[glibc] htl: Fix case when sem_*wait is canceled while holding a token

[glibc] htl: Fix case when sem_*wait is canceled while holding a token

[Samuel Thibault]

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1b90d52df96c4f768570e148c33bc9c2db53373d

commit 1b90d52df96c4f768570e148c33bc9c2db53373d
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Wed Jun 24 00:18:45 2020 +0000

    htl: Fix case when sem_*wait is canceled while holding a token
    
    * sysdeps/htl/sem-timedwait.c (struct cancel_ctx): Add cancel_wake
    field.
    (cancel_hook): When unblocking thread, set cancel_wake field to 1.
    (__sem_timedwait_internal): Set cancel_wake field to 0 by default.
    On cancellation exit, check whether we hold a token, to be put back.

Diff:
---
 sysdeps/htl/sem-timedwait.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/sysdeps/htl/sem-timedwait.c b/sysdeps/htl/sem-timedwait.c
index 691fb7e5ee..fffdf36467 100644
--- a/sysdeps/htl/sem-timedwait.c
+++ b/sysdeps/htl/sem-timedwait.c
@@ -27,6 +27,7 @@ struct cancel_ctx
 {
   struct __pthread *wakeup;
   sem_t *sem;
+  int cancel_wake;
 };
 
 static void
@@ -42,7 +43,10 @@ cancel_hook (void *arg)
      If it was already unblocked, it's not queued any more.  */
   unblock = wakeup->prevp != NULL;
   if (unblock)
-    __pthread_dequeue (wakeup);
+    {
+      __pthread_dequeue (wakeup);
+      ctx->cancel_wake = 1;
+    }
   __pthread_spin_unlock (&sem->__lock);
 
   if (unblock)
@@ -62,6 +66,7 @@ __sem_timedwait_internal (sem_t *restrict sem,
   struct cancel_ctx ctx;
   ctx.wakeup = self;
   ctx.sem = sem;
+  ctx.cancel_wake = 0;
 
   /* Test for a pending cancellation request, switch to deferred mode for
      safer resource handling, and prepare the hook to call in case we're
@@ -159,7 +164,13 @@ out_locked:
   __pthread_mutex_unlock (&self->cancel_lock);
 
   if (cancelled)
-    __pthread_exit (PTHREAD_CANCELED);
+    {
+      if (ret == 0 && ctx.cancel_wake == 0)
+	/* We were cancelled while waking up with a token, put it back.  */
+	sem_post (sem);
+
+      __pthread_exit (PTHREAD_CANCELED);
+    }
 
   return ret;
 }