From 5b165864836e2eac44922a574e05c5b971f401bb Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Tue, 8 Aug 2023 11:59:43 -0700
Subject: [PATCH 01/10] Fixes for wolfSSL conditional porting. Can cause
 deadlock in high usage situations. Added better signal support on MacOS.
 Issue created in PR #6437.

---
 examples/benchmark/tls_bench.c   |  9 ++--
 examples/echoserver/echoserver.c |  5 --
 src/crl.c                        | 24 +++------
 tests/utils.c                    | 26 ++++------
 wolfcrypt/src/wc_port.c          | 84 +++++++++++++++++++++++++-------
 wolfssl/test.h                   | 54 +++++---------------
 wolfssl/wolfcrypt/types.h        | 20 +++++---
 7 files changed, 112 insertions(+), 110 deletions(-)

diff --git a/examples/benchmark/tls_bench.c b/examples/benchmark/tls_bench.c
index 2d114e8d8..0417f1b18 100644
--- a/examples/benchmark/tls_bench.c
+++ b/examples/benchmark/tls_bench.c
@@ -436,8 +436,7 @@ static int ServerMemRecv(info_t* info, char* buf, int sz)
 #ifndef BENCH_USE_NONBLOCK
     while (info->to_server.write_idx - info->to_server.read_idx < sz &&
             !info->to_client.done) {
-        THREAD_CHECK_RET(wolfSSL_CondWait(&info->to_server.cond,
-                                            &info->to_server.mutex));
+        THREAD_CHECK_RET(wolfSSL_CondWait(&info->to_server.cond));
     }
 #else
     if (info->to_server.write_idx - info->to_server.read_idx < sz) {
@@ -511,8 +510,7 @@ static int ClientMemRecv(info_t* info, char* buf, int sz)
 #ifndef BENCH_USE_NONBLOCK
     while (info->to_client.write_idx - info->to_client.read_idx < sz &&
             !info->to_server.done) {
-        THREAD_CHECK_RET(wolfSSL_CondWait(&info->to_client.cond,
-                                            &info->to_client.mutex));
+        THREAD_CHECK_RET(wolfSSL_CondWait(&info->to_client.cond));
     }
 #else
     if (info->to_client.write_idx - info->to_client.read_idx < sz) {
@@ -1054,8 +1052,7 @@ static int bench_tls_client(info_t* info)
         if (info->doDTLS && !info->clientOrserverOnly) {
             THREAD_CHECK_RET(wc_LockMutex(&info->dtls_mutex));
             if (info->serverReady != 1) {
-                THREAD_CHECK_RET(wolfSSL_CondWait(&info->dtls_cond,
-                                                    &info->dtls_mutex));
+                THREAD_CHECK_RET(wolfSSL_CondWait(&info->dtls_cond));
             }
             /* for next loop */
             info->serverReady = 0;
diff --git a/examples/echoserver/echoserver.c b/examples/echoserver/echoserver.c
index a392fe18b..ae5e8dbbc 100644
--- a/examples/echoserver/echoserver.c
+++ b/examples/echoserver/echoserver.c
@@ -74,13 +74,8 @@ static void SignalReady(void* args, word16 port)
     THREAD_CHECK_RET(wc_LockMutex(&ready->mutex));
     ready->ready = 1;
     ready->port = port;
-#ifdef COND_NO_REQUIRE_LOCKED_MUTEX
-    THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
-#endif
     THREAD_CHECK_RET(wolfSSL_CondSignal(&ready->cond));
-#ifndef COND_NO_REQUIRE_LOCKED_MUTEX
     THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
-#endif
 #endif /* NO_MAIN_DRIVER && WOLFSSL_COND */
     (void)args;
     (void)port;
diff --git a/src/crl.c b/src/crl.c
index b167914c0..540f785f8 100644
--- a/src/crl.c
+++ b/src/crl.c
@@ -931,20 +931,14 @@ static int SignalSetup(WOLFSSL_CRL* crl, int status)
     int ret;
 
     /* signal to calling thread we're setup */
-#ifndef COND_NO_REQUIRE_LOCKED_MUTEX
     if (wc_LockMutex(&crl->crlLock) != 0) {
         WOLFSSL_MSG("wc_LockMutex crlLock failed");
         return BAD_MUTEX_E;
     }
-#endif
-
     crl->setup = status;
-    ret = wolfSSL_CondSignal(&crl->cond);
-
-#ifndef COND_NO_REQUIRE_LOCKED_MUTEX
     wc_UnLockMutex(&crl->crlLock);
-#endif
 
+    ret = wolfSSL_CondSignal(&crl->cond);
     if (ret != 0)
         return BAD_COND_E;
 
@@ -1491,26 +1485,24 @@ static int StartMonitorCRL(WOLFSSL_CRL* crl)
         return THREAD_CREATE_E;
     }
 
-#ifndef COND_NO_REQUIRE_LOCKED_MUTEX
     /* wait for setup to complete */
     if (wc_LockMutex(&crl->crlLock) != 0) {
-        WOLFSSL_MSG("wc_LockMutex crlLock error");
+        WOLFSSL_MSG("wc_LockMutex crlLock failed");
         return BAD_MUTEX_E;
     }
-#endif
-
     while (crl->setup == 0) {
-        if (wolfSSL_CondWait(&crl->cond, &crl->crlLock) != 0) {
+        int condRet;
+        wc_UnLockMutex(&crl->crlLock);
+        condRet = wolfSSL_CondWait(&crl->cond);
+        wc_LockMutex(&crl->crlLock);
+        if (condRet != 0) {
             ret = BAD_COND_E;
             break;
         }
     }
-    if (crl->setup < 0)
+    if (ret >= 0 && crl->setup < 0)
         ret = crl->setup;  /* store setup error */
-
-#ifndef COND_NO_REQUIRE_LOCKED_MUTEX
     wc_UnLockMutex(&crl->crlLock);
-#endif
 
     if (ret < 0) {
         WOLFSSL_MSG("DoMonitor setup failure");
diff --git a/tests/utils.c b/tests/utils.c
index 368c7f44a..14480855c 100644
--- a/tests/utils.c
+++ b/tests/utils.c
@@ -322,31 +322,23 @@ void signal_ready(tcp_ready* ready)
 {
     THREAD_CHECK_RET(wc_LockMutex(&ready->mutex));
     ready->ready = 1;
-#ifdef COND_NO_REQUIRE_LOCKED_MUTEX
     THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
-#endif
     THREAD_CHECK_RET(wolfSSL_CondSignal(&ready->cond));
-#ifndef COND_NO_REQUIRE_LOCKED_MUTEX
-    THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
-#endif
 }
 #endif
 
