diff --git a/sys/kern/kern_mutex.c b/sys/kern/kern_mutex.c --- a/sys/kern/kern_mutex.c +++ b/sys/kern/kern_mutex.c @@ -1010,6 +1010,18 @@ case MTX_LINK_LINKED_EX: case MTX_LINK_LINKED_SH: mtx_delete_link(mtx, link); + /* + * DF-0047: a concurrent mtx_chain_link_ex/sh() can grant + * the lock to us during the mtx_delete_link() LINKSPIN + * acquire window -- it sets link->state = MTX_LINK_ACQUIRED + * and mtx->mtx_owner = curthread. If that happened we now + * own the mutex exclusively, so the caller must release it: + * return success instead of leaking the lock. + */ + if (link->state == MTX_LINK_ACQUIRED) { + error = 0; + break; + } /* fall through */ default: if (error == 0)