NSPR PR_RWLocks are not re-entrant. 389 is refactoring its code to provide and use slapi_rwlocks instead. All freeipa plugins should be refactored to use the slapi_rwlock interface when it is available.
Upstream ticket: https://fedorahosted.org/freeipa/ticket/1635
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/0147ef5b73c5b5345dd9bdb5d273ffcf8cb20cab ipa-2-1: https://fedorahosted.org/freeipa/changeset/ae06f7b68e04000b748f702d553a5b691eb6cb3c
Fixed in 2.1.1