2716093
Index: glibc-2.12-2-gc4ccff1/malloc/arena.c
2716093
===================================================================
2716093
--- glibc-2.12-2-gc4ccff1.orig/malloc/arena.c
2716093
+++ glibc-2.12-2-gc4ccff1/malloc/arena.c
2716093
@@ -870,7 +870,7 @@ heap_trim(heap, pad) heap_info *heap; si
2716093
     heap = prev_heap;
2716093
     if(!prev_inuse(p)) { /* consolidate backward */
2716093
       p = prev_chunk(p);
2716093
-      unlink(p, bck, fwd);
2716093
+      unlink(ar_ptr, p, bck, fwd);
2716093
     }
2716093
     assert(((unsigned long)((char*)p + new_size) & (pagesz-1)) == 0);
2716093
     assert( ((char*)p + new_size) == ((char*)heap + heap->size) );
2716093
Index: glibc-2.12-2-gc4ccff1/malloc/hooks.c
2716093
===================================================================
2716093
--- glibc-2.12-2-gc4ccff1.orig/malloc/hooks.c
2716093
+++ glibc-2.12-2-gc4ccff1/malloc/hooks.c
2716093
@@ -219,7 +219,9 @@ top_check()
2716093
 	(char*)t + chunksize(t) == mp_.sbrk_base + main_arena.system_mem)))
2716093
     return 0;
2716093
 
2716093
+  mutex_unlock(&main_arena);
2716093
   malloc_printerr (check_action, "malloc: top chunk is corrupt", t);
2716093
+  mutex_lock(&main_arena);
2716093
 
2716093
   /* Try to set up a new top chunk. */
2716093
   brk = MORECORE(0);
2716093
Index: glibc-2.12-2-gc4ccff1/malloc/malloc.c
2716093
===================================================================
2716093
--- glibc-2.12-2-gc4ccff1.orig/malloc/malloc.c
2716093
+++ glibc-2.12-2-gc4ccff1/malloc/malloc.c
2716093
@@ -1541,12 +1541,14 @@
2716093
 #define last(b)      ((b)->bk)
2716093
 
2716093
 /* Take a chunk off a bin list */
2716093
-#define unlink(P, BK, FD) {                                            \
2716093
+#define unlink(AV, P, BK, FD) {					       \
2716093
   FD = P->fd;                                                          \
2716093
   BK = P->bk;                                                          \
2716093
-  if (__builtin_expect (FD->bk != P || BK->fd != P, 0))                \
2716093
+  if (__builtin_expect (FD->bk != P || BK->fd != P, 0)) {	       \
2716093
+    mutex_unlock(&(AV)->mutex);					       \
2716093
     malloc_printerr (check_action, "corrupted double-linked list", P); \
2716093
-  else {                                                               \
2716093
+    mutex_lock(&(AV)->mutex);					       \
2716093
+  } else {							       \
2716093
     FD->bk = BK;                                                       \
2716093
     BK->fd = FD;                                                       \
2716093
     if (!in_smallbin_range (P->size)				       \
2716093
@@ -2593,7 +2595,9 @@
2716093
 
2716093
     else if (contiguous(av) && old_size && brk < old_end) {
2716093
       /* Oops!  Someone else killed our space..  Can't touch anything.  */
2716093
+      mutex_unlock(&av->mutex);
2716093
       malloc_printerr (3, "break adjusted to free malloc space", brk);
2716093
+      mutex_lock(&av->mutex);
2716093
     }
2716093
 
2716093
     /*
2716093
@@ -3467,7 +3471,9 @@
2716093
 	{
2716093
 	  errstr = "malloc(): memory corruption (fast)";
2716093
 	errout:
2716093
+	  mutex_unlock(&av->mutex);
2716093
 	  malloc_printerr (check_action, errstr, chunk2mem (victim));
2716093
+	  mutex_lock(&av->mutex);
2716093
 	  return NULL;
2716093
 	}
2716093
       check_remalloced_chunk(av, victim, nb);
2716093
@@ -3552,8 +3558,12 @@
2716093
       bck = victim->bk;
2716093
       if (__builtin_expect (victim->size <= 2 * SIZE_SZ, 0)
2716093
 	  || __builtin_expect (victim->size > av->system_mem, 0))
2716093
-	malloc_printerr (check_action, "malloc(): memory corruption",
2716093
-			 chunk2mem (victim));
2716093
+	{
2716093
+	  void *p = chunk2mem(victim);
2716093
+	  mutex_unlock(&av->mutex);
2716093
+	  malloc_printerr (check_action, "malloc(): memory corruption", p);
2716093
+	  mutex_lock(&av->mutex);
2716093
+	}
2716093
       size = chunksize(victim);
2716093
 
