Unlocking a robust mutex in a cleanup handler

[Konstantin Belousov]

On Tue, Dec 06, 2016 at 11:49:24AM +0100, Dimitri Staessens wrote:
> Dear devs,
> 
> first of all, thank you for supporting robust mutexes in FreeBSD 11.
> 
> I'm having some issues with a thread that holds a robust mutex (residing 
> in a POSIX shared memory (shm) segment) in conjunctions with a condition 
> variable (also in that POSIX shm) on which that thread is blocked via a 
> pthread_cond_wait() call. pthread_cond_wait tries to retake the mutex 
> after the thread cancellation signal is received, and there is a 
> pthread_mutex_unlock pushed to the cleanup stack to unlock that robust 
> mutex in case of a cancellation.
> 
> Cancelling that thread works fine on Linux, however, on FreeBSD 
> 11.0-RELEASE, if I pthread_cancel that thread I can't get past the 
> following check and resulting PANIC call:
> https://github.com/freebsd/freebsd/blob/master/lib/libthr/thread/thr_mutex.c#L187
> 
> After removing the check and recompiling libthr everything seems to work 
> fine.
> 
> Could this be a bug in libthr or am I missing a nuance in the use of a 
> shared robust mutexes in conjunction with condition variables?

Most likely, this is a bug in libthr.  But please extract the minimal
reproduction case and send it to me.