Merged revisions 100465 via svnmerge from

https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r100465 | tilghman | 2008-01-27 15:59:53 -0600 (Sun, 27 Jan 2008) | 11 lines

When deleting a task from the scheduler, ignoring the return value could
possibly cause memory to be accessed after it is freed, which causes all
sorts of random memory corruption.  Instead, if a deletion fails, wait a
bit and try again (noting that another thread could change our taskid
value).
(closes issue #11386)
 Reported by: flujan
 Patches:
       20080124__bug11386.diff.txt uploaded by Corydon76 (license 14)
 Tested by: Corydon76, flujan, stuarth`

........

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@100488 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_h323.c b/channels/chan_h323.c
index 61dc7c2..bba205e 100644 (file)
--- a/channels/chan_h323.c
+++ b/channels/chan_h323.c
@@ -368,14 +368,12 @@ static void __oh323_update_info(struct ast_channel *c, struct oh323_pvt *pvt)
                if (pvt->newdigit == ' ') {             /* signalUpdate message */
                        f.subclass = pvt->curDTMF;
                        if (pvt->DTMFsched >= 0) {
-                               ast_sched_del(sched, pvt->DTMFsched);
-                               pvt->DTMFsched = -1;
+                               AST_SCHED_DEL(sched, pvt->DTMFsched);
                        }
                } else {                                                /* Regular input or signal message */
                        if (pvt->newduration) {         /* This is a signal, signalUpdate follows */
                                f.frametype = AST_FRAME_DTMF_BEGIN;
-                               if (pvt->DTMFsched >= 0)
-                                       ast_sched_del(sched, pvt->DTMFsched);
+                               AST_SCHED_DEL(sched, pvt->DTMFsched);
                                pvt->DTMFsched = ast_sched_add(sched, pvt->newduration, oh323_simulate_dtmf_end, pvt);
                                if (h323debug)
                                        ast_log(LOG_DTMF, "Scheduled DTMF END simulation for %d ms, id=%d\n", pvt->newduration, pvt->DTMFsched);
@@ -448,10 +446,7 @@ static void __oh323_destroy(struct oh323_pvt *pvt)
 {
        struct oh323_pvt *cur, *prev = NULL;
 
-       if (pvt->DTMFsched >= 0) {
-               ast_sched_del(sched, pvt->DTMFsched);
-               pvt->DTMFsched = -1;
-       }
+       AST_SCHED_DEL(sched, pvt->DTMFsched);
 
        if (pvt->rtp) {
                ast_rtp_destroy(pvt->rtp);
@@ -1846,15 +1841,11 @@ static int receive_digit(unsigned call_reference, char digit, const char *token,
                        };
                        if (digit == ' ') {             /* signalUpdate message */
                                f.subclass = pvt->curDTMF;
-                               if (pvt->DTMFsched >= 0) {
-                                       ast_sched_del(sched, pvt->DTMFsched);
-                                       pvt->DTMFsched = -1;
-                               }
+                               AST_SCHED_DEL(sched, pvt->DTMFsched);
                        } else {                                /* Regular input or signal message */
                                if (pvt->DTMFsched >= 0) {
                                        /* We still don't send DTMF END from previous event, send it now */
-                                       ast_sched_del(sched, pvt->DTMFsched);
-                                       pvt->DTMFsched = -1;
+                                       AST_SCHED_DEL(sched, pvt->DTMFsched);
                                        f.subclass = pvt->curDTMF;
                                        f.samples = f.len = 0;
                                        ast_queue_frame(pvt->owner, &f);

diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index 200a7a1..b2a04b5 100644 (file)
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -1155,7 +1155,7 @@ static void __send_lagrq(const void *data)
        int callno = (long)data;
        /* Ping only if it's real not if it's bridged */
        ast_mutex_lock(&iaxsl[callno]);
-       if (iaxs[callno] && iaxs[callno]->lagid != -1) {
+       if (iaxs[callno] && iaxs[callno]->lagid > -1) {
                send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_LAGRQ, 0, NULL, 0, -1);
                iaxs[callno]->lagid = iax2_sched_add(sched, lagrq_time * 1000, send_lagrq, data);
        }
@@ -1568,8 +1568,7 @@ static int find_callno(unsigned short callno, unsigned short dcallno, struct soc
 
 static void iax2_frame_free(struct iax_frame *fr)
 {
-       if (fr->retrans > -1)
-               ast_sched_del(sched, fr->retrans);
+       AST_SCHED_DEL(sched, fr->retrans);
        iax_frame_free(fr);
 }
 
@@ -2040,24 +2039,12 @@ static void iax2_destroy_helper(struct chan_iax2_pvt *pvt)
                ast_clear_flag(pvt, IAX_MAXAUTHREQ);
        }
        /* No more pings or lagrq's */
-       if (pvt->pingid > -1)
-               ast_sched_del(sched, pvt->pingid);
-       pvt->pingid = -1;
-       if (pvt->lagid > -1)
-               ast_sched_del(sched, pvt->lagid);
-       pvt->lagid = -1;
-       if (pvt->autoid > -1)
-               ast_sched_del(sched, pvt->autoid);
-       pvt->autoid = -1;
-       if (pvt->authid > -1)
-               ast_sched_del(sched, pvt->authid);
-       pvt->authid = -1;
-       if (pvt->initid > -1)
-               ast_sched_del(sched, pvt->initid);
-       pvt->initid = -1;
-       if (pvt->jbid > -1)
-               ast_sched_del(sched, pvt->jbid);
-       pvt->jbid = -1;
+       AST_SCHED_DEL(sched, pvt->pingid);
+       AST_SCHED_DEL(sched, pvt->lagid);
+       AST_SCHED_DEL(sched, pvt->autoid);
+       AST_SCHED_DEL(sched, pvt->authid);
+       AST_SCHED_DEL(sched, pvt->initid);
+       AST_SCHED_DEL(sched, pvt->jbid);
 }
 
