SMP multithread delock

[exploman]

I have the delock issue in performance test. And I found the context, vhost in only on thread' wsi has been changed in error value.

thread 149 own then mutex in libwebsockets.c:1314.
But in here the mutex address in wsi is error.
So I think in the pre turn, thread 149 lock the mutex, and the mutex address in wsi has changed before unlock .
And the next turn,

(gdb) thread 149
[Switching to thread 149 (Thread 0x7ff5e77fe700 (LWP 170))]
(gdb) bt
#0 0x00007ff81ff1e1ab in __pause_nocancel () from /lib64/libc.so.6
#1 0x00007ff821de35e5 in __pthread_mutex_lock_full () from /lib64/libpthread.so.0
#2 0x00007ff8216fec24 in lws_mutex_refcount_lock (mr=0x7ff5d0000100, reason=reason@entry=0x7ff82173ce10 <func.34062> "lws_tls_reuse_session") at /tmp//libs/libwebsockets-4.3.3/lib/core/libwebsockets.c:1314
#3 0x00007ff8216f5864 in lws_tls_reuse_session (wsi=wsi@entry=0x7ff5d0318950) at /tmp//libs/libwebsockets-4.3.3/lib/tls/openssl/openssl-session.c:87
#4 0x00007ff8216f81b8 in lws_ssl_client_bio_create (wsi=wsi@entry=0x7ff5d0318950) at /tmp//libs/libwebsockets-4.3.3/lib/tls/openssl/openssl-client.c:291
#5 0x00007ff8216f7af2 in lws_client_create_tls (wsi=wsi@entry=0x7ff5d0318950, pcce=pcce@entry=0x7ff5e77fd5c8, do_c1=do_c1@entry=1) at /tmp//libs/libwebsockets-4.3.3/lib/tls/tls-client.c:204
#6 0x00007ff82173a2b2 in lws_http_client_socket_service (wsi=wsi@entry=0x7ff5d0318950, pollfd=pollfd@entry=0x7ff5e77fd760) at /tmp//libs/libwebsockets-4.3.3/lib/roles/http/client/client-http.c:185
#7 0x00007ff8217291e7 in rops_handle_POLLIN_h1 (pt=, wsi=0x7ff5d0318950, pollfd=0x7ff5e77fd760) at /tmp//libs/libwebsockets-4.3.3/lib/roles/h1/ops-h1.c:701
#8 0x00007ff821711650 in lws_service_fd_tsi (tsi=0, pollfd=0x7ff5e77fd760, context=0x7ff6300022e0) at /tmp//libs/libwebsockets-4.3.3/lib/core-net/service.c:766
#9 lws_service_fd_tsi (context=0x7ff6300022e0, pollfd=0x7ff5e77fd760, tsi=0) at /tmp//libs/libwebsockets-4.3.3/lib/core-net/service.c:638
#10 0x00007ff82171af2a in lws_client_connect_4_established (wsi=wsi@entry=0x7ff5d0318950, wsi_piggyback=wsi_piggyback@entry=0x0, plen=plen@entry=0) at /tmp//libs/libwebsockets-4.3.3/lib/core-net/client/connect4.c:321
#11 0x00007ff82171a262 in lws_client_connect_3_connect (wsi=0x7ff5d0318950, ads=ads@entry=0x0, result=, result@entry=0x0, n=, n@entry=0, opaque=opaque@entry=0x0)
at /tmp//libs/libwebsockets-4.3.3/lib/core-net/client/connect3.c:664
#12 0x00007ff82173a5a8 in lws_http_client_socket_service (wsi=wsi@entry=0x7ff5d0318950, pollfd=pollfd@entry=0x7ff5fbf0bc40) at /tmp//libs/libwebsockets-4.3.3/lib/roles/http/client/client-http.c:70
#13 0x00007ff8217291e7 in rops_handle_POLLIN_h1 (pt=, wsi=0x7ff5d0318950, pollfd=0x7ff5fbf0bc40) at /tmp//libs/libwebsockets-4.3.3/lib/roles/h1/ops-h1.c:701
#14 0x00007ff821711650 in lws_service_fd_tsi (tsi=7, pollfd=0x7ff5fbf0bc40, context=0x7ff6300022e0) at /tmp//libs/libwebsockets-4.3.3/lib/core-net/service.c:766
#15 lws_service_fd_tsi (context=context@entry=0x7ff6300022e0, pollfd=0x7ff5fbf0bc40, tsi=tsi@entry=7) at /tmp//libs/libwebsockets-4.3.3/lib/core-net/service.c:638
#16 0x00007ff8216f0fae in _lws_plat_service_forced_tsi (context=context@entry=0x7ff6300022e0, tsi=tsi@entry=7) at /tmp//libs/libwebsockets-4.3.3/lib/plat/unix/unix-service.c:51
#17 0x00007ff8216f12c1 in _lws_plat_service_tsi (tsi=7, timeout_ms=, context=0x7ff6300022e0) at /tmp//libs/libwebsockets-4.3.3/lib/plat/unix/unix-service.c:216
#18 _lws_plat_service_tsi (context=context@entry=0x7ff6300022e0, timeout_ms=timeout_ms@entry=0, tsi=tsi@entry=7) at /tmp//libs/libwebsockets-4.3.3/lib/plat/unix/unix-service.c:72
#19 0x00007ff821711a5e in lws_service_tsi (context=0x7ff6300022e0, timeout_ms=timeout_ms@entry=0, tsi=tsi@entry=7) at /tmp//libs/libwebsockets-4.3.3/lib/core-net/service.c:870

(gdb) p mr->lock
$24 = {
__data = {
__lock = -802971424,
__count = 32757,
__owner = -793471536,
__nusers = 32757,
__kind = -804534240,
__spins = 32757,
__elision = 0,
__list = {
__prev = 0x7ff5d15aaf90,
__next = 0x7ff5d1790140
}
},
__size = "\340\240#\320\365\177\000\000Е\264\320\365\177\000\000 \310\v\320\365\177\000\000\220\257Z\321\365\177\000\000@\001y\321\365\177\000",
__align = 140693735710944
}

(gdb) thread 148
[Switching to thread 148 (Thread 0x7ff5e7fff700 (LWP 169))]
#0 0x00007ff821dea82d in __lll_lock_wait () from /lib64/libpthread.so.0
(gdb) f 2
#2 0x00007ff8216fec24 in lws_mutex_refcount_lock (mr=mr@entry=0x7ff6300047f0, reason=reason@entry=0x7ff821740860 <func.34120> "lws_close_free_wsi") at /tmp/libs/libwebsockets-4.3.3/lib/core/libwebsockets.c:1314
1314 in /tmp/libs/libwebsockets-4.3.3/lib/core/libwebsockets.c
(gdb) p mr->lock
$25 = {
__data = {
__lock = 2,
__count = 0,
__owner = 170,
__nusers = 1,
__kind = 0,
__spins = 0,
__elision = 0,
__list = {
__prev = 0x0,
__next = 0x0
}
},
__size = "\002\000\000\000\000\000\000\000\252\000\000\000\001", '\000' <repeats 26 times>,
__align = 2
}

[exploman]

version: tags v4.3.3