2716093
       /*
2716093
@@ -3694,7 +3704,7 @@
2716093
 	  victim = victim->fd;
2716093
 
2716093
 	remainder_size = size - nb;
2716093
-	unlink(victim, bck, fwd);
2716093
+	unlink(av, victim, bck, fwd);
2716093
 
2716093
 	/* Exhaust */
2716093
 	if (remainder_size < MINSIZE)  {
2716093
@@ -3792,7 +3802,7 @@
2716093
 	remainder_size = size - nb;
2716093
 
2716093
 	/* unlink */
2716093
-	unlink(victim, bck, fwd);
2716093
+	unlink(av, victim, bck, fwd);
2716093
 
2716093
 	/* Exhaust */
2716093
 	if (remainder_size < MINSIZE) {
2716093
@@ -3927,9 +3937,11 @@
2716093
     {
2716093
       errstr = "free(): invalid pointer";
2716093
     errout:
2716093
-      if (! have_lock && locked)
2716093
+      if (have_lock || locked)
2716093
 	(void)mutex_unlock(&av->mutex);
2716093
       malloc_printerr (check_action, errstr, chunk2mem(p));
2716093
+      if (have_lock)
2716093
+	mutex_lock(&av->mutex);
2716093
       return;
2716093
     }
2716093
   /* We know that each chunk is at least MINSIZE bytes in size.  */
2716093
@@ -4073,7 +4085,7 @@
2716093
       prevsize = p->prev_size;
2716093
       size += prevsize;
2716093
       p = chunk_at_offset(p, -((long) prevsize));
2716093
-      unlink(p, bck, fwd);
2716093
+      unlink(av, p, bck, fwd);
2716093
     }
2716093
 
2716093
     if (nextchunk != av->top) {
2716093
@@ -4082,7 +4094,7 @@
2716093
 
2716093
       /* consolidate forward */
2716093
       if (!nextinuse) {
2716093
-	unlink(nextchunk, bck, fwd);
2716093
+	unlink(av, nextchunk, bck, fwd);
2716093
 	size += nextsize;
2716093
       } else
2716093
 	clear_inuse_bit_at_offset(nextchunk, 0);
2716093
@@ -4243,7 +4255,7 @@
2716093
 	    prevsize = p->prev_size;
2716093
 	    size += prevsize;
2716093
 	    p = chunk_at_offset(p, -((long) prevsize));
2716093
-	    unlink(p, bck, fwd);
2716093
+	    unlink(av, p, bck, fwd);
2716093
 	  }
2716093
 
2716093
 	  if (nextchunk != av->top) {
2716093
@@ -4251,7 +4263,7 @@
2716093
 
2716093
 	    if (!nextinuse) {
2716093
 	      size += nextsize;
2716093
-	      unlink(nextchunk, bck, fwd);
2716093
+	      unlink(av, nextchunk, bck, fwd);
2716093
 	    } else
2716093
 	      clear_inuse_bit_at_offset(nextchunk, 0);
2716093
 
2716093
@@ -4320,7 +4332,9 @@
2716093
     {
2716093
       errstr = "realloc(): invalid old size";
2716093
     errout:
2716093
+      mutex_unlock(&av->mutex);
2716093
       malloc_printerr (check_action, errstr, chunk2mem(oldp));
2716093
+      mutex_lock(&av->mutex);
2716093
       return NULL;
2716093
     }
2716093
 
2716093
@@ -4362,7 +4376,7 @@
2716093
 	     (unsigned long)(newsize = oldsize + nextsize) >=
2716093
 	     (unsigned long)(nb)) {
2716093
       newp = oldp;
2716093
-      unlink(next, bck, fwd);
2716093
+      unlink(av, next, bck, fwd);
2716093
     }
2716093
 
2716093
     /* allocate, copy, free */