 void wait_tcp_ready(func_args* args)
 {
 #if !defined(SINGLE_THREADED) && defined(WOLFSSL_COND)
-    if (!args->signal->ready) {
-#ifndef COND_NO_REQUIRE_LOCKED_MUTEX
-        THREAD_CHECK_RET(wc_LockMutex(&args->signal->mutex));
-#endif
-        THREAD_CHECK_RET(wolfSSL_CondWait(&args->signal->cond,
-                                            &args->signal->mutex));
-#ifndef COND_NO_REQUIRE_LOCKED_MUTEX
-        THREAD_CHECK_RET(wc_UnLockMutex(&args->signal->mutex));
-#endif
+    tcp_ready* ready = args->signal;
+    THREAD_CHECK_RET(wc_LockMutex(&ready->mutex));
+    if (!ready->ready) {
+        THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
+        THREAD_CHECK_RET(wolfSSL_CondWait(&ready->cond));
+        THREAD_CHECK_RET(wc_LockMutex(&ready->mutex));
     }
-    args->signal->ready = 0; /* reset */
-
+    ready->ready = 0; /* reset */
+    THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
 #else
     /* no threading wait or single threaded */
     (void)args;
@@ -356,7 +348,7 @@ void wait_tcp_ready(func_args* args)
 #ifndef SINGLE_THREADED
 /* Start a thread.
  *
- * @param [in]  fun     Function to executre in thread.
+ * @param [in]  fun     Function to execute in thread.
  * @param [in]  args    Object to send to function in thread.
  * @param [out] thread  Handle to thread.
  */
diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index 61104b99a..c2169ec09 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -3491,11 +3491,8 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         return 0;
     }
 
-    int wolfSSL_CondWait(COND_TYPE* cond,
-        wolfSSL_Mutex* mutex)
+    int wolfSSL_CondWait(COND_TYPE* cond)
     {
-        (void)mutex;
-
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
@@ -3698,14 +3695,20 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
     }
 
 #ifdef WOLFSSL_COND
+    #ifndef __MACH__
+    /* Generic POSIX conditional */
     int wolfSSL_CondInit(COND_TYPE* cond)
     {
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        if (pthread_cond_init(cond, NULL) != 0)
+        cond->lockCount = 1; /* behave as signal, by defaulting to locked */
+        if (pthread_mutex_init(&cond->mutex, NULL) != 0)
             return MEMORY_E;
-
+        if (pthread_cond_init(&cond->cond, NULL) != 0) {
+            pthread_mutex_destroy(&cond->mutex);
+            return MEMORY_E;
+        }
         return 0;
     }
 
@@ -3714,9 +3717,8 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        if (pthread_cond_destroy(cond) != 0)
-            return MEMORY_E;
-
+        pthread_mutex_destroy(&cond->mutex);
+        pthread_cond_destroy(&cond->cond);
         return 0;
     }
 
@@ -3725,26 +3727,72 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        if (pthread_cond_signal(cond) != 0)
-            return MEMORY_E;
-
+        pthread_mutex_lock(&cond->mutex);
+        if (cond->lockCount > 0)
+            cond->lockCount--;
+        pthread_cond_signal(&cond->cond);
+        pthread_mutex_unlock(&cond->mutex);
         return 0;
     }
 
-    int wolfSSL_CondWait(COND_TYPE* cond,
-            wolfSSL_Mutex* mutex)
+    int wolfSSL_CondWait(COND_TYPE* cond)
     {
-        if (cond == NULL || mutex == NULL)
+        if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        /* mutex has to be locked on entry so we can't touch */
+        pthread_mutex_lock(&cond->mutex);
+        while (cond->lockCount > 0)
+            pthread_cond_wait(&cond->cond, &cond->mutex);
+        cond->lockCount++;
+        pthread_mutex_unlock(&cond->mutex);
+        return 0;
+    }
+    #else
+    /* Apple style dispatch semaphore */
+    int wolfSSL_CondInit(COND_TYPE* cond)
+    {
+        if (cond == NULL)
+            return BAD_FUNC_ARG;
 
-        if (pthread_cond_wait(cond, mutex) != 0)
+        /* dispatch_release() fails hard, with Trace/BPT trap signal, if the
+         * sem's internal count is less than the value passed in with
+         * dispatch_semaphore_create().  work around this by initing
+         * with 0, then incrementing it afterwards.
+         */
+        cond->sem = dispatch_semaphore_create(0);
+        if (cond->sem == NULL)
             return MEMORY_E;
-
         return 0;
     }
 
+    int wolfSSL_CondFree(COND_TYPE* cond)
+    {
+        if (cond == NULL)
+            return BAD_FUNC_ARG;
+
+        dispatch_release(cond->sem);
+        cond->sem = NULL;
+        return 0;
+    }
+
+    int wolfSSL_CondSignal(COND_TYPE* cond)
+    {
+        if (cond == NULL)
+            return BAD_FUNC_ARG;
+
+        dispatch_semaphore_signal(cond->sem);
+        return 0;
+    }
+
+    int wolfSSL_CondWait(COND_TYPE* cond)
+    {
+        if (cond == NULL)
+            return BAD_FUNC_ARG;
+
+        dispatch_semaphore_wait(cond->sem, DISPATCH_TIME_FOREVER);
+        return 0;
+    }
+    #endif /* __MACH__ */
 #endif /* WOLFSSL_COND */
 
 #endif
diff --git a/wolfssl/test.h b/wolfssl/test.h
index fb82a7034..f19cfbd3f 100644
--- a/wolfssl/test.h
+++ b/wolfssl/test.h
@@ -551,12 +551,10 @@ static WC_INLINE void InitTcpReady(tcp_ready* ready)
     ready->srfName = NULL;
 
 #ifndef SINGLE_THREADED
-#ifdef WOLFSSL_COND
     THREAD_CHECK_RET(wc_InitMutex(&ready->mutex));
+    #ifdef WOLFSSL_COND
     THREAD_CHECK_RET(wolfSSL_CondInit(&ready->cond));
-#else /* No signaling available, rely only on the mutex */
-    THREAD_CHECK_RET(wc_InitMutex(&ready->mutex));
-#endif
+    #endif
 #endif
 }
 
