Fix possible race when freeing object in fast bin list.

(cherry picked from commit 6cbbaa50aac809ad6e0692247876c82d58e466bf)

diff --git a/ChangeLog b/ChangeLog
index 44c96e0ee8e45e71cc1d4a5d0aae50bbe335074a..fba7a5bbfdc7c19351de207adbcb88d6262b4086 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2009-07-02  Ulrich Drepper  <drepper@redhat.com>
+
+       * malloc/malloc.c [ATOMIC_FASTBINS] (_int_free): Add full barrier when
+       adding to fast bin list.
+
 2009-07-01  Ulrich Drepper  <drepper@redhat.com>
 
        * nis/nss_nis/nis-network.c (_nss_nis_getnetbyaddr_r): Don't use

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 0b9facefd4e326a46ac4d013094f05db8decc5d0..703dcb56e76692eea156d07fbbb4ffafeb5859d3 100644 (file)
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4802,6 +4802,7 @@ _int_free(mstate av, mchunkptr p)
            goto errout;
          }
        p->fd = fd = old;
+       atomic_full_barrier ();
       }
     while ((old = catomic_compare_and_exchange_val_acq (fb, p, fd)) != fd);
 #else