Sometimes we get subunalloced, gotta free lock first

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@3507 65c4cc65-6c06-0410-ace0-fbb531ad65f3

channels/chan_zap.c

@@ -2869,7 +2869,8 @@ static int attempt_transfer(struct zt_pvt *p)
 					p->subs[SUB_REAL].owner->bridge->name, p->subs[SUB_THREEWAY].owner->name);
 			return -1;
 		}
-		/* Orphan the channel */
+		/* Orphan the channel after releasing the lock */
+		ast_mutex_unlock(&p->subs[SUB_THREEWAY].owner->lock);
 		unalloc_sub(p, SUB_THREEWAY);
 	} else if (p->subs[SUB_THREEWAY].owner->bridge) {
 		if (p->subs[SUB_REAL].owner->_state == AST_STATE_RINGING) {
@@ -2882,6 +2883,7 @@ static int attempt_transfer(struct zt_pvt *p)
 			return -1;
 		}
 		swap_subs(p, SUB_THREEWAY, SUB_REAL);
+		ast_mutex_unlock(&p->subs[SUB_THREEWAY].owner->lock);
 		unalloc_sub(p, SUB_THREEWAY);
 		/* Tell the caller not to hangup */
 		return 1;
@@ -3213,7 +3215,8 @@ static struct ast_frame *zt_handle_event(struct ast_channel *ast)
 								}
 							} else
 								p->subs[SUB_THREEWAY].owner->_softhangup |= AST_SOFTHANGUP_DEV;
-							ast_mutex_unlock(&p->subs[SUB_THREEWAY].owner->lock);
+							if (p->subs[SUB_THREEWAY].owner)
+								ast_mutex_unlock(&p->subs[SUB_THREEWAY].owner->lock);
 						} else {
 							ast_mutex_unlock(&p->subs[SUB_THREEWAY].owner->lock);
 							/* Swap subs and dis-own channel */