libc6 pthread_cond_wait fails to reacquire mutex upon cancellation

[Rémi Denis-Courmont]

pthread_cond_wait() fails to re-acquire the provided mutex when acting on a deferred cancellation event from another thread. I initially hit the bug from the VLC media player test suite, but I wrote a simple reduced test case (attached).

# gcc -O2 -Wall condfail.c -lpthread -o condfail
# ./condfail
1
2
a.out: condfail.c:18: cleanup_lock: Assertion `val == 0' failed.
Aborted

This is a violation of POSIX threads semantics. This also renders VLC media player debug versions completely unusable on affected systems. As a side note, this bug looks awfully similar to old Debian bug http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=551903

Running stock Ubuntu 2.6.38-11-generic kernel and libc6 2.13-0ubuntu13. If this is any use, CPU information follows:
% cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 14
model name : Genuine Intel(R) CPU T2400 @ 1.83GHz
stepping : 8
cpu MHz : 1000.000
cache size : 2048 KB
physical id : 0
siblings : 2
core id : 0
cpu cores : 2
apicid : 0
initial apicid : 0
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 10
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe nx constant_tsc arch_perfmon bts aperfmperf pni monitor vmx est tm2 xtpr pdcm dts
bogomips : 3657.21
clflush size : 64
cache_alignment : 64
address sizes : 32 bits physical, 32 bits virtual
power management:

processor : 1
vendor_id : GenuineIntel
cpu family : 6
model : 14
model name : Genuine Intel(R) CPU T2400 @ 1.83GHz
stepping : 8
cpu MHz : 1000.000
cache size : 2048 KB
physical id : 0
siblings : 2
core id : 1
cpu cores : 2
apicid : 1
initial apicid : 1
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 10
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe nx constant_tsc arch_perfmon bts aperfmperf pni monitor vmx est tm2 xtpr pdcm dts
bogomips : 3657.55
clflush size : 64
cache_alignment : 64
address sizes : 32 bits physical, 32 bits virtual
power management:

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.