res_pjsip_pubsub: Ensure dialog manipulation happens on proper thread.

When destroying a subscription we remove the serializer from its dialog
and decrease its reference count. Depending on which thread dropped the
subscription reference count to 0 it was possible for this to occur in
a thread where it is not possible.

(closes issue ASTERISK-22952)
Reported by: Matt Jordan
........

Merged revisions 404553 from http://svn.asterisk.org/svn/asterisk/branches/12


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@404554 65c4cc65-6c06-0410-ace0-fbb531ad65f3

res/res_pjsip_pubsub.c

@@ -303,17 +303,10 @@ static int datastore_cmp(void *obj, void *arg, int flags)
 	return strcmp(datastore1->uid, uid2) ? 0 : CMP_MATCH | CMP_STOP;
 }
 
-static void subscription_destructor(void *obj)
+static int subscription_remove_serializer(void *obj)
 {
 	struct ast_sip_subscription *sub = obj;
 
-	ast_debug(3, "Destroying SIP subscription\n");
-	remove_subscription(sub);
-
-	ao2_cleanup(sub->datastores);
-	ao2_cleanup(sub->endpoint);
-
-	if (sub->dlg) {
 	/* This is why we keep the dialog on the subscription. When the subscription
 	 * is destroyed, there is no guarantee that the underlying dialog is ready
 	 * to be destroyed. Furthermore, there's no guarantee in the opposite direction
@@ -325,6 +318,22 @@ static void subscription_destructor(void *obj)
 	 */
 	ast_sip_dialog_set_serializer(sub->dlg, NULL);
 	pjsip_dlg_dec_session(sub->dlg, &pubsub_module);
+
+	return 0;
+}
+
+static void subscription_destructor(void *obj)
+{
+	struct ast_sip_subscription *sub = obj;
+
+	ast_debug(3, "Destroying SIP subscription\n");
+	remove_subscription(sub);
+
+	ao2_cleanup(sub->datastores);
+	ao2_cleanup(sub->endpoint);
+
+	if (sub->dlg) {
+		ast_sip_push_task_synchronous(NULL, subscription_remove_serializer, sub);
 	}
 	ast_taskprocessor_unreference(sub->serializer);
 }