@@ -567,11 +565,9 @@ static WC_INLINE void InitTcpReady(tcp_ready* ready)
 static WC_INLINE void FreeTcpReady(tcp_ready* ready)
 {
 #ifndef SINGLE_THREADED
+    THREAD_CHECK_RET(wc_FreeMutex(&ready->mutex));
 #ifdef WOLFSSL_COND
-    THREAD_CHECK_RET(wc_FreeMutex(&ready->mutex));
     THREAD_CHECK_RET(wolfSSL_CondFree(&ready->cond));
-#else /* No signaling available, rely only on the mutex */
-    THREAD_CHECK_RET(wc_FreeMutex(&ready->mutex));
 #endif
 #else
     (void)ready;
@@ -695,24 +691,16 @@ static WC_INLINE void srtp_helper_init(srtp_test_helper *srtp)
 static WC_INLINE void srtp_helper_get_ekm(srtp_test_helper *srtp,
                                           uint8_t **ekm, size_t *size)
 {
-#ifndef COND_NO_REQUIRE_LOCKED_MUTEX
-    THREAD_CHECK_RET(wc_LockMutex(&srtp->mutex));
-#endif
-
     if (srtp->server_srtp_ekm == NULL)
         THREAD_CHECK_RET(wolfSSL_CondWait(&srtp->cond, &srtp->mutex));
 
-#ifdef COND_NO_REQUIRE_LOCKED_MUTEX
     THREAD_CHECK_RET(wc_LockMutex(&srtp->mutex));
-#endif
-
     *ekm = srtp->server_srtp_ekm;
     *size = srtp->server_srtp_ekm_size;
 
     /* reset */
     srtp->server_srtp_ekm = NULL;
     srtp->server_srtp_ekm_size = 0;
-
     THREAD_CHECK_RET(wc_UnLockMutex(&srtp->mutex));
 }
 
@@ -731,17 +719,10 @@ static WC_INLINE void srtp_helper_set_ekm(srtp_test_helper *srtp,
                                           uint8_t *ekm, size_t size)
 {
     THREAD_CHECK_RET(wc_LockMutex(&srtp->mutex));
-
     srtp->server_srtp_ekm_size = size;
     srtp->server_srtp_ekm = ekm;
-#ifdef COND_NO_REQUIRE_LOCKED_MUTEX
     THREAD_CHECK_RET(wc_UnLockMutex(&srtp->mutex));
-#endif
     THREAD_CHECK_RET(wolfSSL_CondSignal(&srtp->cond));
-
-#ifndef COND_NO_REQUIRE_LOCKED_MUTEX
-    THREAD_CHECK_RET(wc_UnLockMutex(&srtp->mutex));
-#endif
 }
 
 static WC_INLINE void srtp_helper_free(srtp_test_helper *srtp)
@@ -750,7 +731,8 @@ static WC_INLINE void srtp_helper_free(srtp_test_helper *srtp)
     THREAD_CHECK_RET(wolfSSL_CondFree(&srtp->cond));
 }
 
-#endif /* WOLFSSL_SRTP && !SINGLE_THREADED && POSIX_THREADS */
+#endif /* WOLFSSL_SRTP && WOLFSSL_COND */
+
 
 /**
  *
@@ -2237,19 +2219,12 @@ static WC_INLINE void udp_accept(SOCKET_T* sockfd, SOCKET_T* clientfd,
         THREAD_CHECK_RET(wc_LockMutex(&ready->mutex));
         ready->ready = 1;
         ready->port = port;
-#ifdef WOLFSSL_COND
+        THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
+    #ifdef WOLFSSL_COND
         /* signal ready to accept data */
-#ifdef COND_NO_REQUIRE_LOCKED_MUTEX
-        THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
-#endif
         THREAD_CHECK_RET(wolfSSL_CondSignal(&ready->cond));
-#ifndef COND_NO_REQUIRE_LOCKED_MUTEX
-        THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
-#endif
-#else
-        THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
-#endif
-#endif
+    #endif
+#endif /* !SINGLE_THREADED */
     }
     else {
         fprintf(stderr, "args or args->signal was NULL. Not setting ready info.");
@@ -2283,17 +2258,12 @@ static WC_INLINE void tcp_accept(SOCKET_T* sockfd, SOCKET_T* clientfd,
             THREAD_CHECK_RET(wc_LockMutex(&ready->mutex));
             ready->ready = 1;
             ready->port = port;
-#ifdef WOLFSSL_COND
-#ifdef COND_NO_REQUIRE_LOCKED_MUTEX
             THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
-#endif
+        #ifdef WOLFSSL_COND
             THREAD_CHECK_RET(wolfSSL_CondSignal(&ready->cond));
-#ifndef COND_NO_REQUIRE_LOCKED_MUTEX
-            THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
-#endif
-#endif
+        #endif
         }
-#endif
+#endif /* !SINGLE_THREADED */
 
