about summary refs log tree commit diff
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@redhat.com>2009-07-02 03:30:55 -0700
committerPetr Baudis <pasky@suse.cz>2009-07-16 17:44:48 +0200
commit51da0dcf515bd63d44dd4c479147810b4f30a7f5 (patch)
tree5938d77903752465da2a241d02fc3fe822288ab2
parent870a58b0b6a05589a56ea3dc7ee7b59ed64dee50 (diff)
downloadglibc-51da0dcf515bd63d44dd4c479147810b4f30a7f5.tar.gz
glibc-51da0dcf515bd63d44dd4c479147810b4f30a7f5.tar.xz
glibc-51da0dcf515bd63d44dd4c479147810b4f30a7f5.zip
Fix possible race when freeing object in fast bin list.
(cherry picked from commit 6cbbaa50aac809ad6e0692247876c82d58e466bf)
-rw-r--r--ChangeLog5
-rw-r--r--malloc/malloc.c1
2 files changed, 6 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog
index 44c96e0ee8..fba7a5bbfd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2009-07-02  Ulrich Drepper  <drepper@redhat.com>
+
+	* malloc/malloc.c [ATOMIC_FASTBINS] (_int_free): Add full barrier when
+	adding to fast bin list.
+
 2009-07-01  Ulrich Drepper  <drepper@redhat.com>
 
 	* nis/nss_nis/nis-network.c (_nss_nis_getnetbyaddr_r): Don't use
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 0b9facefd4..703dcb56e7 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4802,6 +4802,7 @@ _int_free(mstate av, mchunkptr p)
 	    goto errout;
 	  }
 	p->fd = fd = old;
+	atomic_full_barrier ();
       }
     while ((old = catomic_compare_and_exchange_val_acq (fb, p, fd)) != fd);
 #else