 /*!
@@ -2693,8 +2680,8 @@ static void update_jbsched(struct chan_iax2_pvt *pvt)
        when = ast_tvdiff_ms(ast_tvnow(), pvt->rxcore);
        
        when = jb_next(pvt->jb) - when;
-       
-       if(when <= 0) {
+
+       if (when <= 0) {
                /* XXX should really just empty until when > 0.. */
                when = 1;
        }
@@ -2847,10 +2834,7 @@ static int schedule_delivery(struct iax_frame *fr, int updatehistory, int fromtr
 
                jb_reset(iaxs[fr->callno]->jb);
 
-               if (iaxs[fr->callno]->jbid > -1)
-                       ast_sched_del(sched, iaxs[fr->callno]->jbid);
-
-               iaxs[fr->callno]->jbid = -1;
+               AST_SCHED_DEL(sched, iaxs[fr->callno]->jbid);
 
                /* deliver this frame now */
                if (tsout)
@@ -7988,11 +7972,7 @@ retryowner:
                        }
                }
                if (f.frametype == AST_FRAME_IAX) {
-                       if (iaxs[fr->callno]->initid > -1) {
-                               /* Don't auto congest anymore since we've gotten something usefulb ack */
-                               ast_sched_del(sched, iaxs[fr->callno]->initid);
-                               iaxs[fr->callno]->initid = -1;
-                       }
+                       AST_SCHED_DEL(sched, iaxs[fr->callno]->initid);
                        /* Handle the IAX pseudo frame itself */
                        if (iaxdebug)
                                ast_debug(1, "IAX subclass %d received\n", f.subclass);
@@ -9966,9 +9946,7 @@ static struct iax2_peer *build_peer(const char *name, struct ast_variable *v, st
                                        }
                                } else {
                                        /* Non-dynamic.  Make sure we become that way if we're not */
-                                       if (peer->expire > -1)
-                                               ast_sched_del(sched, peer->expire);
-                                       peer->expire = -1;
+                                       AST_SCHED_DEL(sched, peer->expire);
                                        ast_clear_flag(peer, IAX_DYNAMIC);
                                        if (ast_dnsmgr_lookup(v->value, &peer->addr.sin_addr, &peer->dnsmgr))
                                                return peer_unref(peer);
@@ -10347,8 +10325,7 @@ static void delete_users(void)
 
        AST_LIST_LOCK(&registrations);
        while ((reg = AST_LIST_REMOVE_HEAD(&registrations, entry))) {
-               if (reg->expire > -1)
-                       ast_sched_del(sched, reg->expire);
+               AST_SCHED_DEL(sched, reg->expire);
                if (reg->callno) {
                        ast_mutex_lock(&iaxsl[reg->callno]);
                        if (iaxs[reg->callno]) {

diff --git a/channels/chan_mgcp.c b/channels/chan_mgcp.c
index 526e8e2..3e9af57 100644 (file)
--- a/channels/chan_mgcp.c
+++ b/channels/chan_mgcp.c
@@ -3355,9 +3355,8 @@ static int mgcpsock_read(int *id, int fd, short events, void *ignore)
                        }
 
                        /* stop retrans timer if the queue is empty */
-                       if (!gw->msgs && (gw->retransid != -1)) {
-                               ast_sched_del(sched, gw->retransid);
-                               gw->retransid = -1;
+                       if (!gw->msgs) {
+                               AST_SCHED_DEL(sched, gw->retransid);
                        }
 
                        ast_mutex_unlock(&gw->msgs_lock);
@@ -3609,9 +3608,7 @@ static struct mgcp_gateway *build_gateway(char *cat, struct ast_variable *v)
                                        }
                                } else {
                                        /* Non-dynamic.  Make sure we become that way if we're not */
-                                       if (gw->expire > -1)
-                                               ast_sched_del(sched, gw->expire);
-                                       gw->expire = -1;
+                                       AST_SCHED_DEL(sched, gw->expire);
                                        gw->dynamic = 0;
                                        if (ast_get_ip(&gw->addr, v->value)) {
                                                if (!gw_reload) {

diff --git a/channels/chan_misdn.c b/channels/chan_misdn.c
index a0153ef..ca39186 100644 (file)
--- a/channels/chan_misdn.c
+++ b/channels/chan_misdn.c
@@ -652,7 +652,7 @@ static int misdn_tasks_add_variable (int timeout, ast_sched_cb callback, const v
 
 static void misdn_tasks_remove (int task_id)
 {
-       ast_sched_del(misdn_tasks, task_id);
+       AST_SCHED_DEL(misdn_tasks, task_id);
 }
 
 static int misdn_l1_task (const void *data)

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 8a8ae81..046d4ab 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -1726,7 +1726,7 @@ static struct sip_pvt *sip_alloc(ast_string_field callid, struct sockaddr_in *si
                                 int useglobal_nat, const int intended_method);
 static int __sip_autodestruct(const void *data);
 static void sip_scheddestroy(struct sip_pvt *p, int ms);
-static void sip_cancel_destroy(struct sip_pvt *p);
+static int sip_cancel_destroy(struct sip_pvt *p);
 static struct sip_pvt *sip_destroy(struct sip_pvt *p);
 static void __sip_destroy(struct sip_pvt *p, int lockowner, int lockdialoglist);
 static void __sip_ack(struct sip_pvt *p, int seqno, int resp, int sipmethod);
@@ -2819,11 +2819,12 @@ static enum sip_result __sip_reliable_xmit(struct sip_pvt *p, int seqno, int res
 
        if (xmitres == XMIT_ERROR) {    /* Serious network trouble, no need to try again */
                append_history(pkt->owner, "XmitErr", "%s", pkt->is_fatal ? "(Critical)" : "(Non-critical)");
-               ast_sched_del(sched, pkt->retransid);   /* No more retransmission */
-               pkt->retransid = -1;
                return AST_FAILURE;
-       } else
+       } else {
+               /* Schedule retransmission */
+               pkt->retransid = ast_sched_add_variable(sched, siptimer_a, retrans_pkt, pkt, 1);
                return AST_SUCCESS;
+       }
 }
 
