From: Howard Chu <hyc@openldap.org>
Date: Wed, 15 Oct 2025 17:12:26 +0000 (+0100)
Subject: ITS#9564 lmdb: fix race condition freeing spilled pages at end of transaction
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b807ef1345becebf5eca41ac9426742595f8d2d5;p=thirdparty%2Fopenldap.git

ITS#9564 lmdb: fix race condition freeing spilled pages at end of transaction
---

diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index 73892c16ea..a6b5375c00 100644
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -3078,6 +3078,7 @@ mdb_txn_end(MDB_txn *txn, unsigned mode)
 
 		txn->mt_numdbs = 0;
 		txn->mt_flags = MDB_TXN_FINISHED;
+		mdb_midl_free(txn->mt_spill_pgs);
 
 		if (!txn->mt_parent) {
 			mdb_midl_shrink(&txn->mt_free_pgs);
@@ -3099,7 +3100,6 @@ mdb_txn_end(MDB_txn *txn, unsigned mode)
 			mdb_midl_free(txn->mt_free_pgs);
 			free(txn->mt_u.dirty_list);
 		}
-		mdb_midl_free(txn->mt_spill_pgs);
 
 		mdb_midl_free(pghead);
 	}