         if (ready_file) {
         #if !defined(NO_FILESYSTEM) || defined(FORCE_BUFFER_TEST) && \
diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h
index 93413f3da..a46970ecf 100644
--- a/wolfssl/wolfcrypt/types.h
+++ b/wolfssl/wolfcrypt/types.h
@@ -1380,9 +1380,21 @@ typedef struct w64wrapper {
         #define WOLFSSL_THREAD
     #elif (defined(_POSIX_THREADS) || defined(HAVE_PTHREAD)) && \
         !defined(__MINGW32__)
+        #ifdef __MACH__
+            #include <dispatch/dispatch.h>
+            typedef struct COND_TYPE {
+                dispatch_semaphore_t sem;
+            } COND_TYPE;
+        #else
+            #include <pthread.h>
+            typedef struct COND_TYPE {
+                volatile int lockCount;
+                pthread_mutex_t mutex;
+                pthread_cond_t cond;
+            } COND_TYPE;
+        #endif
         typedef void*         THREAD_RETURN;
         typedef pthread_t     THREAD_TYPE;
-        typedef pthread_cond_t COND_TYPE;
         #define WOLFSSL_COND
         #define WOLFSSL_THREAD
         #ifndef HAVE_SELFTEST
@@ -1398,7 +1410,6 @@ typedef struct w64wrapper {
         typedef HANDLE        COND_TYPE;
         #define WOLFSSL_COND
         #define INVALID_THREAD_VAL ((THREAD_TYPE)(INVALID_HANDLE_VALUE))
-        #define COND_NO_REQUIRE_LOCKED_MUTEX
         #define WOLFSSL_THREAD __stdcall
         #define WOLFSSL_THREAD_NO_JOIN __cdecl
     #else
@@ -1433,8 +1444,6 @@ typedef struct w64wrapper {
          *                          thread callbacks that don't require cleanup
          * WOLFSSL_COND - defined if this system suports signaling
          * COND_TYPE - type that should be passed into the signaling API
-         * COND_NO_REQUIRE_LOCKED_MUTEX - defined if the signaling doesn't
-         *                                require locking a mutex
          * WOLFSSL_THREAD_VOID_RETURN - defined if the thread callback has a
          *                              void return
          * WOLFSSL_RETURN_FROM_THREAD - define used to correctly return from a
@@ -1475,8 +1484,7 @@ typedef struct w64wrapper {
             WOLFSSL_API int wolfSSL_CondInit(COND_TYPE* cond);
             WOLFSSL_API int wolfSSL_CondFree(COND_TYPE* cond);
             WOLFSSL_API int wolfSSL_CondSignal(COND_TYPE* cond);
-            WOLFSSL_API int wolfSSL_CondWait(COND_TYPE* cond,
-                wolfSSL_Mutex* mutex);
+            WOLFSSL_API int wolfSSL_CondWait(COND_TYPE* cond);
         #endif
     #else
         #define WOLFSSL_RETURN_FROM_THREAD(x) return (THREAD_RETURN)(x)

From 39f632d09656d6fcec79e0a887acc3aed9b7e1a4 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Tue, 8 Aug 2023 12:51:27 -0700
Subject: [PATCH 02/10] Remove lockCount.

---
 wolfcrypt/src/wc_port.c   | 7 +------
 wolfssl/wolfcrypt/types.h | 1 -
 2 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index c2169ec09..54eb27f25 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -3702,7 +3702,6 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        cond->lockCount = 1; /* behave as signal, by defaulting to locked */
         if (pthread_mutex_init(&cond->mutex, NULL) != 0)
             return MEMORY_E;
         if (pthread_cond_init(&cond->cond, NULL) != 0) {
@@ -3728,8 +3727,6 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
             return BAD_FUNC_ARG;
 
         pthread_mutex_lock(&cond->mutex);
-        if (cond->lockCount > 0)
-            cond->lockCount--;
         pthread_cond_signal(&cond->cond);
         pthread_mutex_unlock(&cond->mutex);
         return 0;
@@ -3741,9 +3738,7 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
             return BAD_FUNC_ARG;
 
         pthread_mutex_lock(&cond->mutex);
-        while (cond->lockCount > 0)
-            pthread_cond_wait(&cond->cond, &cond->mutex);
-        cond->lockCount++;
+        pthread_cond_wait(&cond->cond, &cond->mutex);
         pthread_mutex_unlock(&cond->mutex);
         return 0;
     }
diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h
index a46970ecf..3c4294895 100644
--- a/wolfssl/wolfcrypt/types.h
+++ b/wolfssl/wolfcrypt/types.h
@@ -1388,7 +1388,6 @@ typedef struct w64wrapper {
         #else
             #include <pthread.h>
             typedef struct COND_TYPE {
-                volatile int lockCount;
                 pthread_mutex_t mutex;
                 pthread_cond_t cond;
             } COND_TYPE;

From c7b6fa2931f9da69ba9235ccd2283c1a57730983 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Tue, 8 Aug 2023 13:58:38 -0700
Subject: [PATCH 03/10] Return codes and missed srtp.

---
 wolfcrypt/src/wc_port.c | 26 +++++++++++++++-----------
 wolfssl/test.h          |  8 +++++---
 2 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index 54eb27f25..e39f6ad9e 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -3705,7 +3705,7 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         if (pthread_mutex_init(&cond->mutex, NULL) != 0)
             return MEMORY_E;
         if (pthread_cond_init(&cond->cond, NULL) != 0) {
-            pthread_mutex_destroy(&cond->mutex);
+            (void)pthread_mutex_destroy(&cond->mutex);
             return MEMORY_E;
         }
         return 0;
@@ -3716,8 +3716,8 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        pthread_mutex_destroy(&cond->mutex);
-        pthread_cond_destroy(&cond->cond);
+        (void)pthread_mutex_destroy(&cond->mutex);
+        (void)pthread_cond_destroy(&cond->cond);
         return 0;
     }
 
@@ -3726,10 +3726,12 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        pthread_mutex_lock(&cond->mutex);
-        pthread_cond_signal(&cond->cond);
-        pthread_mutex_unlock(&cond->mutex);
-        return 0;
+        if (pthread_mutex_lock(&cond->mutex) == 0) {
+            (void)pthread_cond_signal(&cond->cond);
+            (void)pthread_mutex_unlock(&cond->mutex);
+            return 0;
+        }
+        return BAD_MUTEX_E;
     }
 
     int wolfSSL_CondWait(COND_TYPE* cond)
@@ -3737,10 +3739,12 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        pthread_mutex_lock(&cond->mutex);
-        pthread_cond_wait(&cond->cond, &cond->mutex);
-        pthread_mutex_unlock(&cond->mutex);
-        return 0;
+        if (pthread_mutex_lock(&cond->mutex) == 0) {
+            (void)pthread_cond_wait(&cond->cond, &cond->mutex);
+            (void)pthread_mutex_unlock(&cond->mutex);
+            return 0;
+        }
+        return BAD_MUTEX_E;
     }
     #else
     /* Apple style dispatch semaphore */
diff --git a/wolfssl/test.h b/wolfssl/test.h
index f19cfbd3f..e468e7bae 100644
--- a/wolfssl/test.h
+++ b/wolfssl/test.h
@@ -691,10 +691,12 @@ static WC_INLINE void srtp_helper_init(srtp_test_helper *srtp)
 static WC_INLINE void srtp_helper_get_ekm(srtp_test_helper *srtp,
                                           uint8_t **ekm, size_t *size)
 {
-    if (srtp->server_srtp_ekm == NULL)
-        THREAD_CHECK_RET(wolfSSL_CondWait(&srtp->cond, &srtp->mutex));
-
     THREAD_CHECK_RET(wc_LockMutex(&srtp->mutex));
+    if (srtp->server_srtp_ekm == NULL) {
+        THREAD_CHECK_RET(wc_UnLockMutex(&srtp->mutex));
+        THREAD_CHECK_RET(wolfSSL_CondWait(&srtp->cond));
+        THREAD_CHECK_RET(wc_LockMutex(&srtp->mutex));
+    }
     *ekm = srtp->server_srtp_ekm;
     *size = srtp->server_srtp_ekm_size;
 