 /*! \brief Kill a SIP dialog (called only by the scheduler)
@@ -2889,7 +2890,9 @@ static void sip_scheddestroy(struct sip_pvt *p, int ms)
        }
        if (sip_debug_test_pvt(p))
                ast_verbose("Scheduling destruction of SIP dialog '%s' in %d ms (Method: %s)\n", p->callid, ms, sip_methods[p->method].text);
-       sip_cancel_destroy(p);
+       if (sip_cancel_destroy(p))
+               ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
+
        if (p->do_history)
                append_history(p, "SchedDestroy", "%d ms", ms);
        p->autokillid = ast_sched_add(sched, ms, __sip_autodestruct, dialog_ref(p));
@@ -2902,14 +2905,17 @@ static void sip_scheddestroy(struct sip_pvt *p, int ms)
  * Be careful as this also absorbs the reference - if you call it
  * from within the scheduler, this might be the last reference.
  */
-static void sip_cancel_destroy(struct sip_pvt *p)
+static int sip_cancel_destroy(struct sip_pvt *p)
 {
+       int res = 0;
        if (p->autokillid > -1) {
-               ast_sched_del(sched, p->autokillid);
-               append_history(p, "CancelDestroy", "");
-               p->autokillid = -1;
+               if (!(res = ast_sched_del(sched, p->autokillid))) {
+                       append_history(p, "CancelDestroy", "");
+                       p->autokillid = -1;
+               }
                dialog_unref(p);
        }
+       return res;
 }
 
 /*! \brief Acknowledges receipt of a packet and stops retransmission */
@@ -2940,8 +2946,6 @@ static void __sip_ack(struct sip_pvt *p, int seqno, int resp, int sipmethod)
                        if (cur->retransid > -1) {
                                if (sipdebug)
                                        ast_debug(4, "** SIP TIMER: Cancelling retransmit of packet (reply received) Retransid #%d\n", cur->retransid);
-                               ast_sched_del(sched, cur->retransid);
-                               cur->retransid = -1;
                        }
                        UNLINK(cur, p->packets, prev);
                        dialog_unref(cur->owner);
@@ -2985,9 +2989,8 @@ static int __sip_semi_ack(struct sip_pvt *p, int seqno, int resp, int sipmethod)
                        if (cur->retransid > -1) {
                                if (sipdebug)
                                        ast_debug(4, "*** SIP TIMER: Cancelling retransmission #%d - %s (got response)\n", cur->retransid, sip_methods[sipmethod].text);
-                               ast_sched_del(sched, cur->retransid);
-                               cur->retransid = -1;
                        }
+                       AST_SCHED_DEL(sched, cur->retransid);
                        res = 0;
                        break;
                }
@@ -3400,10 +3403,8 @@ static void sip_destroy_peer(struct sip_peer *peer)
         *
         * NOTE: once peer is refcounted, this probably is no longer necessary.
         */
-       while (peer->expire > -1 && ast_sched_del(sched, peer->expire))
-               usleep(1);
-       while (peer->pokeexpire > -1 && ast_sched_del(sched, peer->pokeexpire))
-               usleep(1);
+       AST_SCHED_DEL(sched, peer->expire);
+       AST_SCHED_DEL(sched, peer->pokeexpire);
 
        register_peer_exten(peer, FALSE);
        ast_free_ha(peer->ha);
@@ -4105,10 +4106,8 @@ static void sip_registry_destroy(struct sip_registry *reg)
                ast_debug(3, "Destroying active SIP dialog for registry %s@%s\n", reg->username, reg->hostname);
                reg->call = sip_destroy(reg->call);
        }
-       if (reg->expire > -1)
-               ast_sched_del(sched, reg->expire);
-       if (reg->timeout > -1)
-               ast_sched_del(sched, reg->timeout);
+       AST_SCHED_DEL(sched, reg->expire);
+       AST_SCHED_DEL(sched, reg->timeout);
        ast_string_field_free_memory(reg);
        regobjs--;
        ast_free(reg);
@@ -4141,12 +4140,9 @@ static void __sip_destroy(struct sip_pvt *p, int lockowner, int lockdialoglist)
 
        if (p->stateid > -1)
                ast_extension_state_del(p->stateid, NULL);
-       if (p->initid > -1)
-               ast_sched_del(sched, p->initid);
-       if (p->waitid > -1)
-               ast_sched_del(sched, p->waitid);
-       if (p->autokillid > -1)
-               ast_sched_del(sched, p->autokillid);
+       AST_SCHED_DEL(sched, p->initid);
+       AST_SCHED_DEL(sched, p->waitid);
+       AST_SCHED_DEL(sched, p->autokillid);
 
