From: William A. Rowe Jr <wrowe@apache.org>
Date: Thu, 30 Jun 2016 17:47:48 +0000 (+0000)
Subject: mod_mem_cache: Fix concurrent removal of stale entries which could lead
X-Git-Tag: 2.2.32~116
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f0cf2d10b8c58f9bb38ea9d5b90d416375ce8d61;p=thirdparty%2Fapache%2Fhttpd.git

mod_mem_cache: Fix concurrent removal of stale entries which could lead
to a crash.

PR: 43724
Submitted by: ylavic
Reviewed by: covener, wrowe


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1750846 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index 23d4cee690e..3e35e84584a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -12,6 +12,9 @@ Changes with Apache 2.2.32
      to avoid reusing it should the close be effective after some new request
      is ready to be sent.  [Yann Ylavic]
 
+  *) mod_mem_cache: Fix concurrent removal of stale entries which could lead
+     to a crash.  PR 43724.  [Yann Ylavic]
+
   *) mime.types: add common extension "m4a" for MPEG 4 Audio.
      PR 57895 [Dylan Millikin <dylan.millikin gmail.com>]
 
diff --git a/STATUS b/STATUS
index cfa31e4d923..4a58f53836a 100644
--- a/STATUS
+++ b/STATUS
@@ -103,11 +103,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-  *) mod_mem_cache: Fix concurrent removal of stale entries which could lead
-                    to a crash. PR 43724.
-     trunk patch: not applicable (2.2.x only)
-     2.2.x patch: http://home.apache.org/~ylavic/patches/httpd-2.2.x-mod_mem_cache-pr43724.patch
-     +1: ylavic, covener, wrowe
 
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
diff --git a/modules/cache/mod_mem_cache.c b/modules/cache/mod_mem_cache.c
index b845b98330a..c2a091c4953 100644
--- a/modules/cache/mod_mem_cache.c
+++ b/modules/cache/mod_mem_cache.c
@@ -537,7 +537,7 @@ static int remove_url(cache_handle_t *h, apr_pool_t *p)
     }
 
     obj = h->cache_obj;
-    if (obj) {
+    if (obj && cache_find(sconf->cache_cache, obj->key) == obj) {
         cache_remove(sconf->cache_cache, obj);
         /* For performance, cleanup cache object after releasing the lock */
         cleanup = !apr_atomic_dec32(&obj->refcount);