From 27feb9b9e972f447a6916f4c6ef87ca8e088b784 Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Wed, 9 Aug 2023 14:18:32 +0200
Subject: [PATCH 04/10] Simplify mac cond type

---
 wolfcrypt/src/wc_port.c   | 14 +++++++-------
 wolfssl/wolfcrypt/types.h | 10 ++++------
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index e39f6ad9e..29200ae90 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -3746,7 +3746,7 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         }
         return BAD_MUTEX_E;
     }
-    #else
+    #else /* __MACH__ */
     /* Apple style dispatch semaphore */
     int wolfSSL_CondInit(COND_TYPE* cond)
     {
@@ -3758,8 +3758,8 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
          * dispatch_semaphore_create().  work around this by initing
          * with 0, then incrementing it afterwards.
          */
-        cond->sem = dispatch_semaphore_create(0);
-        if (cond->sem == NULL)
+        *cond = dispatch_semaphore_create(0);
+        if (*cond == NULL)
             return MEMORY_E;
         return 0;
     }
@@ -3769,8 +3769,8 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        dispatch_release(cond->sem);
-        cond->sem = NULL;
+        dispatch_release(*cond);
+        *cond = NULL;
         return 0;
     }
 
@@ -3779,7 +3779,7 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        dispatch_semaphore_signal(cond->sem);
+        dispatch_semaphore_signal(*cond);
         return 0;
     }
 
@@ -3788,7 +3788,7 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        dispatch_semaphore_wait(cond->sem, DISPATCH_TIME_FOREVER);
+        dispatch_semaphore_wait(*cond, DISPATCH_TIME_FOREVER);
         return 0;
     }
     #endif /* __MACH__ */
diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h
index 3c4294895..3a6b8a7af 100644
--- a/wolfssl/wolfcrypt/types.h
+++ b/wolfssl/wolfcrypt/types.h
@@ -1380,17 +1380,15 @@ typedef struct w64wrapper {
         #define WOLFSSL_THREAD
     #elif (defined(_POSIX_THREADS) || defined(HAVE_PTHREAD)) && \
         !defined(__MINGW32__)
-        #ifdef __MACH__
-            #include <dispatch/dispatch.h>
-            typedef struct COND_TYPE {
-                dispatch_semaphore_t sem;
-            } COND_TYPE;
-        #else
+        #ifndef __MACH__
             #include <pthread.h>
             typedef struct COND_TYPE {
                 pthread_mutex_t mutex;
                 pthread_cond_t cond;
             } COND_TYPE;
+        #else
+            #include <dispatch/dispatch.h>
+            typedef dispatch_semaphore_t COND_TYPE;
         #endif
         typedef void*         THREAD_RETURN;
         typedef pthread_t     THREAD_TYPE;

From 6fcdead11294164ef9af6bb2d70dbb0a7c9c94bb Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Wed, 9 Aug 2023 14:20:29 +0200
Subject: [PATCH 05/10] Check error codes from pthread funcs

---
 wolfcrypt/src/wc_port.c | 51 ++++++++++++++++++++++++++++-------------
 1 file changed, 35 insertions(+), 16 deletions(-)

diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index 29200ae90..e9514836c 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -3705,7 +3705,9 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         if (pthread_mutex_init(&cond->mutex, NULL) != 0)
             return MEMORY_E;
         if (pthread_cond_init(&cond->cond, NULL) != 0) {
-            (void)pthread_mutex_destroy(&cond->mutex);
+            /* Keep compilers happy that we are using the return code */
+            if (pthread_mutex_destroy(&cond->mutex) != 0)
+                return MEMORY_E;
             return MEMORY_E;
         }
         return 0;
@@ -3713,38 +3715,55 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
 
     int wolfSSL_CondFree(COND_TYPE* cond)
     {
+        int ret = 0;
+
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        (void)pthread_mutex_destroy(&cond->mutex);
-        (void)pthread_cond_destroy(&cond->cond);
-        return 0;
+        if (pthread_mutex_destroy(&cond->mutex) != 0)
+            ret = MEMORY_E;
+        if (pthread_cond_destroy(&cond->cond) != 0)
+            ret = MEMORY_E;
+
+        return ret;
     }
 
     int wolfSSL_CondSignal(COND_TYPE* cond)
     {
+        int ret = 0;
+
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        if (pthread_mutex_lock(&cond->mutex) == 0) {
-            (void)pthread_cond_signal(&cond->cond);
-            (void)pthread_mutex_unlock(&cond->mutex);
-            return 0;
-        }
-        return BAD_MUTEX_E;
+        if (pthread_mutex_lock(&cond->mutex) != 0)
+            return BAD_MUTEX_E;
+
+        if (pthread_cond_signal(&cond->cond) != 0)
+            ret = MEMORY_E;
+
+        if (pthread_mutex_unlock(&cond->mutex) != 0)
+            ret = MEMORY_E;
+
+        return ret;
     }
 
     int wolfSSL_CondWait(COND_TYPE* cond)
     {
+        int ret = 0;
+
         if (cond == NULL)
             return BAD_FUNC_ARG;
 
-        if (pthread_mutex_lock(&cond->mutex) == 0) {
-            (void)pthread_cond_wait(&cond->cond, &cond->mutex);
-            (void)pthread_mutex_unlock(&cond->mutex);
-            return 0;
-        }
-        return BAD_MUTEX_E;
+        if (pthread_mutex_lock(&cond->mutex) != 0)
+            return BAD_MUTEX_E;
+
+        if (pthread_cond_wait(&cond->cond, &cond->mutex) != 0)
+            ret = MEMORY_E;
+
+        if (pthread_mutex_unlock(&cond->mutex) != 0)
+            ret = MEMORY_E;
+
+        return ret;
     }
     #else /* __MACH__ */
     /* Apple style dispatch semaphore */