        if (p->rtp)
                ast_rtp_destroy(p->rtp);
@@ -4214,8 +4210,7 @@ static void __sip_destroy(struct sip_pvt *p, int lockowner, int lockdialoglist)
        /* remove all current packets in this dialog */
        while((cp = p->packets)) {
                p->packets = p->packets->next;
-               if (cp->retransid > -1)
-                       ast_sched_del(sched, cp->retransid);
+               AST_SCHED_DEL(sched, cp->retransid);
                dialog_unref(cp->owner);
                ast_free(cp);
        }
@@ -4544,8 +4539,8 @@ static int sip_hangup(struct ast_channel *ast)
                        update_call_counter(p, DEC_CALL_LIMIT);
                }
                ast_debug(4, "SIP Transfer: Not hanging up right now... Rescheduling hangup for %s.\n", p->callid);
-               if (p->autokillid > -1)
-                       sip_cancel_destroy(p);
+               if (p->autokillid > -1 && sip_cancel_destroy(p))
+                       ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);
                ast_clear_flag(&p->flags[0], SIP_DEFER_BYE_ON_TRANSFER);        /* Really hang up next time */
                p->needdestroy = 0;
@@ -4675,10 +4670,9 @@ static int sip_hangup(struct ast_channel *ast)
                                   but we can't send one while we have "INVITE" outstanding. */
                                ast_set_flag(&p->flags[0], SIP_PENDINGBYE);     
                                ast_clear_flag(&p->flags[0], SIP_NEEDREINVITE); 
-                               if (p->waitid)
-                                       ast_sched_del(sched, p->waitid);
-                               p->waitid = -1;
-                               sip_cancel_destroy(p);
+                               AST_SCHED_DEL(sched, p->waitid);
+                               if (sip_cancel_destroy(p))
+                                       ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                        }
                }
        }
@@ -8989,7 +8983,7 @@ static int transmit_register(struct sip_registry *r, int sipmethod, const char *
                                        global_reg_timeout * 1000, sip_reg_timeout, r);
                                ast_log(LOG_WARNING, "Still have a registration timeout for %s@%s (create_addr() error), %d\n", r->username, r->hostname, r->timeout);
                        } else {
-                               r->timeout = ast_sched_add(sched, global_reg_timeout*1000, sip_reg_timeout, r);
+                               r->timeout = ast_sched_add(sched, global_reg_timeout * 1000, sip_reg_timeout, r);
                                ast_log(LOG_WARNING, "Probably a DNS error for registration to %s@%s, trying REGISTER again (after %d seconds)\n", r->username, r->hostname, global_reg_timeout);
                        }
                        r->regattempts++;
@@ -9551,9 +9545,7 @@ static enum parse_register_result parse_register_contact(struct sip_pvt *pvt, st
        } else if (!strcasecmp(curi, "*") || !expiry) { /* Unregister this peer */
                /* This means remove all registrations and return OK */
                memset(&peer->addr, 0, sizeof(peer->addr));
-               if (peer->expire > -1)
-                       ast_sched_del(sched, peer->expire);
-               peer->expire = -1;
+               AST_SCHED_DEL(sched, peer->expire);
 
                destroy_association(peer);
                
@@ -9610,10 +9602,7 @@ static enum parse_register_result parse_register_contact(struct sip_pvt *pvt, st
        if (!ast_strlen_zero(curi) && ast_strlen_zero(peer->username))
                ast_copy_string(peer->username, curi, sizeof(peer->username));
 
-       if (peer->expire > -1) {
-               ast_sched_del(sched, peer->expire);
-               peer->expire = -1;
-       }
+       AST_SCHED_DEL(sched, peer->expire);
        if (expiry > max_expiry)
                expiry = max_expiry;
        if (expiry < min_expiry)
@@ -9983,8 +9972,8 @@ static int cb_extensionstate(char *context, char* exten, int state, void *data)
        switch(state) {
        case AST_EXTENSION_DEACTIVATED: /* Retry after a while */
        case AST_EXTENSION_REMOVED:     /* Extension is gone */
-               if (p->autokillid > -1)
-                       sip_cancel_destroy(p);  /* Remove subscription expiry for renewals */
+               if (p->autokillid > -1 && sip_cancel_destroy(p))        /* Remove subscription expiry for renewals */
+                       ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);     /* Delete subscription in 32 secs */
                ast_verb(2, "Extension state: Watcher for hint %s %s. Notify User %s\n", exten, state == AST_EXTENSION_DEACTIVATED ? "deactivated" : "removed", p->username);
                p->stateid = -1;
@@ -10113,7 +10102,8 @@ static enum check_auth_result register_verify(struct sip_pvt *p, struct sockaddr
                        if (ast_test_flag(&p->flags[1], SIP_PAGE2_REGISTERTRYING))
                                transmit_response(p, "100 Trying", req);
                        if (!(res = check_auth(p, req, peer->name, peer->secret, peer->md5secret, SIP_REGISTER, uri, XMIT_UNRELIABLE, req->ignore))) {
-                               sip_cancel_destroy(p);
+                               if (sip_cancel_destroy(p))
+                                       ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
 
                                /* We have a successful registration attempt with proper authentication,
                                   now, update the peer */
@@ -10146,7 +10136,8 @@ static enum check_auth_result register_verify(struct sip_pvt *p, struct sockaddr
                peer = temp_peer(name);
                if (peer) {
                        ASTOBJ_CONTAINER_LINK(&peerl, peer);
-                       sip_cancel_destroy(p);
+                       if (sip_cancel_destroy(p))
+                               ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                        switch (parse_register_contact(p, peer, req)) {
                        case PARSE_REGISTER_FAILED:
                                ast_log(LOG_WARNING, "Failed to parse contact info\n");
@@ -14252,11 +14243,8 @@ static void handle_response_invite(struct sip_pvt *p, int resp, char *rest, stru
        }
 
        /* Acknowledge sequence number - This only happens on INVITE from SIP-call */
-       if (p->initid > -1) {
-               /* Don't auto congest anymore since we've gotten something useful back */
-               ast_sched_del(sched, p->initid);
-               p->initid = -1;
-       }
+       /* Don't auto congest anymore since we've gotten something useful back */
+       AST_SCHED_DEL(sched, p->initid);
 
