2010-05-06  Ulrich Drepper  <drepper@redhat.com>

	* malloc/malloc.c (_int_free): Possible race in the most recently
	added check.  Only act on the data if no current modification
	happened.

Index: glibc-2.12-2-gc4ccff1/malloc/malloc.c
===================================================================
--- glibc-2.12-2-gc4ccff1.orig/malloc/malloc.c
+++ glibc-2.12-2-gc4ccff1/malloc/malloc.c
@@ -4859,6 +4859,7 @@ _int_free(mstate av, mchunkptr p)
 #ifdef ATOMIC_FASTBINS
     mchunkptr fd;
     mchunkptr old = *fb;
+    unsigned int old_idx = ~0u;
     do
       {
 	/* Another simple check: make sure the top of the bin is not the
@@ -4868,15 +4869,17 @@ _int_free(mstate av, mchunkptr p)
 	    errstr = "double free or corruption (fasttop)";
 	    goto errout;
 	  }
-	if (old != NULL
-	    && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0))
-	  {
-	    errstr = "invalid fastbin entry (free)";
-	    goto errout;
-	  }
+	if (old != NULL)
+	  old_idx = fastbin_index(chunksize(old));
 	p->fd = fd = old;
       }
     while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd);
+
+    if (fd != NULL && __builtin_expect (old_idx != idx, 0))
+      {
+	errstr = "invalid fastbin entry (free)";
+	goto errout;
+      }
 #else
     /* Another simple check: make sure the top of the bin is not the
        record we are going to add (i.e., double free).  */