htl: Make pthread*_cond_timedwait register wref before releasing mutex

Otherwise another thread could be rightly trying to destroy the condition,
see e.g. tst-cond20.

1 files changed, 6 insertions, 4 deletions

diff --git a/sysdeps/htl/pt-cond-timedwait.c b/sysdeps/htl/pt-cond-timedwait.c
index 6f4cb41bf1..4352e54fff 100644
--- a/sysdeps/htl/pt-cond-timedwait.c
+++ b/sysdeps/htl/pt-cond-timedwait.c
@@ -142,13 +142,15 @@ __pthread_cond_timedwait_internal (pthread_cond_t *cond,
 
   __pthread_mutex_unlock (&self->cancel_lock);
 
-  /* Release MUTEX before blocking.  */
-  __pthread_mutex_unlock (mutex);
-
   /* Increase the waiter reference count.  Relaxed MO is sufficient because
-     we only need to synchronize when decrementing the reference count.  */
+     we only need to synchronize when decrementing the reference count.
+     We however need to have the mutex held to prevent concurrency with
+     a pthread_cond_destroy.  */
   atomic_fetch_add_relaxed (&cond->__wrefs, 2);
 
+  /* Release MUTEX before blocking.  */
+  __pthread_mutex_unlock (mutex);
+
   /* Block the thread.  */
   if (abstime != NULL)
     err = __pthread_timedblock (self, abstime, clock_id);