        /* RFC3261 says we must treat every 1xx response (but not 100)
           that we don't recognize as if it was 183.
@@ -14276,15 +14264,15 @@ static void handle_response_invite(struct sip_pvt *p, int resp, char *rest, stru
        switch (resp) {
        case 100:       /* Trying */
        case 101:       /* Dialog establishment */
-               if (!req->ignore && p->invitestate != INV_CANCELLED)
-                       sip_cancel_destroy(p);
+               if (!req->ignore && p->invitestate != INV_CANCELLED && sip_cancel_destroy(p))
+                       ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                check_pendings(p);
                break;
 
        case 180:       /* 180 Ringing */
        case 182:       /* 182 Queued */
-               if (!req->ignore && p->invitestate != INV_CANCELLED)
-                       sip_cancel_destroy(p);
+               if (!req->ignore && p->invitestate != INV_CANCELLED && sip_cancel_destroy(p))
+                       ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                if (!req->ignore && p->owner) {
                        ast_queue_control(p->owner, AST_CONTROL_RINGING);
                        if (p->owner->_state != AST_STATE_UP) {
@@ -14304,8 +14292,8 @@ static void handle_response_invite(struct sip_pvt *p, int resp, char *rest, stru
                break;
 
        case 183:       /* Session progress */
-               if (!req->ignore && (p->invitestate != INV_CANCELLED))
-                       sip_cancel_destroy(p);
+               if (!req->ignore && (p->invitestate != INV_CANCELLED) && sip_cancel_destroy(p))
+                       ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                /* Ignore 183 Session progress without SDP */
                if (find_sdp(req)) {
                        if (p->invitestate != INV_CANCELLED)
@@ -14320,8 +14308,8 @@ static void handle_response_invite(struct sip_pvt *p, int resp, char *rest, stru
                break;
 
        case 200:       /* 200 OK on invite - someone's answering our call */
-               if (!req->ignore && (p->invitestate != INV_CANCELLED))
-                       sip_cancel_destroy(p);
+               if (!req->ignore && (p->invitestate != INV_CANCELLED) && sip_cancel_destroy(p))
+                       ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                p->authtries = 0;
                if (find_sdp(req)) {
                        if ((res = process_sdp(p, req)) && !req->ignore)
@@ -14670,8 +14658,7 @@ static int handle_response_register(struct sip_pvt *p, int resp, char *rest, str
                break;
        case 403:       /* Forbidden */
                ast_log(LOG_WARNING, "Forbidden - wrong password on authentication for REGISTER for '%s' to '%s'\n", p->registry->username, p->registry->hostname);
-               ast_sched_del(sched, r->timeout);
-               r->timeout = -1;
+               AST_SCHED_DEL(sched, r->timeout);
                r->regstate = REG_STATE_NOAUTH;
                p->needdestroy = 1;
                break;
@@ -14680,8 +14667,7 @@ static int handle_response_register(struct sip_pvt *p, int resp, char *rest, str
                p->needdestroy = 1;
                r->call = NULL;
                r->regstate = REG_STATE_REJECTED;
-               ast_sched_del(sched, r->timeout);
-               r->timeout = -1;
+               AST_SCHED_DEL(sched, r->timeout);
                break;
        case 407:       /* Proxy auth */
                if (p->authtries == MAX_AUTHTRIES || do_register_auth(p, req, resp)) {
@@ -14694,8 +14680,7 @@ static int handle_response_register(struct sip_pvt *p, int resp, char *rest, str
                        p->registry->regattempts = global_regattempts_max+1;
                p->needdestroy = 1;
                r->call = NULL;
-               ast_sched_del(sched, r->timeout);
-               r->timeout = -1;
+               AST_SCHED_DEL(sched, r->timeout);
                break;
        case 423:       /* Interval too brief */
                r->expiry = atoi(get_header(req, "Min-Expires"));
@@ -14721,8 +14706,7 @@ static int handle_response_register(struct sip_pvt *p, int resp, char *rest, str
                p->needdestroy = 1;
                r->call = NULL;
                r->regstate = REG_STATE_REJECTED;
-               ast_sched_del(sched, r->timeout);
-               r->timeout = -1;
+               AST_SCHED_DEL(sched, r->timeout);
                break;
        case 200:       /* 200 OK */
                if (!r) {
@@ -14738,9 +14722,8 @@ static int handle_response_register(struct sip_pvt *p, int resp, char *rest, str
                ast_debug(1, "Registration successful\n");
                if (r->timeout > -1) {
                        ast_debug(1, "Cancelling timeout %d\n", r->timeout);
-                       ast_sched_del(sched, r->timeout);
                }
-               r->timeout=-1;
+               AST_SCHED_DEL(sched, r->timeout);
                r->call = NULL;
                p->registry = NULL;
                /* Let this one hang around until we have all the responses */
@@ -14749,8 +14732,7 @@ static int handle_response_register(struct sip_pvt *p, int resp, char *rest, str
 
                /* set us up for re-registering */
                /* figure out how long we got registered for */
-               if (r->expire > -1)
-                       ast_sched_del(sched, r->expire);
+               AST_SCHED_DEL(sched, r->expire);
                /* according to section 6.13 of RFC, contact headers override
                   expires headers, so check those first */
                expires = 0;
@@ -15133,8 +15115,8 @@ static void handle_response(struct sip_pvt *p, int resp, char *rest, struct sip_
                                        p->needdestroy = 1;
                        } else if ((resp >= 100) && (resp < 200)) {
                                if (sipmethod == SIP_INVITE) {
-                                       if (!req->ignore)
-                                               sip_cancel_destroy(p);
+                                       if (!req->ignore && sip_cancel_destroy(p))
+                                               ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                                        if (find_sdp(req))
                                                process_sdp(p, req);
                                        if (p->owner) {
@@ -15232,8 +15214,8 @@ static void handle_response(struct sip_pvt *p, int resp, char *rest, struct sip_
                default:        /* Errors without handlers */
                        if ((resp >= 100) && (resp < 200)) {
                                if (sipmethod == SIP_INVITE) {  /* re-invite */
-                                       if (!req->ignore)
-                                               sip_cancel_destroy(p);
+                                       if (!req->ignore && sip_cancel_destroy(p))
+                                               ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                                }
                        }
                        if ((resp >= 300) && (resp < 700)) {
@@ -15246,9 +15228,9 @@ static void handle_response(struct sip_pvt *p, int resp, char *rest, struct sip_
                                case 503: /* Service Unavailable */
                                case 504: /* Server timeout */
 
