commit aa8a3e4cdef20c50cb20f008864fff05cbfbdf29

Author: Martin Kuchta <martin.kuchta@netapp.com>

Date:   Mon Aug 27 18:54:46 2018 +0200

    pthread_cond_broadcast: Fix waiters-after-spinning case [BZ #23538]

    (cherry picked from commit 99ea93ca31795469d2a1f1570f17a5c39c2eb7e2)

diff --git a/nptl/pthread_cond_common.c b/nptl/pthread_cond_common.c

index 8e425eb01eceabec..479e54febb417675 100644

--- a/nptl/pthread_cond_common.c

+++ b/nptl/pthread_cond_common.c

@@ -405,8 +405,12 @@ __condvar_quiesce_and_switch_g1 (pthread_cond_t *cond, uint64_t wseq,

 	{

 	  /* There is still a waiter after spinning.  Set the wake-request

 	     flag and block.  Relaxed MO is fine because this is just about

-	     this futex word.  */

-	  r = atomic_fetch_or_relaxed (cond->__data.__g_refs + g1, 1);

+	     this futex word.

+

+	     Update r to include the set wake-request flag so that the upcoming

+	     futex_wait only blocks if the flag is still set (otherwise, we'd

+	     violate the basic client-side futex protocol).  */

+	  r = atomic_fetch_or_relaxed (cond->__data.__g_refs + g1, 1) | 1;

 	  if ((r >> 1) > 0)

 	    futex_wait_simple (cond->__data.__g_refs + g1, r, private);