From 7ba00f3b841b217bc4921ebc7c199952105b5ffb Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Wed, 9 Aug 2023 16:23:46 +0200
Subject: [PATCH 06/10] Initialize BIO methods at compile time

---
 src/bio.c     | 32 ++++++++++++++++----------------
 wolfssl/ssl.h | 13 +++++++++++++
 2 files changed, 29 insertions(+), 16 deletions(-)

diff --git a/src/bio.c b/src/bio.c
index 2e6de0a9c..85de16dd5 100644
--- a/src/bio.c
+++ b/src/bio.c
@@ -1963,10 +1963,10 @@ int wolfSSL_BIO_flush(WOLFSSL_BIO* bio)
 
     WOLFSSL_BIO_METHOD* wolfSSL_BIO_f_md(void)
     {
-        static WOLFSSL_BIO_METHOD meth;
+        static WOLFSSL_BIO_METHOD meth =
+                WOLFSSL_BIO_METHOD_INIT(WOLFSSL_BIO_MD);
 
         WOLFSSL_ENTER("wolfSSL_BIO_f_md");
-        meth.type = WOLFSSL_BIO_MD;
 
         return &meth;
     }
@@ -1986,10 +1986,10 @@ int wolfSSL_BIO_flush(WOLFSSL_BIO* bio)
 
     WOLFSSL_BIO_METHOD* wolfSSL_BIO_f_buffer(void)
     {
-        static WOLFSSL_BIO_METHOD meth;
+        static WOLFSSL_BIO_METHOD meth =
+                WOLFSSL_BIO_METHOD_INIT(WOLFSSL_BIO_BUFFER);
 
         WOLFSSL_ENTER("wolfSSL_BIO_f_buffer");
-        meth.type = WOLFSSL_BIO_BUFFER;
 
         return &meth;
     }
@@ -2017,10 +2017,10 @@ int wolfSSL_BIO_flush(WOLFSSL_BIO* bio)
 
     WOLFSSL_BIO_METHOD* wolfSSL_BIO_s_bio(void)
     {
-        static WOLFSSL_BIO_METHOD bio_meth;
+        static WOLFSSL_BIO_METHOD bio_meth =
+                WOLFSSL_BIO_METHOD_INIT(WOLFSSL_BIO_BIO);
 
         WOLFSSL_ENTER("wolfSSL_BIO_s_bio");
-        bio_meth.type = WOLFSSL_BIO_BIO;
 
         return &bio_meth;
     }
@@ -2029,10 +2029,10 @@ int wolfSSL_BIO_flush(WOLFSSL_BIO* bio)
 #ifndef NO_FILESYSTEM
     WOLFSSL_BIO_METHOD* wolfSSL_BIO_s_file(void)
     {
-        static WOLFSSL_BIO_METHOD file_meth;
+        static WOLFSSL_BIO_METHOD file_meth =
+                WOLFSSL_BIO_METHOD_INIT(WOLFSSL_BIO_FILE);
 
         WOLFSSL_ENTER("wolfSSL_BIO_s_file");
-        file_meth.type = WOLFSSL_BIO_FILE;
 
         return &file_meth;
     }
@@ -2041,10 +2041,10 @@ int wolfSSL_BIO_flush(WOLFSSL_BIO* bio)
 
     WOLFSSL_BIO_METHOD* wolfSSL_BIO_f_ssl(void)
     {
-        static WOLFSSL_BIO_METHOD meth;
+        static WOLFSSL_BIO_METHOD meth =
+                WOLFSSL_BIO_METHOD_INIT(WOLFSSL_BIO_SSL);
 
         WOLFSSL_ENTER("wolfSSL_BIO_f_ssl");
-        meth.type = WOLFSSL_BIO_SSL;
 
         return &meth;
     }
@@ -2052,10 +2052,10 @@ int wolfSSL_BIO_flush(WOLFSSL_BIO* bio)
 
     WOLFSSL_BIO_METHOD *wolfSSL_BIO_s_socket(void)
     {
-        static WOLFSSL_BIO_METHOD meth;
+        static WOLFSSL_BIO_METHOD meth =
+                WOLFSSL_BIO_METHOD_INIT(WOLFSSL_BIO_SOCKET);
 
         WOLFSSL_ENTER("wolfSSL_BIO_s_socket");
-        meth.type = WOLFSSL_BIO_SOCKET;
 
         return &meth;
     }
@@ -2803,10 +2803,10 @@ WOLFSSL_BIO* wolfSSL_BIO_pop(WOLFSSL_BIO* bio)
 
 WOLFSSL_BIO_METHOD* wolfSSL_BIO_s_mem(void)
 {
-    static WOLFSSL_BIO_METHOD meth;
+    static WOLFSSL_BIO_METHOD meth =
+            WOLFSSL_BIO_METHOD_INIT(WOLFSSL_BIO_MEMORY);
 
     WOLFSSL_ENTER("wolfSSL_BIO_s_mem");
-    meth.type = WOLFSSL_BIO_MEMORY;
 
     return &meth;
 }
@@ -2814,10 +2814,10 @@ WOLFSSL_BIO_METHOD* wolfSSL_BIO_s_mem(void)
 
 WOLFSSL_BIO_METHOD* wolfSSL_BIO_f_base64(void)
 {
-    static WOLFSSL_BIO_METHOD meth;
+    static WOLFSSL_BIO_METHOD meth =
+            WOLFSSL_BIO_METHOD_INIT(WOLFSSL_BIO_BASE64);
 
     WOLFSSL_ENTER("wolfSSL_BIO_f_base64");
-    meth.type = WOLFSSL_BIO_BASE64;
 
     return &meth;
 }
diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h
index 26082f850..b1ade6b6b 100644
--- a/wolfssl/ssl.h
+++ b/wolfssl/ssl.h
@@ -525,6 +525,19 @@ struct WOLFSSL_BIO_METHOD {
     wolfssl_BIO_meth_ctrl_info_cb ctrlInfoCb;
 };
 