-                                       if (sipmethod == SIP_INVITE) {  /* re-invite failed */
-                                               sip_cancel_destroy(p);
-                                       }
+                                       /* re-invite failed */
+                                       if (sipmethod == SIP_INVITE && sip_cancel_destroy(p))
+                                               ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                                        break;
                                }
                        }
@@ -16048,7 +16030,8 @@ static int handle_request_invite(struct sip_pvt *p, struct sip_request *req, int
        if (!req->ignore) {
                int newcall = (p->initreq.headers ? TRUE : FALSE);
 
-               sip_cancel_destroy(p);
+               if (sip_cancel_destroy(p))
+                       ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                /* This also counts as a pending invite */
                p->pendinginvite = seqno;
                check_via(p, req);
@@ -17427,8 +17410,8 @@ static int handle_request_subscribe(struct sip_pvt *p, struct sip_request *req,
                        else
                                ast_debug(2, "Adding subscription for extension %s context %s for peer %s\n", p->exten, p->context, p->username);
                }
-               if (p->autokillid > -1)
-                       sip_cancel_destroy(p);  /* Remove subscription expiry for renewals */
+               if (p->autokillid > -1 && sip_cancel_destroy(p))        /* Remove subscription expiry for renewals */
+                       ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");
                if (p->expiry > 0)
                        sip_scheddestroy(p, (p->expiry + 10) * 1000);   /* Set timer for destruction of call at expiration */
 
@@ -18578,10 +18561,8 @@ static int sip_poke_peer(struct sip_peer *peer)
        if (!peer->maxms || !peer->addr.sin_addr.s_addr) {
                /* IF we have no IP, or this isn't to be monitored, return
                  immediately after clearing things out */
-               if (peer->pokeexpire > -1)
-                       ast_sched_del(sched, peer->pokeexpire);
+               AST_SCHED_DEL(sched, peer->pokeexpire);
                peer->lastms = 0;
-               peer->pokeexpire = -1;
                peer->call = NULL;
                return 0;
        }
@@ -18613,8 +18594,7 @@ static int sip_poke_peer(struct sip_peer *peer)
        build_via(p);
        build_callid_pvt(p);
 
-       if (peer->pokeexpire > -1)
-               ast_sched_del(sched, peer->pokeexpire);
+       AST_SCHED_DEL(sched, peer->pokeexpire);
        p->relatedpeer = peer;
        ast_set_flag(&p->flags[0], SIP_OUTGOING);
 #ifdef VOCAL_DATA_HACK
@@ -19563,9 +19543,7 @@ static struct sip_peer *build_peer(const char *name, struct ast_variable *v, str
                                peer->host_dynamic = TRUE;
                        } else {
                                /* Non-dynamic.  Make sure we become that way if we're not */
-                               if (peer->expire > -1)
-                                       ast_sched_del(sched, peer->expire);
-                               peer->expire = -1;
+                               AST_SCHED_DEL(sched, peer->expire);
                                peer->host_dynamic = FALSE;
                                srvlookup = v->value;
                        }

diff --git a/include/asterisk/sched.h b/include/asterisk/sched.h
index f074518..dbe0663 100644 (file)
--- a/include/asterisk/sched.h
+++ b/include/asterisk/sched.h
@@ -35,6 +35,16 @@ extern "C" {
  */
 #define SCHED_MAX_CACHE 128
 
+#define AST_SCHED_DEL(sched, id) \
+       do { \
+               int _count = 0; \
+               while (id > -1 && ast_sched_del(sched, id) && _count++ < 10) \
+                       usleep(1); \
+               if (_count == 10) \
+                       ast_log(LOG_WARNING, "Unable to cancel schedule ID %d.  This is probably a bug (%s: %s, line %d).\n", id, __FILE__, __PRETTY_FUNCTION__, __LINE__); \
+               id = -1; \
+       } while (0);
+
 struct sched_context;
 
 /*! \brief New schedule context

diff --git a/main/cdr.c b/main/cdr.c
index 028e0eb..85545be 100644 (file)
--- a/main/cdr.c
+++ b/main/cdr.c
@@ -1139,8 +1139,7 @@ static int submit_scheduled_batch(const void *data)
 static void submit_unscheduled_batch(void)
 {
        /* this is okay since we are not being called from within the scheduler */
-       if (cdr_sched > -1)
-               ast_sched_del(sched, cdr_sched);
+       AST_SCHED_DEL(sched, cdr_sched);
        /* schedule the submission to occur ASAP (1 ms) */
        cdr_sched = ast_sched_add(sched, 1, submit_scheduled_batch, NULL);
        /* signal the do_cdr thread to wakeup early and do some work (that lazy thread ;) */
@@ -1332,8 +1331,7 @@ static int do_reload(int reload)
        batchmode = 0;
 
