From a5b72e6d4ed88ed29aad5eebbcce574bdb8bdd33 Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Mon, 11 Aug 2025 08:33:21 -0400
Subject: [PATCH] MT#55283 clean up RTCP send locking

Fixes regression from Ib4285e7aae

RTCP multiplexing requires the RTCP sender to maybe lock the same output
stream, maybe lock some other one. Allow for both.

Change-Id: I6fcef32e656f8f0de46ad777f11a19c259ce35c7
(cherry picked from commit cec0afa25e1c0b29be8d93433dec3a52ddc67514)
(cherry picked from commit d1d4110f0ffd7fa63ba38c180b579848f3d2b08e)
(cherry picked from commit ea26245c4ddd9808f97465da0b65dffbcd6abdeb)
---
 daemon/codec.c        |  2 +-
 daemon/media_player.c |  7 +++++--
 daemon/rtcp.c         | 22 ++++++++++++++--------
 include/rtcp.h        |  3 ++-
 4 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/daemon/codec.c b/daemon/codec.c
index 2aaa96f6e..06a934381 100644
--- a/daemon/codec.c
+++ b/daemon/codec.c
@@ -1029,7 +1029,7 @@ static void __rtcp_timer_run(struct codec_timer *ct) {
 		if (!ssrc_out[u]) // end of list
 			break;
 		// coverity[use : FALSE]
-		rtcp_send_report(media, ssrc_out[u]);
+		rtcp_send_report(media, ssrc_out[u], NULL);
 	}
 
 	rwlock_unlock_r(&rt->call->master_lock);
diff --git a/daemon/media_player.c b/daemon/media_player.c
index ac96172e4..e0913449c 100644
--- a/daemon/media_player.c
+++ b/daemon/media_player.c
@@ -250,12 +250,13 @@ struct send_timer *send_timer_new(struct packet_stream *ps) {
 
 // call is locked in R
 // ssrc_out is locked
+// st->sink is locked
 static void send_timer_rtcp(struct send_timer *st, struct ssrc_ctx *ssrc_out) {
 	struct call_media *media = st->sink ? st->sink->media : NULL;
 	if (!media)
 		return;
 
-	rtcp_send_report(media, ssrc_out);
+	rtcp_send_report(media, ssrc_out, st->sink);
 
 	ssrc_out->next_rtcp = rtpe_now;
 	timeval_add_usec(&ssrc_out->next_rtcp, 5000000 + (ssl_random() % 2000000));
@@ -351,6 +352,7 @@ out:
 	log_info_pop();
 }
 
+// sink->lock is held
 static void __send_timer_rtcp(struct send_timer *st, struct ssrc_ctx *ssrc_out) {
 	// do we send RTCP?
 	if (!ssrc_out)
@@ -379,9 +381,10 @@ static void send_timer_send_lock(struct send_timer *st, struct codec_packet *cp)
 
 	__send_timer_send_common(st, cp);
 
+	__send_timer_rtcp(st, ssrc_out);
+
 	mutex_unlock(&st->sink->lock);
 
-	__send_timer_rtcp(st, ssrc_out);
 	ssrc_ctx_put(&ssrc_out);
 
 	rwlock_unlock_r(&call->master_lock);
diff --git a/daemon/rtcp.c b/daemon/rtcp.c
index f5894ec88..c84c59809 100644
--- a/daemon/rtcp.c
+++ b/daemon/rtcp.c
@@ -1556,8 +1556,10 @@ void rtcp_receiver_reports(GQueue *out, struct ssrc_hash *hash, struct call_mono
 
 
 // call must be locked in R
-// no in_lock or out_lock must be held
-void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out) {
+// if a `ps` is locked, it must be passed as argument
+void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out,
+		const struct packet_stream *locked)
+{
 	// figure out where to send it
 	struct packet_stream *ps = media->streams.head->data;
 	// crypto context is held separately
@@ -1568,16 +1570,15 @@ void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out) {
 	else {
 		if (PS_ISSET(rtcp_ps, RTCP))
 			ps = rtcp_ps;
-		else
-			rtcp_ps = ps;
 	}
 
-	LOCK(&ps->lock);
+	if (ps != locked)
+		mutex_lock(&ps->lock);
 
-	if (!ps->selected_sfd || !rtcp_ps->selected_sfd)
-		return;
+	if (!ps->selected_sfd)
+		goto out;
 	if (ps->selected_sfd->socket.fd == -1 || ps->endpoint.address.family == NULL)
-		return;
+		goto out;
 
 	log_info_stream_fd(ps->selected_sfd);
 
@@ -1629,6 +1630,11 @@ void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out) {
 		struct ssrc_receiver_report *srr = g_queue_pop_head(&srrs);
 		g_slice_free1(sizeof(*srr), srr);
 	}
+
+out:
+	if (ps != locked)
+		mutex_unlock(&ps->lock);
+
 }
 
 
diff --git a/include/rtcp.h b/include/rtcp.h
index cfc41fc33..0a9c30708 100644
--- a/include/rtcp.h
+++ b/include/rtcp.h
@@ -39,6 +39,7 @@ void rtcp_init(void);
 
 
 void rtcp_receiver_reports(GQueue *out, struct ssrc_hash *hash, struct call_monologue *ml);
-void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out);
+void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out,
+		const struct packet_stream *locked);
 
 #endif