+#define WOLFSSL_BIO_METHOD_INIT(bio_type) { \
+    .type = bio_type,                       \
+    .name = { 0 },                          \
+    .writeCb = NULL,                        \
+    .readCb = NULL,                         \
+    .putsCb = NULL,                         \
+    .getsCb = NULL,                         \
+    .ctrlCb = NULL,                         \
+    .createCb = NULL,                       \
+    .freeCb = NULL,                         \
+    .ctrlInfoCb = NULL,                     \
+}
+
 /* wolfSSL BIO type */
 typedef long (*wolf_bio_info_cb)(WOLFSSL_BIO *bio, int event, const char *parg,
                                  int iarg, long larg, long return_value);

From d747df2ae4d0d90cda7a2214cb8795724e55976f Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Wed, 9 Aug 2023 16:25:58 +0200
Subject: [PATCH 07/10] Make sure no mutexes are held when cond API are called

---
 examples/benchmark/tls_bench.c   | 16 +++++++++++-----
 examples/echoserver/echoserver.c |  2 +-
 src/crl.c                        | 20 ++++++++++++++++----
 wolfcrypt/src/wc_port.c          |  3 +++
 4 files changed, 31 insertions(+), 10 deletions(-)

diff --git a/examples/benchmark/tls_bench.c b/examples/benchmark/tls_bench.c
index 0417f1b18..686060aa4 100644
--- a/examples/benchmark/tls_bench.c
+++ b/examples/benchmark/tls_bench.c
@@ -416,9 +416,9 @@ static int ServerMemSend(info_t* info, char* buf, int sz)
     XMEMCPY(&info->to_client.buf[info->to_client.write_idx], buf, sz);
     info->to_client.write_idx += sz;
     info->to_client.write_bytes += sz;
+    THREAD_CHECK_RET(wc_UnLockMutex(&info->to_client.mutex));
 
     THREAD_CHECK_RET(wolfSSL_CondSignal(&info->to_client.cond));
-    THREAD_CHECK_RET(wc_UnLockMutex(&info->to_client.mutex));
 
 #ifdef BENCH_USE_NONBLOCK
     if (sz == 0) {
@@ -436,7 +436,9 @@ static int ServerMemRecv(info_t* info, char* buf, int sz)
 #ifndef BENCH_USE_NONBLOCK
     while (info->to_server.write_idx - info->to_server.read_idx < sz &&
             !info->to_client.done) {
+        THREAD_CHECK_RET(wc_UnLockMutex(&info->to_server.mutex));
         THREAD_CHECK_RET(wolfSSL_CondWait(&info->to_server.cond));
+        THREAD_CHECK_RET(wc_LockMutex(&info->to_server.mutex));
     }
 #else
     if (info->to_server.write_idx - info->to_server.read_idx < sz) {
@@ -491,8 +493,8 @@ static int ClientMemSend(info_t* info, char* buf, int sz)
     info->to_server.write_idx += sz;
     info->to_server.write_bytes += sz;
 
-    THREAD_CHECK_RET(wolfSSL_CondSignal(&info->to_server.cond));
     THREAD_CHECK_RET(wc_UnLockMutex(&info->to_server.mutex));
+    THREAD_CHECK_RET(wolfSSL_CondSignal(&info->to_server.cond));
 
 #ifdef BENCH_USE_NONBLOCK
     if (sz == 0) {
@@ -510,7 +512,9 @@ static int ClientMemRecv(info_t* info, char* buf, int sz)
 #ifndef BENCH_USE_NONBLOCK
     while (info->to_client.write_idx - info->to_client.read_idx < sz &&
             !info->to_server.done) {
+        THREAD_CHECK_RET(wc_UnLockMutex(&info->to_client.mutex));
         THREAD_CHECK_RET(wolfSSL_CondWait(&info->to_client.cond));
+        THREAD_CHECK_RET(wc_LockMutex(&info->to_client.mutex));
     }
 #else
     if (info->to_client.write_idx - info->to_client.read_idx < sz) {
@@ -1052,7 +1056,9 @@ static int bench_tls_client(info_t* info)
         if (info->doDTLS && !info->clientOrserverOnly) {
             THREAD_CHECK_RET(wc_LockMutex(&info->dtls_mutex));
             if (info->serverReady != 1) {
+                THREAD_CHECK_RET(wc_UnLockMutex(&info->dtls_mutex));
                 THREAD_CHECK_RET(wolfSSL_CondWait(&info->dtls_cond));
+                THREAD_CHECK_RET(wc_LockMutex(&info->dtls_mutex));
             }
             /* for next loop */
             info->serverReady = 0;
@@ -1198,9 +1204,9 @@ static THREAD_RETURN WOLFSSL_THREAD_NO_JOIN client_thread(void* args)
 
     ret = bench_tls_client(info);
 
-    THREAD_CHECK_RET(wolfSSL_CondSignal(&info->to_server.cond));
     info->to_client.done = 1;
     info->client.ret = ret;
+    THREAD_CHECK_RET(wolfSSL_CondSignal(&info->to_server.cond));
 
     WOLFSSL_RETURN_FROM_THREAD(NULL);
 }
@@ -1288,8 +1294,8 @@ static int SocketWaitClient(info_t* info)
         if (!info->clientOrserverOnly) {
             THREAD_CHECK_RET(wc_LockMutex(&info->dtls_mutex));
             info->serverReady = 1;
-            THREAD_CHECK_RET(wolfSSL_CondSignal(&info->dtls_cond));
             THREAD_CHECK_RET(wc_UnLockMutex(&info->dtls_mutex));
+            THREAD_CHECK_RET(wolfSSL_CondSignal(&info->dtls_cond));
         }
 #endif
         connd = (int)recvfrom(info->listenFd, (char *)msg, sizeof(msg),
@@ -1656,9 +1662,9 @@ static THREAD_RETURN WOLFSSL_THREAD_NO_JOIN server_thread(void* args)
         }
     }
 
-    THREAD_CHECK_RET(wolfSSL_CondSignal(&info->to_client.cond));
     info->to_server.done = 1;
     info->server.ret = ret;
+    THREAD_CHECK_RET(wolfSSL_CondSignal(&info->to_client.cond));
 
