From bd9db5fe87ca536fe977459103df6ac214e5a275 Mon Sep 17 00:00:00 2001
From: sauwming <ming@teluu.com>
Date: Fri, 13 Oct 2023 23:35:39 +0800
Subject: [PATCH] Fixed race condition between TURN session destroy and
 incoming data processing (#3730)

---
 pjnath/src/pjnath/turn_sock.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pjnath/src/pjnath/turn_sock.c b/pjnath/src/pjnath/turn_sock.c
index 36ddaff700..e5b73d4299 100644
--- a/pjnath/src/pjnath/turn_sock.c
+++ b/pjnath/src/pjnath/turn_sock.c
@@ -1183,6 +1183,8 @@ static void turn_on_state(pj_turn_session *sess,
         (*turn_sock->cb.on_state)(turn_sock, old_state, new_state);
     }
 
+    pj_grp_lock_acquire(turn_sock->grp_lock);
+
     /* Make sure user hasn't destroyed us in the callback */
     if (turn_sock->sess && new_state == PJ_TURN_STATE_RESOLVED) {
         pj_turn_session_info info;
@@ -1250,6 +1252,7 @@ static void turn_on_state(pj_turn_session *sess,
             status = pj_sock_socket(turn_sock->af, sock_type, 0, &sock);
             if (status != PJ_SUCCESS) {
                 turn_sock_destroy(turn_sock, status);
+                pj_grp_lock_release(turn_sock->grp_lock);
                 return;
             }
 
@@ -1260,6 +1263,7 @@ static void turn_on_state(pj_turn_session *sess,
             if (status != PJ_SUCCESS) {
                 pj_sock_close(sock);
                 turn_sock_destroy(turn_sock, status);
+                pj_grp_lock_release(turn_sock->grp_lock);
                 return;
             }
             /* Apply QoS, if specified */
@@ -1271,6 +1275,7 @@ static void turn_on_state(pj_turn_session *sess,
             {
                 pj_sock_close(sock);
                 turn_sock_destroy(turn_sock, status);
+                pj_grp_lock_release(turn_sock->grp_lock);
                 return;
             }
 
@@ -1387,6 +1392,7 @@ static void turn_on_state(pj_turn_session *sess,
             }
             if (status != PJ_SUCCESS) {
                 turn_sock_destroy(turn_sock, status);
+                pj_grp_lock_release(turn_sock->grp_lock);
                 return;
             }
             if (turn_sock->cert) {
@@ -1398,6 +1404,7 @@ static void turn_on_state(pj_turn_session *sess,
 
             if (status != PJ_SUCCESS) {
                 turn_sock_destroy(turn_sock, status);
+                pj_grp_lock_release(turn_sock->grp_lock);
                 return;
             }
 
@@ -1415,6 +1422,7 @@ static void turn_on_state(pj_turn_session *sess,
 
         if (status != PJ_SUCCESS) {
             turn_sock_destroy(turn_sock, status);
+            pj_grp_lock_release(turn_sock->grp_lock);
             return;
         }
 
@@ -1457,6 +1465,7 @@ static void turn_on_state(pj_turn_session *sess,
                           pj_sockaddr_print(&info.server, addrtxt,
                                             sizeof(addrtxt), 3)));
             turn_sock_destroy(turn_sock, status);
+            pj_grp_lock_release(turn_sock->grp_lock);
             return;
         }
 
@@ -1478,6 +1487,8 @@ static void turn_on_state(pj_turn_session *sess,
                                           &delay, TIMER_DESTROY,
                                           turn_sock->grp_lock);
     }
+
+    pj_grp_lock_release(turn_sock->grp_lock);
 }