From 20922159b4127bb715576e922d252b0c96dee7a2 Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Mon, 20 Apr 2026 14:56:40 -0400
Subject: [PATCH] MT#55283 prevent SSRC deadlock

Closes #2095

Change-Id: I693924eba5c7896f1efa9123cce606db97b0086c
(cherry picked from commit fba001c3b0339c996ca3450cfa06d61af2cb5146)
(cherry picked from commit 5273ff5af2d1102a3d261a00c186cb496a92aba8)
---
 daemon/rtcp.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/daemon/rtcp.c b/daemon/rtcp.c
index c84c59809..771f5bb3a 100644
--- a/daemon/rtcp.c
+++ b/daemon/rtcp.c
@@ -1446,6 +1446,13 @@ static GString *rtcp_sender_report(struct ssrc_sender_report *ssr,
 	int i = 0, n = 0;
 	while (rrs->length) {
 		struct ssrc_ctx *s = g_queue_pop_head(rrs);
+
+		// don't send a receiver report for ourselves. prevents possible deadlock
+		if (s->parent->h.ssrc == ssrc) {
+			ssrc_ctx_put(&s);
+			continue;
+		}
+
 		if (i < 30) {
 			g_string_set_size(ret, ret->len + sizeof(struct report_block));
 			struct report_block *rr = (void *) ret->str + ret->len - sizeof(struct report_block);
@@ -1557,6 +1564,7 @@ void rtcp_receiver_reports(GQueue *out, struct ssrc_hash *hash, struct call_mono
 
 // call must be locked in R
 // if a `ps` is locked, it must be passed as argument
+// ssrc_out may be locked
 void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out,
 		const struct packet_stream *locked)
 {