From dbd8908f8d13e6f6c62738ccb9ff6aee0f2d0c30 Mon Sep 17 00:00:00 2001
From: George Joseph <gjoseph@digium.com>
Date: Tue, 9 Feb 2021 10:25:27 -0700
Subject: [PATCH] res_pjsip_refer: Always serialize calls to
 refer_progress_notify

refer_progress_notify wasn't always being called from the progress
serializer.  This could allow clearing notification->progress->sub
in one thread while another was trying to use it.

* Instances where refer_progress_notify was being called in-line,
  have been changed to use ast_sip_push_task().

Change-Id: Idcf1934c4e873f2c82e2d106f8d9f040caf9fa1e
---
 res/res_pjsip_refer.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/res/res_pjsip_refer.c b/res/res_pjsip_refer.c
index 06ea0b65b5..030e2be507 100644
--- a/res/res_pjsip_refer.c
+++ b/res/res_pjsip_refer.c
@@ -560,7 +560,9 @@ static int refer_attended_task(void *data)
 		notification = refer_progress_notification_alloc(attended->progress, response,
 			PJSIP_EVSUB_STATE_TERMINATED);
 		if (notification) {
-			refer_progress_notify(notification);
+			if (ast_sip_push_task(attended->progress->serializer, refer_progress_notify, notification)) {
+				ao2_cleanup(notification);
+			}
 		}
 	}
 
@@ -616,7 +618,9 @@ static void refer_blind_callback(struct ast_channel *chan, struct transfer_chann
 			PJSIP_EVSUB_STATE_TERMINATED);
 
 		if (notification) {
-			refer_progress_notify(notification);
+			if (ast_sip_push_task(refer->progress->serializer, refer_progress_notify, notification)) {
+				ao2_cleanup(notification);
+			}
 		}
 	} else if (refer->progress) {
 		/* If attended transfer and progress monitoring is being done attach a frame hook so we can monitor it */
@@ -637,7 +641,9 @@ static void refer_blind_callback(struct ast_channel *chan, struct transfer_chann
 				ast_channel_name(chan));
 
 			if (notification) {
-				refer_progress_notify(notification);
+				if (ast_sip_push_task(refer->progress->serializer, refer_progress_notify, notification)) {
+					ao2_cleanup(notification);
+				}
 			}
 		}
 
@@ -660,7 +666,9 @@ static void refer_blind_callback(struct ast_channel *chan, struct transfer_chann
 				ast_channel_name(chan));
 
 			if (notification) {
-				refer_progress_notify(notification);
+				if (ast_sip_push_task(refer->progress->serializer, refer_progress_notify, notification)) {
+					ao2_cleanup(notification);
+				}
 			}
 
 			ao2_cleanup(refer->progress);
@@ -680,7 +688,9 @@ static void refer_blind_callback(struct ast_channel *chan, struct transfer_chann
 					ast_channel_name(chan));
 
 			if (notification) {
-				refer_progress_notify(notification);
+				if (ast_sip_push_task(refer->progress->serializer, refer_progress_notify, notification)) {
+					ao2_cleanup(notification);
+				}
 			}
 
 			ast_channel_lock(chan);
@@ -1155,7 +1165,9 @@ static int refer_incoming_refer_request(struct ast_sip_session *session, struct
 
 		if (notification) {
 			/* The refer_progress_notify function will call ao2_cleanup on this for us */
-			refer_progress_notify(notification);
+			if (ast_sip_push_task(progress->serializer, refer_progress_notify, notification)) {
+				ao2_cleanup(notification);
+			}
 		}
 	}
 
-- 
GitLab