Fix crash during CDR update.

The ast_cdr_setcid() and ast_cdr_update() were shown in ASTERISK-18836 to
be called by different threads for the same channel.  The channel driver
thread and the PBX thread running dialplan.

* Add lock protection around CDR API calls that access an ast_channel
pointer.

(closes issue ASTERISK-18836)
Reported by: gpluser

Review: https://reviewboard.asterisk.org/r/1628/
........

Merged revisions 348362 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 348363 from http://svn.asterisk.org/svn/asterisk/branches/10


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@348364 65c4cc65-6c06-0410-ace0-fbb531ad65f3

3 files changed, 25 insertions, 8 deletions

diff --git a/apps/app_authenticate.c b/apps/app_authenticate.c
index 540e3df1c..3bdf48390 100644
--- a/apps/app_authenticate.c
+++ b/apps/app_authenticate.c
@@ -213,14 +213,20 @@ static int auth_exec(struct ast_channel *chan, const char *data)
 						continue;
 					ast_md5_hash(md5passwd, passwd);
 					if (!strcmp(md5passwd, md5secret)) {
-						if (ast_test_flag(&flags,OPT_ACCOUNT))
+						if (ast_test_flag(&flags,OPT_ACCOUNT)) {
+							ast_channel_lock(chan);
 							ast_cdr_setaccount(chan, buf);
+							ast_channel_unlock(chan);
+						}
 						break;
 					}
 				} else {
 					if (!strcmp(passwd, buf)) {
-						if (ast_test_flag(&flags, OPT_ACCOUNT))
+						if (ast_test_flag(&flags, OPT_ACCOUNT)) {
+							ast_channel_lock(chan);
 							ast_cdr_setaccount(chan, buf);
+							ast_channel_unlock(chan);
+						}
 						break;
 					}
 				}
@@ -242,8 +248,11 @@ static int auth_exec(struct ast_channel *chan, const char *data)
 	}
 
 	if ((retries < 3) && !res) {
-		if (ast_test_flag(&flags,OPT_ACCOUNT) && !ast_test_flag(&flags,OPT_MULTIPLE))
+		if (ast_test_flag(&flags,OPT_ACCOUNT) && !ast_test_flag(&flags,OPT_MULTIPLE)) {
+			ast_channel_lock(chan);
 			ast_cdr_setaccount(chan, passwd);
+			ast_channel_unlock(chan);
+		}
 		if (!(res = ast_streamfile(chan, "auth-thankyou", chan->language)))
 			res = ast_waitstream(chan, "");
 	} else {
diff --git a/apps/app_followme.c b/apps/app_followme.c
index bab4d1ba3..9ee2e334e 100644
--- a/apps/app_followme.c
+++ b/apps/app_followme.c
@@ -492,10 +492,12 @@ static void clear_caller(struct findme_user *tmpuser)
 
 	if (tmpuser && tmpuser->ochan && tmpuser->state >= 0) {
 		outbound = tmpuser->ochan;
+		ast_channel_lock(outbound);
 		if (!outbound->cdr) {
 			outbound->cdr = ast_cdr_alloc();
-			if (outbound->cdr)
+			if (outbound->cdr) {
 				ast_cdr_init(outbound->cdr, outbound);
+			}
 		}
 		if (outbound->cdr) {
 			char tmp[256];
@@ -506,11 +508,15 @@ static void clear_caller(struct findme_user *tmpuser)
 			ast_cdr_start(outbound->cdr);
 			ast_cdr_end(outbound->cdr);
 			/* If the cause wasn't handled properly */
-			if (ast_cdr_disposition(outbound->cdr, outbound->hangupcause))
+			if (ast_cdr_disposition(outbound->cdr, outbound->hangupcause)) {
 				ast_cdr_failed(outbound->cdr);
-		} else
+			}
+		} else {
 			ast_log(LOG_WARNING, "Unable to create Call Detail Record\n");
-		ast_hangup(tmpuser->ochan);
+		}
+		ast_channel_unlock(outbound);
+		ast_hangup(outbound);
+		tmpuser->ochan = NULL;
 	}
 }
 
@@ -890,6 +896,7 @@ static void findmeexec(struct fm_args *tpargs)
 					AST_LIST_INSERT_TAIL(findme_user_list, tmpuser, entry);
 				} else {
 					ast_verb(3, "couldn't reach at this number.\n");
+					ast_channel_lock(outbound);
 					if (!outbound->cdr) {
 						outbound->cdr = ast_cdr_alloc();
 					}
@@ -909,6 +916,7 @@ static void findmeexec(struct fm_args *tpargs)
 					} else {
 						ast_log(LOG_ERROR, "Unable to create Call Detail Record\n");
 					}
+					ast_channel_unlock(outbound);
 					ast_hangup(outbound);
 					ast_free(tmpuser);
 				}
diff --git a/apps/app_queue.c b/apps/app_queue.c
index fe8723c54..de88dcaba 100644
--- a/apps/app_queue.c
+++ b/apps/app_queue.c
@@ -5116,9 +5116,9 @@ static int try_calling(struct queue_ent *qe, const char *options, char *announce
 			if ((strcasecmp(cdr->uniqueid, qe->chan->uniqueid)) &&
 			    (strcasecmp(cdr->linkedid, qe->chan->uniqueid)) &&
 			    (newcdr = ast_cdr_dup(cdr))) {
+				ast_channel_lock(qe->chan);
 				ast_cdr_init(newcdr, qe->chan);
 				ast_cdr_reset(newcdr, 0);
-				ast_channel_lock(qe->chan);
 				cdr = ast_cdr_append(cdr, newcdr);
 				cdr = cdr->next;
 				ast_channel_unlock(qe->chan);