Hi Jan,
when free_cell() frees the memory of a transaction the shm memory lock is already held:
shm_lock(); ... /* callbacks */ for( cbs=(struct tm_callback*)dead_cell->tmcb_hl.first ; cbs ; ) { cbs_tmp = cbs; cbs = cbs->next; if (cbs_tmp->release) { cbs_tmp->release(cbs_tmp->param); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ I think this can cause a dead-lock because the release function is not aware of the state of the shm mem lock.
} shm_free_unsafe( cbs_tmp ); }
I saw that you have added this function call, but I cannot found any customer of this function in the repository, so I do not know whether the cb functions use safe or unsafe shm_free(). Do you know anything about this?
I recently added another place where this cb is called from (without locking), hence I think it would be better to move this outside of the shm mem lock to be on the safe side.
http://git.sip-router.org/cgi-bin/gitweb.cgi?p=sip-router;a=commitdiff;h=657...
Thanks, Miklos