++ * @return	    PJ_SUCCESS on success or the appropriate error.
++ */
++PJ_DECL(pj_status_t) pjsip_tx_data_clone(const pjsip_tx_data *src,
++                                         unsigned flags,
++                                         pjsip_tx_data **p_rdata);
+ 
+ /*****************************************************************************
+  *
+diff --git a/pjsip/src/pjsip-ua/sip_100rel.c b/pjsip/src/pjsip-ua/sip_100rel.c
+index eb9e587..7bf0ad1 100644
+--- a/pjsip/src/pjsip-ua/sip_100rel.c
++++ b/pjsip/src/pjsip-ua/sip_100rel.c
+@@ -634,47 +634,6 @@ static void on_retransmit(pj_timer_heap_t *timer_heap,
+ }
+ 
+ 
+-/* Clone response. */
+-static pjsip_tx_data *clone_tdata(dlg_data *dd,
+-				  const pjsip_tx_data *src)
+-{
+-    pjsip_tx_data *dst;
+-    const pjsip_hdr *hsrc;
+-    pjsip_msg *msg;
+-    pj_status_t status;
+-
+-    status = pjsip_endpt_create_tdata(dd->inv->dlg->endpt, &dst);
+-    if (status != PJ_SUCCESS)
+-	return NULL;
+-
+-    msg = pjsip_msg_create(dst->pool, PJSIP_RESPONSE_MSG);
+-    dst->msg = msg;
+-    pjsip_tx_data_add_ref(dst);
+-
+-    /* Duplicate status line */
+-    msg->line.status.code = src->msg->line.status.code;
+-    pj_strdup(dst->pool, &msg->line.status.reason, 
+-	      &src->msg->line.status.reason);
+-
+-    /* Duplicate all headers */
+-    hsrc = src->msg->hdr.next;
+-    while (hsrc != &src->msg->hdr) {
+-	pjsip_hdr *h = (pjsip_hdr*) pjsip_hdr_clone(dst->pool, hsrc);
+-	pjsip_msg_add_hdr(msg, h);
+-	hsrc = hsrc->next;
+-    }
+-
+-    /* Duplicate message body */
+-    if (src->msg->body)
+-	msg->body = pjsip_msg_body_clone(dst->pool, src->msg->body);
+-
+-    PJ_LOG(5,(dd->inv->dlg->obj_name,
+-	     "Reliable response %s created",
+-	     pjsip_tx_data_get_info(dst)));
+-
+-    return dst;
+-}
+-
+ 
+ /* Check if any pending response in transmission list has SDP */
+ static pj_bool_t has_sdp(dlg_data *dd)
+@@ -725,7 +684,7 @@ PJ_DEF(pj_status_t) pjsip_100rel_tx_response(pjsip_inv_session *inv,
+      * if it wants to send another response.
+      */
+     old_tdata = tdata;
+-    tdata = clone_tdata(dd, old_tdata);
++    pjsip_tx_data_clone(old_tdata, 0, &tdata);
+     pjsip_tx_data_dec_ref(old_tdata);
+     
+ 
+diff --git a/pjsip/src/pjsip-ua/sip_inv.c b/pjsip/src/pjsip-ua/sip_inv.c
+index 16a0e17..da28903 100644
+--- a/pjsip/src/pjsip-ua/sip_inv.c
++++ b/pjsip/src/pjsip-ua/sip_inv.c
+@@ -2382,6 +2382,7 @@ PJ_DEF(pj_status_t) pjsip_inv_answer(	pjsip_inv_session *inv,
+ 					pjsip_tx_data **p_tdata )
+ {
+     pjsip_tx_data *last_res;
++    pjsip_tx_data *old_res;
+     pj_status_t status;
+ 
+     /* Verify arguments. */
+@@ -2397,8 +2398,19 @@ PJ_DEF(pj_status_t) pjsip_inv_answer(	pjsip_inv_session *inv,
+ 
+     pjsip_dlg_inc_lock(inv->dlg);
+ 
++    /* Clone last response.
++     * The tdata (last_answer) is a shared object used by the transaction.
++     * Modifying a shared object might lead to a deadlock.
++     * Refer to ticket #2137 for more detail.
++     */
++    status = pjsip_tx_data_clone(inv->last_answer, 0, &last_res);
++    if (status != PJ_SUCCESS)
++	goto on_return;
++    old_res = inv->last_answer;
++    inv->last_answer = last_res;
++    pjsip_tx_data_dec_ref(old_res);
++
+     /* Modify last response. */
+-    last_res = inv->last_answer;
+     status = pjsip_dlg_modify_response(inv->dlg, last_res, st_code, st_text);
+     if (status != PJ_SUCCESS)
+ 	goto on_return;
+diff --git a/pjsip/src/pjsip/sip_transport.c b/pjsip/src/pjsip/sip_transport.c
+index f350fe7..3a8baca 100644
+--- a/pjsip/src/pjsip/sip_transport.c
++++ b/pjsip/src/pjsip/sip_transport.c
+@@ -643,6 +643,53 @@ PJ_DEF(pj_status_t) pjsip_tx_data_set_transport(pjsip_tx_data *tdata,
+     return PJ_SUCCESS;
+ }
+ 
++/* Clone pjsip_tx_data. */
++PJ_DEF(pj_status_t) pjsip_tx_data_clone(const pjsip_tx_data *src,
++                                        unsigned flags,
++				  	pjsip_tx_data ** p_tdata)
++{
++    pjsip_tx_data *dst;
++    const pjsip_hdr *hsrc;
++    pjsip_msg *msg;
++    pj_status_t status;
++
++    PJ_UNUSED_ARG(flags);
++
++    status = pjsip_tx_data_create(src->mgr, p_tdata);
++    if (status != PJ_SUCCESS)
++	return status;
++
++    dst = *p_tdata;
++
++    msg = pjsip_msg_create(dst->pool, PJSIP_RESPONSE_MSG);
++    dst->msg = msg;
++    pjsip_tx_data_add_ref(dst);
++
++    /* Duplicate status line */
++    msg->line.status.code = src->msg->line.status.code;
++    pj_strdup(dst->pool, &msg->line.status.reason,
++	      &src->msg->line.status.reason);
++
++    /* Duplicate all headers */
++    hsrc = src->msg->hdr.next;
++    while (hsrc != &src->msg->hdr) {
++	pjsip_hdr *h = (pjsip_hdr*) pjsip_hdr_clone(dst->pool, hsrc);
++	pjsip_msg_add_hdr(msg, h);
++	hsrc = hsrc->next;
++    }
++
++    /* Duplicate message body */
++    if (src->msg->body)
++	msg->body = pjsip_msg_body_clone(dst->pool, src->msg->body);
++
++    dst->is_pending = src->is_pending;
++
++    PJ_LOG(5,(THIS_FILE,
++	     "Tx data %s cloned",
++	     pjsip_tx_data_get_info(dst)));
++
++    return PJ_SUCCESS;
++}
+ 
+ PJ_DEF(char*) pjsip_rx_data_get_info(pjsip_rx_data *rdata)
+ {
+-- 
+2.7.4
+