ITS#9564 lmdb: fix race condition freeing spilled pages at end of transaction

Move the freeing of the spilled pages list inside the protection of the
transaction mutex so there is no race condition with another transaction

diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index 887ad3ecfe03a347031b5b6d7835d47135af56ca..c37d48ea0b07e9e3ebe01b63ed30be5e9e14f4bc 100644 (file)
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -3652,6 +3652,10 @@ mdb_txn_end(MDB_txn *txn, unsigned mode)
                txn->mt_numdbs = 0;
                txn->mt_flags = MDB_TXN_FINISHED;
 
+               mdb_midl_free(txn->mt_spill_pgs);
+#if OVERFLOW_NOTYET
+               mdb_mid2l_free(txn->mt_dirty_ovs);
+#endif
                if (!txn->mt_parent) {
                        mdb_midl_shrink(&txn->mt_free_pgs);
                        env->me_free_pgs = txn->mt_free_pgs;
@@ -3672,10 +3676,6 @@ mdb_txn_end(MDB_txn *txn, unsigned mode)
                        mdb_midl_free(txn->mt_free_pgs);
                        free(txn->mt_u.dirty_list);
                }
-               mdb_midl_free(txn->mt_spill_pgs);
-#if OVERFLOW_NOTYET
-               mdb_mid2l_free(txn->mt_dirty_ovs);
-#endif
 
                mdb_midl_free(pghead);
        }