     WOLFSSL_RETURN_FROM_THREAD(NULL);
 }
diff --git a/examples/echoserver/echoserver.c b/examples/echoserver/echoserver.c
index ae5e8dbbc..5f6293e0e 100644
--- a/examples/echoserver/echoserver.c
+++ b/examples/echoserver/echoserver.c
@@ -74,8 +74,8 @@ static void SignalReady(void* args, word16 port)
     THREAD_CHECK_RET(wc_LockMutex(&ready->mutex));
     ready->ready = 1;
     ready->port = port;
-    THREAD_CHECK_RET(wolfSSL_CondSignal(&ready->cond));
     THREAD_CHECK_RET(wc_UnLockMutex(&ready->mutex));
+    THREAD_CHECK_RET(wolfSSL_CondSignal(&ready->cond));
 #endif /* NO_MAIN_DRIVER && WOLFSSL_COND */
     (void)args;
     (void)port;
diff --git a/src/crl.c b/src/crl.c
index 540f785f8..49048703c 100644
--- a/src/crl.c
+++ b/src/crl.c
@@ -936,7 +936,10 @@ static int SignalSetup(WOLFSSL_CRL* crl, int status)
         return BAD_MUTEX_E;
     }
     crl->setup = status;
-    wc_UnLockMutex(&crl->crlLock);
+    if (wc_UnLockMutex(&crl->crlLock) != 0) {
+        WOLFSSL_MSG("wc_UnLockMutex crlLock failed");
+        return BAD_MUTEX_E;
+    }
 
     ret = wolfSSL_CondSignal(&crl->cond);
     if (ret != 0)
@@ -1492,9 +1495,15 @@ static int StartMonitorCRL(WOLFSSL_CRL* crl)
     }
     while (crl->setup == 0) {
         int condRet;
-        wc_UnLockMutex(&crl->crlLock);
+        if (wc_UnLockMutex(&crl->crlLock) != 0) {
+            WOLFSSL_MSG("wc_UnLockMutex crlLock failed");
+            return BAD_MUTEX_E;
+        }
         condRet = wolfSSL_CondWait(&crl->cond);
-        wc_LockMutex(&crl->crlLock);
+        if (wc_LockMutex(&crl->crlLock) != 0) {
+            WOLFSSL_MSG("wc_LockMutex crlLock failed");
+            return BAD_MUTEX_E;
+        }
         if (condRet != 0) {
             ret = BAD_COND_E;
             break;
@@ -1502,12 +1511,15 @@ static int StartMonitorCRL(WOLFSSL_CRL* crl)
     }
     if (ret >= 0 && crl->setup < 0)
         ret = crl->setup;  /* store setup error */
-    wc_UnLockMutex(&crl->crlLock);
 
     if (ret < 0) {
         WOLFSSL_MSG("DoMonitor setup failure");
         crl->tid = INVALID_THREAD_VAL;  /* thread already done */
     }
+    if (wc_UnLockMutex(&crl->crlLock) != 0) {
+        WOLFSSL_MSG("wc_UnLockMutex crlLock failed");
+        return BAD_MUTEX_E;
+    }
 
     return ret;
 }
diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index e9514836c..13ca5799b 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -3704,12 +3704,14 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
 
         if (pthread_mutex_init(&cond->mutex, NULL) != 0)
             return MEMORY_E;
+
         if (pthread_cond_init(&cond->cond, NULL) != 0) {
             /* Keep compilers happy that we are using the return code */
             if (pthread_mutex_destroy(&cond->mutex) != 0)
                 return MEMORY_E;
             return MEMORY_E;
         }
+
         return 0;
     }
 
@@ -3722,6 +3724,7 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
 
         if (pthread_mutex_destroy(&cond->mutex) != 0)
             ret = MEMORY_E;
+
         if (pthread_cond_destroy(&cond->cond) != 0)
             ret = MEMORY_E;
 

From bc4c0df3150cbd1b24eb602b460160809a07f6e1 Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Wed, 9 Aug 2023 16:47:03 +0200
Subject: [PATCH 08/10] Update multi-compiler timeout

---
 .github/workflows/multi-compiler.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/multi-compiler.yml b/.github/workflows/multi-compiler.yml
index 60feb3b41..3099139c9 100644
--- a/.github/workflows/multi-compiler.yml
+++ b/.github/workflows/multi-compiler.yml
@@ -26,7 +26,7 @@ jobs:
             CXX: clang++-14
     runs-on: ubuntu-latest
     # This should be a safe limit for the tests to run.
-    timeout-minutes: 2
+    timeout-minutes: 4
     steps:
       - uses: actions/checkout@v3
       - name: Build

From b86d2a3bff4cc0cfb5d95e1176ecd0bddcc52052 Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Wed, 9 Aug 2023 16:47:14 +0200
Subject: [PATCH 09/10] Fix typo

---
 wolfssl/quic.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wolfssl/quic.h b/wolfssl/quic.h
index 871951169..c1462cbae 100644
--- a/wolfssl/quic.h
+++ b/wolfssl/quic.h
@@ -52,7 +52,7 @@ typedef struct wolfssl_quic_method_t WOLFSSL_QUIC_METHOD;
 
 struct wolfssl_quic_method_t {
     /**
-     * Provide secrets to the QUIC stack when they becaome available in the SSL
+     * Provide secrets to the QUIC stack when they become available in the SSL
      * instance during handshake processing. read/write secrets have the same
      * length. A call may only provide one, passing NULL as the other.
      */

From 737e12a1bdc42d76ebc1030f3a5cf2d9ee9ae5c9 Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Wed, 9 Aug 2023 17:04:59 +0200
Subject: [PATCH 10/10] fixup! Initialize BIO methods at compile time

---
 wolfssl/ssl.h | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h
index b1ade6b6b..20f85982c 100644
--- a/wolfssl/ssl.h
+++ b/wolfssl/ssl.h
@@ -525,18 +525,8 @@ struct WOLFSSL_BIO_METHOD {
     wolfssl_BIO_meth_ctrl_info_cb ctrlInfoCb;
 };
 
-#define WOLFSSL_BIO_METHOD_INIT(bio_type) { \
-    .type = bio_type,                       \
-    .name = { 0 },                          \
-    .writeCb = NULL,                        \
-    .readCb = NULL,                         \
-    .putsCb = NULL,                         \
-    .getsCb = NULL,                         \
-    .ctrlCb = NULL,                         \
-    .createCb = NULL,                       \
-    .freeCb = NULL,                         \
-    .ctrlInfoCb = NULL,                     \
-}
+#define WOLFSSL_BIO_METHOD_INIT(bio_type) \
+    { bio_type, { 0 }, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL }
 
 /* wolfSSL BIO type */
 typedef long (*wolf_bio_info_cb)(WOLFSSL_BIO *bio, int event, const char *parg,