res_pjsip_session: Add cleanup to ast_sip_session_terminate

If you use ast_request to create a PJSIP channel but then hang it
up without causing a transaction to be sent, the session will
never be destroyed.  This is due ot the fact that it's pjproject
that triggers the session cleanup when the transaction ends.
app_chanisavail was doing this to get more granular channel state
and it's also possible for this to happen via ARI.

* ast_sip_session_terminate was modified to explicitly call the
  cleanup tasks and unreference session if the invite state is NULL
  AND invite_tsx is NULL (meaning we never sent a transaction).

* chan_pjsip/hangup was modified to bump session before it calls
  ast_sip_session_terminate to insure that session stays valid
  while it does its own cleanup.

* Added test events to session_destructor for a future testsuite
  test.

ASTERISK-26908 #close
Reported-by: Richard Mudgett

Change-Id: I52daf6f757184e5544c261f64f6fe9602c4680a9

1 files changed, 7 insertions, 2 deletions

diff --git a/channels/chan_pjsip.c b/channels/chan_pjsip.c
index a92816431..5bf339ee9 100644
--- a/channels/chan_pjsip.c
+++ b/channels/chan_pjsip.c
@@ -2052,11 +2052,16 @@ static int hangup(void *data)
 	struct ast_sip_session *session = channel->session;
 	int cause = h_data->cause;
 
-	ast_sip_session_terminate(session, cause);
+	/*
+	 * It's possible that session_terminate might cause the session to be destroyed
+	 * immediately so we need to keep a reference to it so we can NULL session->channel
+	 * afterwards.
+	 */
+	ast_sip_session_terminate(ao2_bump(session), cause);
 	clear_session_and_channel(session, ast, pvt);
+	ao2_cleanup(session);
 	ao2_cleanup(channel);
 	ao2_cleanup(h_data);
-
 	return 0;
 }