tdb2: coalescing race fix #1

[ccan] / ccan / tdb2 / free.c

diff --git a/ccan/tdb2/free.c b/ccan/tdb2/free.c
index 2b07fdff330a3dfe23631dd6e98a3effb399e428..c19b14a84e20a4228d954b495ea88e7cc94ae15a 100644 (file)
--- a/ccan/tdb2/free.c
+++ b/ccan/tdb2/free.c
@@ -319,6 +319,13 @@ static int coalesce(struct tdb_context *tdb,
                        break;
                }
 
+               if (unlikely(bucket_off(zone_off,
+                                       size_to_bucket(zone_bits, r->data_len))
+                            != nb_off)) {
+                       tdb_unlock_free_bucket(tdb, nb_off);
+                       break;
+               }
+
                if (remove_from_list(tdb, nb_off, end, r) == -1) {
                        tdb_unlock_free_bucket(tdb, nb_off);
                        goto err;
@@ -516,7 +523,7 @@ static tdb_off_t get_free(struct tdb_context *tdb, size_t size,
 int set_header(struct tdb_context *tdb,
               struct tdb_used_record *rec,
               uint64_t keylen, uint64_t datalen,
-              uint64_t actuallen, uint64_t hash,
+              uint64_t actuallen, unsigned hashlow,
               unsigned int zone_bits)
 {
        uint64_t keybits = (fls64(keylen) + 1) / 2;
@@ -524,7 +531,7 @@ int set_header(struct tdb_context *tdb,
        /* Use bottom bits of hash, so it's independent of hash table size. */
        rec->magic_and_meta
                = zone_bits
-               | ((hash & ((1 << 5)-1)) << 6)
+               | ((hashlow & ((1 << 5)-1)) << 6)
                | ((actuallen - (keylen + datalen)) << 11)
                | (keybits << 43)
                | (TDB_MAGIC << 48);