Worker MPM: fix race condition

PR44402: reported and fixed by Basant Kumar Kukreja

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@630335 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 0de1d87cc8daaa788f075e3eb1e2188596099356..c7fc3ab5879444405c3797711c9b22d28ecc97aa 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,9 @@
 Changes with Apache 2.3.0
 [ When backported to 2.2.x, remove entry from this file ]
 
+  *) Worker MPM: fix race condition in recycling a pool
+     PR 44402 [Basant Kumar Kukreja <basant.kukreja sun.com>]
+
   *) mod_include: Correctly handle SSI directives split over multiple filter
      passes.  PR 44447 [Harald Niesche <harald brokenerror.de>]
 

diff --git a/server/mpm/worker/fdqueue.c b/server/mpm/worker/fdqueue.c
index 8be7c9fa2da5ad63e16f14508e708ac175e443bf..b88b8dacd83c716e8c84866fe2df1c330ff25e50 100644 (file)
--- a/server/mpm/worker/fdqueue.c
+++ b/server/mpm/worker/fdqueue.c
@@ -94,10 +94,14 @@ apr_status_t ap_queue_info_set_idle(fd_queue_info_t *queue_info,
                                                          sizeof(*new_recycle));
         new_recycle->pool = pool_to_recycle;
         for (;;) {
-            new_recycle->next = queue_info->recycled_pools;
+            /* Save queue_info->recycled_pool in local variable next because
+             * new_recycle->next can be changed after apr_atomic_casptr
+             * function call.
+             */
+            struct recycled_pool *next = queue_info->recycled_pools;
+            new_recycle->next = next;
             if (apr_atomic_casptr((volatile void**)&(queue_info->recycled_pools),
-                                  new_recycle, new_recycle->next) ==
-                new_recycle->next) {
+                                  new_recycle, new_recycle->next) == next) {
                 break;
             }
         }