From 9e1bcc9390560a5797cf9ed5e3176eb4c11b7abe Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Tue, 26 Aug 2025 09:23:20 -0400
Subject: [PATCH] MT#55283 fix media playback deadlock

NGCP-Flow: mr11.5
Change-Id: Ie58d81332eb491219fdeff289c775ec1a6c24cb9
Ref: #1994
---
 daemon/call.c          |  2 +-
 daemon/media_socket.c  | 12 ++++++++----
 daemon/mqtt.c          |  2 +-
 daemon/rtcp.c          |  4 ++--
 include/media_socket.h |  2 +-
 5 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/daemon/call.c b/daemon/call.c
index f8491f9d2..246a508bd 100644
--- a/daemon/call.c
+++ b/daemon/call.c
@@ -231,7 +231,7 @@ next:
 	for (it = c->medias.head; it; it = it->next) {
 		struct call_media *media = it->data;
 		if (rtpe_config.measure_rtp) {
-			media_update_stats(media);
+			media_update_stats(media, NULL);
 			ssrc_collect_metrics(media);
 		}
 		if (ML_ISSET(media->monologue, TRANSCODING))
diff --git a/daemon/media_socket.c b/daemon/media_socket.c
index f3dde569d..58005ae81 100644
--- a/daemon/media_socket.c
+++ b/daemon/media_socket.c
@@ -1860,10 +1860,8 @@ static void __stream_consume_stats(struct packet_stream *ps, const struct rtpeng
 }
 
 
-// called with master_lock hekd
+// called with master_lock held and ps->lock held
 static void __stream_update_stats(struct packet_stream *ps) {
-	LOCK(&ps->lock);
-
 	struct rtpengine_command_stats stats_info;
 	__re_address_translate_ep(&stats_info.local, &ps->selected_sfd->socket.local);
 	if (kernel_update_stats(&stats_info))
@@ -1939,7 +1937,7 @@ void unkernelize(struct packet_stream *ps, const char *reason) {
 }
 
 // master lock held in R
-void media_update_stats(struct call_media *m) {
+void media_update_stats(struct call_media *m, const struct packet_stream *locked) {
 	if (!proto_is_rtp(m->protocol))
 		return;
 	if (!kernel.is_open)
@@ -1956,7 +1954,13 @@ void media_update_stats(struct call_media *m) {
 		if (!ps->selected_sfd)
 			continue;
 
+		if (ps != locked)
+			mutex_lock(&ps->lock);
+
 		__stream_update_stats(ps);
+
+		if (ps != locked)
+			mutex_unlock(&ps->lock);
 	}
 }
 
diff --git a/daemon/mqtt.c b/daemon/mqtt.c
index d5e3f591b..b37bb7a0b 100644
--- a/daemon/mqtt.c
+++ b/daemon/mqtt.c
@@ -384,7 +384,7 @@ static void mqtt_stream_stats(struct packet_stream *ps, JsonBuilder *json) {
 
 
 static void mqtt_media_stats(struct call_media *media, JsonBuilder *json) {
-	media_update_stats(media);
+	media_update_stats(media, NULL);
 
 	json_builder_set_member_name(json, "media_index");
 	json_builder_add_int_value(json, media->index);
diff --git a/daemon/rtcp.c b/daemon/rtcp.c
index a7a4b4cba..ddbad3e88 100644
--- a/daemon/rtcp.c
+++ b/daemon/rtcp.c
@@ -1573,7 +1573,7 @@ void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out,
 			ps = rtcp_ps;
 	}
 
-	media_update_stats(media);
+	media_update_stats(media, locked);
 
 	if (ps != locked)
 		mutex_lock(&ps->lock);
@@ -1623,7 +1623,7 @@ void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out,
 		struct packet_stream *sink = sh->sink;
 		struct call_media *other_media = sink->media;
 
-		media_update_stats(other_media);
+		media_update_stats(other_media, locked);
 
 		ssrc_sender_report(other_media, &ssr, &rtpe_now);
 		for (GList *k = srrs.head; k; k = k->next) {
diff --git a/include/media_socket.h b/include/media_socket.h
index 522500391..844862f01 100644
--- a/include/media_socket.h
+++ b/include/media_socket.h
@@ -316,7 +316,7 @@ void unkernelize(struct packet_stream *, const char *);
 void __stream_unconfirm(struct packet_stream *, const char *);
 void __reset_sink_handlers(struct packet_stream *);
 
-void media_update_stats(struct call_media *m);
+void media_update_stats(struct call_media *m, const struct packet_stream *locked);
 int __hunt_ssrc_ctx_idx(uint32_t ssrc, struct ssrc_ctx *list[RTPE_NUM_SSRC_TRACKING],
 		unsigned int start_idx);
 struct ssrc_ctx *__hunt_ssrc_ctx(uint32_t ssrc, struct ssrc_ctx *list[RTPE_NUM_SSRC_TRACKING],