[PATCH] pthread_cond_broadcast: Fix waiters-after-spinning case [BZ #23538]

[Florian Weimer <fweimer at redhat dot com>]

I intend to commit this on behalf of Martin and Torvald.

Per FSF guidelines, we do not need copyright assignment for this change 
because it is small enough.

Martin, Torvald, would you please double-check the summary in the 
subject and the ChangeLog entry.

Thanks,
Florian

From: Martin Kuchta <martin.kuchta@netapp.com>
Subject: [PATCH] pthread_cond_broadcast: Fix waiters-after-spinning case [BZ #23538]
To: libc-alpha@sourceware.org

2018-08-24 Martin Kuchta  <martin.kuchta@netapp.com>
	   Torvald Riegel  <triegel@redhat.com>

	[BZ #23538]
	* nptl/pthread_cond_common.c (__condvar_quiesce_and_switch_g1):
	Update r to include the set wake-request flag if waiters are
	remaining after spinning.

diff --git a/nptl/pthread_cond_common.c b/nptl/pthread_cond_common.c
index 8e425eb01e..479e54febb 100644
--- a/nptl/pthread_cond_common.c
+++ b/nptl/pthread_cond_common.c
@@ -405,8 +405,12 @@ __condvar_quiesce_and_switch_g1 (pthread_cond_t *cond, uint64_t wseq,
 	{
 	  /* There is still a waiter after spinning.  Set the wake-request
 	     flag and block.  Relaxed MO is fine because this is just about
-	     this futex word.  */
-	  r = atomic_fetch_or_relaxed (cond->__data.__g_refs + g1, 1);
+	     this futex word.
+
+	     Update r to include the set wake-request flag so that the upcoming
+	     futex_wait only blocks if the flag is still set (otherwise, we'd
+	     violate the basic client-side futex protocol).  */
+	  r = atomic_fetch_or_relaxed (cond->__data.__g_refs + g1, 1) | 1;
 
 	  if ((r >> 1) > 0)
 	    futex_wait_simple (cond->__data.__g_refs + g1, r, private);