app_confbridge: Fix crash caused when waitmarked/marked users leave together

When waitmarked users join a ConfBridge, the conference state is transitioned
from EMPTY -> INACTIVE. In this state, the users are maintined in a waiting
users list. When a marked user joins, the ConfBridge conference transitions
from INACTIVE -> MULTI_MARKED, and all users are put onto the active list of
users. This process works correctly.

When the marked user leaves, if they are the last marked user, the MULTI_MARKED
state does the following:
(1) It plays back a message to the bridge stating that the leader has left the
    conference. This requires an unlocking of the bridge.
(2) It moves waitmarked users back to the waiting list
(3) It transitions to the appropriate state: in this case, INACTIVE

However, because it plays the prompt back to the bridge before moving the users
and before finishing the state transition, this creates a race condition: with
the bridge unlocked, waitmarked users who leave the conference (or are kicked
from it) can cause a state transition of the bridge to another state before
the conference is transitioned to the INACTIVE state. This causes the state
machine to get a bit wonky, often leading to a crash when the MULTI_MARKED state
attempts to conclude its processing.

This patch fixes this problem:
(1) It prevents kicked users from being kicked again. That's just a nicety.
(2) More importantly, it fixes the race condition by only playing the prompt
    once the state has transitioned correctly to INACTIVE. If waitmarked users
    sneak out during the prompt being played, no harm no foul.

Review: https://reviewboard.asterisk.org/r/3108/

Note that the patch committed here is essentially the same as uploaded by
Simon Moxon on ASTERISK-22740, with the addition of the double kick prevention.

(closes issue AST-1258)
Reported by: Steve Pitts

(closes issue ASTERISK-22740)
Reported by: Simon Moxon
patches:
  ASTERISK-22740.diff uploaded by Simon Moxon (license 6546)
........

Merged revisions 405215 from http://svn.asterisk.org/svn/asterisk/branches/11
........

Merged revisions 405216 from http://svn.asterisk.org/svn/asterisk/branches/12


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@405217 65c4cc65-6c06-0410-ace0-fbb531ad65f3

1 files changed, 16 insertions, 11 deletions

diff --git a/apps/confbridge/conf_state_multi_marked.c b/apps/confbridge/conf_state_multi_marked.c
index 525cc4d5f..42a8e7ea2 100644
--- a/apps/confbridge/conf_state_multi_marked.c
+++ b/apps/confbridge/conf_state_multi_marked.c
@@ -81,23 +81,16 @@ static void leave_active(struct confbridge_user *user)
 static void leave_marked(struct confbridge_user *user)
 {
 	struct confbridge_user *user_iter;
+	int need_prompt = 0;
 
 	conf_remove_user_marked(user->conference, user);
 
 	if (user->conference->markedusers == 0) {
-		/* Play back the audio prompt saying the leader has left the conference */
-		if (!ast_test_flag(&user->u_profile, USER_OPT_QUIET)) {
-			ao2_unlock(user->conference);
-			ast_autoservice_start(user->chan);
-			play_sound_file(user->conference,
-				conf_get_sound(CONF_SOUND_LEADER_HAS_LEFT, user->b_profile.sounds));
-			ast_autoservice_stop(user->chan);
-			ao2_lock(user->conference);
-		}
+		need_prompt = 1;
 
 		AST_LIST_TRAVERSE_SAFE_BEGIN(&user->conference->active_list, user_iter, list) {
-			/* Kick ENDMARKED user_iters */
-			if (ast_test_flag(&user_iter->u_profile, USER_OPT_ENDMARKED)) {
+			/* Kick ENDMARKED cbu_iters */
+			if (ast_test_flag(&user_iter->u_profile, USER_OPT_ENDMARKED) && !user_iter->kicked) {
 				if (ast_test_flag(&user_iter->u_profile, USER_OPT_WAITMARKED)
 					&& !ast_test_flag(&user_iter->u_profile, USER_OPT_MARKEDUSER)) {
 					AST_LIST_REMOVE_CURRENT(list);
@@ -164,6 +157,18 @@ static void leave_marked(struct confbridge_user *user)
 			break; /* Stay in marked */
 		}
 	}
+
+	if (need_prompt) {
+		/* Play back the audio prompt saying the leader has left the conference */
+		if (!ast_test_flag(&user->u_profile, USER_OPT_QUIET)) {
+			ao2_unlock(user->conference);
+			ast_autoservice_start(user->chan);
+			play_sound_file(user->conference,
+				conf_get_sound(CONF_SOUND_LEADER_HAS_LEFT, user->b_profile.sounds));
+			ast_autoservice_stop(user->chan);
+			ao2_lock(user->conference);
+		}
+	}
 }
 
 static void transition_to_marked(struct confbridge_user *user)