        /* don't run the next scheduled CDR posting while reloading */
-       if (cdr_sched > -1)
-               ast_sched_del(sched, cdr_sched);
+       AST_SCHED_DEL(sched, cdr_sched);
 
        if (config) {
                if ((enabled_value = ast_variable_retrieve(config, "general", "enable"))) {
@@ -1386,7 +1384,7 @@ static int do_reload(int reload)
                ast_cond_init(&cdr_pending_cond, NULL);
                if (ast_pthread_create_background(&cdr_thread, NULL, do_cdr, NULL) < 0) {
                        ast_log(LOG_ERROR, "Unable to start CDR thread.\n");
-                       ast_sched_del(sched, cdr_sched);
+                       AST_SCHED_DEL(sched, cdr_sched);
                } else {
                        ast_cli_register(&cli_submit);
                        ast_register_atexit(ast_cdr_engine_term);

diff --git a/main/dnsmgr.c b/main/dnsmgr.c
index ed2426c..0989f63 100644 (file)
--- a/main/dnsmgr.c
+++ b/main/dnsmgr.c
@@ -239,7 +239,7 @@ static int refresh_list(const void *data)
 void dnsmgr_start_refresh(void)
 {
        if (refresh_sched > -1) {
-               ast_sched_del(sched, refresh_sched);
+               AST_SCHED_DEL(sched, refresh_sched);
                refresh_sched = ast_sched_add_variable(sched, 100, refresh_list, &master_refresh_info, 1);
        }
 }
@@ -371,8 +371,7 @@ static int do_reload(int loading)
        was_enabled = enabled;
        enabled = 0;
 
-       if (refresh_sched > -1)
-               ast_sched_del(sched, refresh_sched);
+       AST_SCHED_DEL(sched, refresh_sched);
 
        if (config) {
                if ((enabled_value = ast_variable_retrieve(config, "general", "enable"))) {

diff --git a/main/file.c b/main/file.c
index fe51c2d..daffb76 100644 (file)
--- a/main/file.c
+++ b/main/file.c
@@ -747,17 +747,13 @@ int ast_closestream(struct ast_filestream *f)
        if (f->owner) {
                if (f->fmt->format & AST_FORMAT_AUDIO_MASK) {
                        f->owner->stream = NULL;
-                       if (f->owner->streamid > -1)
-                               ast_sched_del(f->owner->sched, f->owner->streamid);
-                       f->owner->streamid = -1;
+                       AST_SCHED_DEL(f->owner->sched, f->owner->streamid);
 #ifdef HAVE_ZAPTEL
                        ast_settimeout(f->owner, 0, NULL, NULL);
 #endif                 
                } else {
                        f->owner->vstream = NULL;
-                       if (f->owner->vstreamid > -1)
-                               ast_sched_del(f->owner->sched, f->owner->vstreamid);
-                       f->owner->vstreamid = -1;
+                       AST_SCHED_DEL(f->owner->sched, f->owner->vstreamid);
                }
        }
        /* destroy the translator on exit */

diff --git a/main/rtp.c b/main/rtp.c
index d59d29b..5671f8a 100644 (file)
--- a/main/rtp.c
+++ b/main/rtp.c
@@ -2374,10 +2374,7 @@ struct ast_rtp *ast_rtp_get_bridged(struct ast_rtp *rtp)
 
 void ast_rtp_stop(struct ast_rtp *rtp)
 {
-       if (rtp->rtcp && rtp->rtcp->schedid > 0) {
-               ast_sched_del(rtp->sched, rtp->rtcp->schedid);
-               rtp->rtcp->schedid = -1;
-       }
+       AST_SCHED_DEL(rtp->sched, rtp->rtcp->schedid);
 
        memset(&rtp->them.sin_addr, 0, sizeof(rtp->them.sin_addr));
        memset(&rtp->them.sin_port, 0, sizeof(rtp->them.sin_port));
@@ -2507,8 +2504,7 @@ void ast_rtp_destroy(struct ast_rtp *rtp)
        if (rtp->s > -1)
                close(rtp->s);
        if (rtp->rtcp) {
-               if (rtp->rtcp->schedid > 0)
-                       ast_sched_del(rtp->sched, rtp->rtcp->schedid);
+               AST_SCHED_DEL(rtp->sched, rtp->rtcp->schedid);
                close(rtp->rtcp->s);
                ast_free(rtp->rtcp);
                rtp->rtcp=NULL;
@@ -2734,9 +2730,7 @@ static int ast_rtcp_write_sr(const void *data)
        
        if (!rtp->rtcp->them.sin_addr.s_addr) {  /* This'll stop rtcp for this rtp session */
                ast_verbose("RTCP SR transmission error, rtcp halted\n");
-               if (rtp->rtcp->schedid > 0)
-                       ast_sched_del(rtp->sched, rtp->rtcp->schedid);
-               rtp->rtcp->schedid = -1;
+               AST_SCHED_DEL(rtp->sched, rtp->rtcp->schedid);
                return 0;
        }
 
@@ -2793,9 +2787,7 @@ static int ast_rtcp_write_sr(const void *data)
        res = sendto(rtp->rtcp->s, (unsigned int *)rtcpheader, len, 0, (struct sockaddr *)&rtp->rtcp->them, sizeof(rtp->rtcp->them));
        if (res < 0) {
                ast_log(LOG_ERROR, "RTCP SR transmission error to %s:%d, rtcp halted %s\n",ast_inet_ntoa(rtp->rtcp->them.sin_addr), ntohs(rtp->rtcp->them.sin_port), strerror(errno));
-               if (rtp->rtcp->schedid > 0)
-                       ast_sched_del(rtp->sched, rtp->rtcp->schedid);
-               rtp->rtcp->schedid = -1;
+               AST_SCHED_DEL(rtp->sched, rtp->rtcp->schedid);
                return 0;
        }
        
