Fixed race condition between TURN session destroy and incoming data p…

…rocessing (#3730)
pjsip · Oct 13, 2023 · bd9db5f · bd9db5f
1 parent 03faa1c
commit bd9db5f
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/pjnath/src/pjnath/turn_sock.c b/pjnath/src/pjnath/turn_sock.c
@@ -1183,6 +1183,8 @@ static void turn_on_state(pj_turn_session *sess,
         (*turn_sock->cb.on_state)(turn_sock, old_state, new_state);
     }
 
+    pj_grp_lock_acquire(turn_sock->grp_lock);
+
     /* Make sure user hasn't destroyed us in the callback */
     if (turn_sock->sess && new_state == PJ_TURN_STATE_RESOLVED) {
         pj_turn_session_info info;
@@ -1250,6 +1252,7 @@ static void turn_on_state(pj_turn_session *sess,
             status = pj_sock_socket(turn_sock->af, sock_type, 0, &sock);
             if (status != PJ_SUCCESS) {
                 turn_sock_destroy(turn_sock, status);
+                pj_grp_lock_release(turn_sock->grp_lock);
                 return;
             }
 
@@ -1260,6 +1263,7 @@ static void turn_on_state(pj_turn_session *sess,
             if (status != PJ_SUCCESS) {
                 pj_sock_close(sock);
                 turn_sock_destroy(turn_sock, status);
+                pj_grp_lock_release(turn_sock->grp_lock);
                 return;
             }
             /* Apply QoS, if specified */
@@ -1271,6 +1275,7 @@ static void turn_on_state(pj_turn_session *sess,
             {
                 pj_sock_close(sock);
                 turn_sock_destroy(turn_sock, status);
+                pj_grp_lock_release(turn_sock->grp_lock);
                 return;
             }
 
@@ -1387,6 +1392,7 @@ static void turn_on_state(pj_turn_session *sess,
             }
             if (status != PJ_SUCCESS) {
                 turn_sock_destroy(turn_sock, status);
+                pj_grp_lock_release(turn_sock->grp_lock);
                 return;
             }
             if (turn_sock->cert) {
@@ -1398,6 +1404,7 @@ static void turn_on_state(pj_turn_session *sess,
 
             if (status != PJ_SUCCESS) {
                 turn_sock_destroy(turn_sock, status);
+                pj_grp_lock_release(turn_sock->grp_lock);
                 return;
             }
 
@@ -1415,6 +1422,7 @@ static void turn_on_state(pj_turn_session *sess,
 
         if (status != PJ_SUCCESS) {
             turn_sock_destroy(turn_sock, status);
+            pj_grp_lock_release(turn_sock->grp_lock);
             return;
         }
 
@@ -1457,6 +1465,7 @@ static void turn_on_state(pj_turn_session *sess,
                           pj_sockaddr_print(&info.server, addrtxt,
                                             sizeof(addrtxt), 3)));
             turn_sock_destroy(turn_sock, status);
+            pj_grp_lock_release(turn_sock->grp_lock);
             return;
         }
 
@@ -1478,6 +1487,8 @@ static void turn_on_state(pj_turn_session *sess,
                                           &delay, TIMER_DESTROY,
                                           turn_sock->grp_lock);
     }
+
+    pj_grp_lock_release(turn_sock->grp_lock);
 }