res_fax.c: Fix deadlock in fax_gateway_indicate_t38().
authorRichard Mudgett <rmudgett@digium.com>
Mon, 22 Aug 2016 17:31:24 +0000 (12:31 -0500)
committerRichard Mudgett <rmudgett@digium.com>
Thu, 25 Aug 2016 22:11:51 +0000 (17:11 -0500)
fax_gateway_indicate_t38() calls ast_indicate_data() which cannot be
called with any channel locks already held.  A deadlock can happen if the
function is operating on a local channel.

* Made fax_gateway_indicate_t38() unlock the channel before calling
ast_indicate_data() since fax_gateway_indicate_t38() is always called with
the channel locked.

* Made fax_gateway_indicate_t38() return void since nothing cared about
its return value.

ASTERISK-26203
Reported by: Etienne Lessard

ASTERISK-24822
Reported by: David Brillert

ASTERISK-22732
Reported by: Richard Mudgett

Change-Id: I701ff2d26c5fc23e0d5a48a3fd98759a9fd09407

res/res_fax.c

index 94c512d..5bbc896 100644 (file)
@@ -3001,12 +3001,15 @@ static struct ast_frame *fax_gateway_detect_v21(struct fax_gateway *gateway, str
        return f;
 }
 
-static int fax_gateway_indicate_t38(struct ast_channel *chan, struct ast_channel *active, struct ast_control_t38_parameters *control_params)
+/*! \pre chan is locked on entry */
+static void fax_gateway_indicate_t38(struct ast_channel *chan, struct ast_channel *active, struct ast_control_t38_parameters *control_params)
 {
        if (active == chan) {
-               return ast_indicate_data(chan, AST_CONTROL_T38_PARAMETERS, control_params, sizeof(*control_params));
+               ast_channel_unlock(chan);
+               ast_indicate_data(chan, AST_CONTROL_T38_PARAMETERS, control_params, sizeof(*control_params));
+               ast_channel_lock(chan);
        } else {
-               return ast_queue_control_data(chan, AST_CONTROL_T38_PARAMETERS, control_params, sizeof(*control_params));
+               ast_queue_control_data(chan, AST_CONTROL_T38_PARAMETERS, control_params, sizeof(*control_params));
        }
 }