@@ -2868,9 +2860,7 @@ static int ast_rtcp_write_rr(const void *data)
          
        if (!rtp->rtcp->them.sin_addr.s_addr) {
                ast_log(LOG_ERROR, "RTCP RR transmission error, rtcp halted\n");
-               if (rtp->rtcp->schedid > 0)
-                       ast_sched_del(rtp->sched, rtp->rtcp->schedid);
-               rtp->rtcp->schedid = -1;
+               AST_SCHED_DEL(rtp->sched, rtp->rtcp->schedid);
                return 0;
        }
 
@@ -2917,9 +2907,7 @@ static int ast_rtcp_write_rr(const void *data)
        if (res < 0) {
                ast_log(LOG_ERROR, "RTCP RR transmission error, rtcp halted: %s\n",strerror(errno));
                /* Remove the scheduler */
-               if (rtp->rtcp->schedid > 0)
-                       ast_sched_del(rtp->sched, rtp->rtcp->schedid);
-               rtp->rtcp->schedid = -1;
+               AST_SCHED_DEL(rtp->sched, rtp->rtcp->schedid);
                return 0;
        }
 

diff --git a/pbx/pbx_dundi.c b/pbx/pbx_dundi.c
index 26a3e51..9d30fe2 100644 (file)
--- a/pbx/pbx_dundi.c
+++ b/pbx/pbx_dundi.c
@@ -1644,8 +1644,7 @@ static int handle_command_response(struct dundi_transaction *trans, struct dundi
                                int expire = default_expiration;
                                char data[256];
                                int needqual = 0;
-                               if (peer->registerexpire > -1)
-                                       ast_sched_del(sched, peer->registerexpire);
+                               AST_SCHED_DEL(sched, peer->registerexpire);
                                peer->registerexpire = ast_sched_add(sched, (expire + 10) * 1000, do_register_expire, peer);
                                snprintf(data, sizeof(data), "%s:%d:%d", ast_inet_ntoa(trans->addr.sin_addr), 
                                        ntohs(trans->addr.sin_port), expire);
@@ -1930,8 +1929,7 @@ static void destroy_packets(struct packetlist *p)
        struct dundi_packet *pack;
        
        while ((pack = AST_LIST_REMOVE_HEAD(p, list))) {
-               if (pack->retransid > -1)
-                       ast_sched_del(sched, pack->retransid);
+               AST_SCHED_DEL(sched, pack->retransid);
                ast_free(pack);
        }
 }
@@ -1950,9 +1948,7 @@ static int ack_trans(struct dundi_transaction *trans, int iseqno)
                                destroy_packets(&trans->lasttrans);
                        }
                        AST_LIST_INSERT_HEAD(&trans->lasttrans, pack, list);
-                       if (trans->autokillid > -1)
-                               ast_sched_del(sched, trans->autokillid);
-                       trans->autokillid = -1;
+                       AST_SCHED_DEL(sched, trans->autokillid);
                        return 1;
                }
        }
@@ -2890,12 +2886,9 @@ static void destroy_packet(struct dundi_packet *pack, int needfree)
 {
        if (pack->parent)
                AST_LIST_REMOVE(&pack->parent->packets, pack, list);
-       if (pack->retransid > -1)
-               ast_sched_del(sched, pack->retransid);
+       AST_SCHED_DEL(sched, pack->retransid);
        if (needfree)
                ast_free(pack);
-       else
-               pack->retransid = -1;
 }
 
 static void destroy_trans(struct dundi_transaction *trans, int fromtimeout)
@@ -2971,9 +2964,7 @@ static void destroy_trans(struct dundi_transaction *trans, int fromtimeout)
        AST_LIST_REMOVE(&alltrans, trans, all);
        destroy_packets(&trans->packets);
        destroy_packets(&trans->lasttrans);
-       if (trans->autokillid > -1)
-               ast_sched_del(sched, trans->autokillid);
-       trans->autokillid = -1;
+       AST_SCHED_DEL(sched, trans->autokillid);
        if (trans->thread) {
                /* If used by a thread, mark as dead and be done */
                ast_set_flag(trans, FLAG_DEAD);
@@ -4116,12 +4107,10 @@ static void destroy_permissions(struct permissionlist *permlist)
 
 static void destroy_peer(struct dundi_peer *peer)
 {
-       if (peer->registerid > -1)
-               ast_sched_del(sched, peer->registerid);
+       AST_SCHED_DEL(sched, peer->registerid);
        if (peer->regtrans)
                destroy_trans(peer->regtrans, 0);
-       if (peer->qualifyid > -1)
-               ast_sched_del(sched, peer->qualifyid);
+       AST_SCHED_DEL(sched, peer->qualifyid);
        destroy_permissions(&peer->permit);
        destroy_permissions(&peer->include);
        ast_free(peer);
@@ -4290,9 +4279,7 @@ static int do_qualify(const void *data)
 static void qualify_peer(struct dundi_peer *peer, int schedonly)
 {
        int when;
-       if (peer->qualifyid > -1)
-               ast_sched_del(sched, peer->qualifyid);
-       peer->qualifyid = -1;
+       AST_SCHED_DEL(sched, peer->qualifyid);
        if (peer->qualtrans)
                destroy_trans(peer->qualtrans, 0);
        peer->qualtrans = NULL;
@@ -4370,9 +4357,7 @@ static void build_peer(dundi_eid *eid, struct ast_variable *v, int *globalpcmode
        peer->us_eid = global_eid;
        destroy_permissions(&peer->permit);
        destroy_permissions(&peer->include);
-       if (peer->registerid > -1)
-               ast_sched_del(sched, peer->registerid);
-       peer->registerid = -1;
+       AST_SCHED_DEL(sched, peer->registerid);
        for (; v; v = v->next) {
                if (!strcasecmp(v->name, "inkey")) {
                        ast_copy_string(peer->inkey, v->value, sizeof(peer->inkey));