Upstream tarball 2.2.9upstream/2.2.9

1 files changed, 8 insertions, 2 deletions

diff --git a/server/mpm/experimental/event/fdqueue.c b/server/mpm/experimental/event/fdqueue.c
index c0ef9bbb..5a1baa94 100644
--- a/server/mpm/experimental/event/fdqueue.c
+++ b/server/mpm/experimental/event/fdqueue.c
@@ -194,10 +194,16 @@ void ap_push_pool(fd_queue_info_t * queue_info,
                                                           (*new_recycle));
         new_recycle->pool = pool_to_recycle;
         for (;;) {
-            new_recycle->next = queue_info->recycled_pools;
+            /*
+             * Save queue_info->recycled_pool in local variable next because
+             * new_recycle->next can be changed after apr_atomic_casptr
+             * function call. For gory details see PR 44402.
+             */
+            struct recycled_pool *next = queue_info->recycled_pools;
+            new_recycle->next = next;
             if (apr_atomic_casptr
                 ((volatile void **) &(queue_info->recycled_pools),
-                 new_recycle, new_recycle->next) == new_recycle->next) {
+                 new_recycle, next) == next) {
                 break;
             }
         }