Index: bridges/bridge_native_rtp.c
===================================================================
--- bridges/bridge_native_rtp.c	(revision 401415)
+++ bridges/bridge_native_rtp.c	(working copy)
@@ -111,7 +111,15 @@
 
 	return audio_glue0_res;
 }
-
+/*!
+ * \internal
+ * \brief Start native RTP bridging of two channels
+ *
+ * \param bridge The bridge that had native RTP bridging happening on it
+ * \param target If remote RTP bridging, the channel that is unheld.
+ *
+ * \note Bridge must be locked when calling this function.
+ */
 static int native_rtp_bridge_start(struct ast_bridge *bridge, struct ast_channel *target)
 {
 	struct ast_bridge_channel *c0 = AST_LIST_FIRST(&bridge->channels);
@@ -131,6 +139,8 @@
 		return 0;
 	}
 
+	ast_channel_lock_both(c0->chan, c1->chan);
+
 	native_type = native_rtp_bridge_get(c0->chan, c1->chan, &glue0, &glue1, &instance0, &instance1, &vinstance0, &vinstance1);
 
 	if (glue0->get_codec) {
@@ -180,6 +190,8 @@
 		break;
 	}
 
+	ast_channel_unlock(c0->chan);
+	ast_channel_unlock(c1->chan);
 	return 0;
 }
 
@@ -260,6 +272,8 @@
  * \param target If remote RTP bridging, the channel that is placed on hold.
  * \param leaving If this is called because a channel is leaving, this is the
  * bridge channel that is leaving the bridge
+ *
+ * \note Bridge must be locked when calling this function.
  */
 static void native_rtp_bridge_stop(struct ast_bridge *bridge, struct ast_channel *target,
 		struct ast_bridge_channel *leaving)
@@ -291,6 +305,7 @@
 		return;
 	}
 
+	ast_channel_lock_both(c0->chan, c1->chan);
 	native_type = native_rtp_bridge_get(c0->chan, c1->chan, &glue0, &glue1, &instance0, &instance1, &vinstance0, &vinstance1);
 
 	switch (native_type) {
@@ -330,6 +345,9 @@
 
 	ast_debug(2, "Discontinued RTP bridging of '%s' and '%s' - media will flow through Asterisk core\n",
 		ast_channel_name(c0->chan), ast_channel_name(c1->chan));
+
+	ast_channel_unlock(c0->chan);
+	ast_channel_unlock(c1->chan);
 }
 
 /*! \brief Frame hook that is called to intercept hold/unhold */
@@ -341,13 +359,15 @@
 		return f;
 	}
 
-	ast_channel_lock(chan);
 	bridge = ast_channel_get_bridge(chan);
-	ast_channel_unlock(chan);
-
 	if (bridge) {
 		if (f->subclass.integer == AST_CONTROL_HOLD) {
-			native_rtp_bridge_stop(bridge, chan, NULL);
+			struct ast_rtp_glue *glue;
+
+			glue = ast_rtp_instance_get_glue(ast_channel_tech(chan)->type);
+			if (glue) {
+				glue->update_peer(chan, NULL, NULL, NULL, NULL, 0);
+			}
 		} else if ((f->subclass.integer == AST_CONTROL_UNHOLD) || (f->subclass.integer == AST_CONTROL_UPDATE_RTP_PEER)) {
 			native_rtp_bridge_start(bridge, chan);
 		}
Index: channels/chan_pjsip.c
===================================================================
--- channels/chan_pjsip.c	(revision 401415)
+++ channels/chan_pjsip.c	(working copy)
@@ -503,14 +503,11 @@
 	struct chan_pjsip_pvt *pvt = channel->pvt;
 	struct ast_sip_session *session = channel->session;
 	int changed = 0;
-	struct ast_channel *bridge_peer;
 
 	/* Don't try to do any direct media shenanigans on early bridges */
-	bridge_peer = ast_channel_bridge_peer(chan);
-	if ((rtp || vrtp || tpeer) && !bridge_peer) {
+	if ((rtp || vrtp || tpeer) && !ast_channel_is_bridged(chan)) {
 		return 0;
 	}
-	ast_channel_cleanup(bridge_peer);
 
 	if (nat_active && session->endpoint->media.direct_media.disable_on_nat) {
 		return 0;
Index: channels/chan_sip.c
===================================================================
--- channels/chan_sip.c	(revision 401415)
+++ channels/chan_sip.c	(working copy)
@@ -32596,11 +32596,8 @@
 	struct sip_pvt *p;
 	int changed = 0;
 
-	/* Lock the channel and the private safely. */
-	ast_channel_lock(chan);
 	p = ast_channel_tech_pvt(chan);
 	if (!p) {
-		ast_channel_unlock(chan);
 		return -1;
 	}
 	sip_pvt_lock(p);
@@ -32608,7 +32605,6 @@
 		/* I suppose it could be argued that if this happens it is a bug. */
 		ast_debug(1, "The private is not owned by channel %s anymore.\n", ast_channel_name(chan));
 		sip_pvt_unlock(p);
-		ast_channel_unlock(chan);
 		return 0;
 	}
 
@@ -32617,14 +32613,12 @@
 		!ast_channel_is_bridged(chan) &&
 		!sip_cfg.directrtpsetup) {
 		sip_pvt_unlock(p);
-		ast_channel_unlock(chan);
 		return 0;
 	}
 
 	if (p->alreadygone) {
 		/* If we're destroyed, don't bother */
 		sip_pvt_unlock(p);
-		ast_channel_unlock(chan);
 		return 0;
 	}
 
@@ -32633,7 +32627,6 @@
 	*/
 	if (nat_active && !ast_test_flag(&p->flags[0], SIP_DIRECT_MEDIA_NAT)) {
 		sip_pvt_unlock(p);
-		ast_channel_unlock(chan);
 		return 0;
 	}
 
@@ -32699,7 +32692,6 @@
 		 */
 		ast_clear_flag(&p->flags[2], SIP_PAGE3_DIRECT_MEDIA_OUTGOING);
 		sip_pvt_unlock(p);
-		ast_channel_unlock(chan);
 		return 0;
 	}
 
@@ -32720,7 +32712,6 @@
 	/* Reset lastrtprx timer */
 	p->lastrtprx = p->lastrtptx = time(NULL);
 	sip_pvt_unlock(p);
-	ast_channel_unlock(chan);
 	return 0;
 }
 
Index: include/asterisk/channel.h
===================================================================
--- include/asterisk/channel.h	(revision 401415)
+++ include/asterisk/channel.h	(working copy)
@@ -4214,6 +4214,8 @@
  * \note The returned peer channel is the current peer in the
  * bridge when called.
  *
+ * \note Absolutely _NO_ channel locks should be held when calling this function.
+ *
  * \retval NULL Channel not in a bridge or the bridge is not two-party.
  * \retval non-NULL Reffed peer channel at time of calling.
  */
Index: main/channel.c
===================================================================
--- main/channel.c	(revision 401415)
+++ main/channel.c	(working copy)
@@ -6868,13 +6868,11 @@
 	}
 
 	ast_debug(1, "Done Masquerading %s (%d)\n", ast_channel_name(original), ast_channel_state(original));
+	ast_channel_unlock(original);
 
 	if ((bridged = ast_channel_bridge_peer(original))) {
-		ast_channel_unlock(original);
 		ast_indicate(bridged, AST_CONTROL_SRCCHANGE);
 		ast_channel_unref(bridged);
-	} else {
-		ast_channel_unlock(original);
 	}
 	ast_indicate(original, AST_CONTROL_SRCCHANGE);
 
