1 2010-05-06 Ulrich Drepper <drepper@redhat.com>
3 * malloc/malloc.c (_int_free): Possible race in the most recently
4 added check. Only act on the data if no current modification
7 Index: glibc-2.12-2-gc4ccff1/malloc/malloc.c
8 ===================================================================
9 --- glibc-2.12-2-gc4ccff1.orig/malloc/malloc.c
10 +++ glibc-2.12-2-gc4ccff1/malloc/malloc.c
11 @@ -4859,6 +4859,7 @@ _int_free(mstate av, mchunkptr p)
12 #ifdef ATOMIC_FASTBINS
15 + unsigned int old_idx = ~0u;
18 /* Another simple check: make sure the top of the bin is not the
19 @@ -4868,15 +4869,17 @@ _int_free(mstate av, mchunkptr p)
20 errstr = "double free or corruption (fasttop)";
24 - && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0))
26 - errstr = "invalid fastbin entry (free)";
30 + old_idx = fastbin_index(chunksize(old));
33 while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd);
35 + if (fd != NULL && __builtin_expect (old_idx != idx, 0))
37 + errstr = "invalid fastbin entry (free)";
41 /* Another simple check: make sure the top of the bin is not the
42 record we are going to add (i.e., double free). */