In pool_free_old(), one code path was not clearing a "next" pointer,

so the code could try to free an extent twice in certain circumstances.

diff --git a/lib/pool_alloc.c b/lib/pool_alloc.c
index e1ce50b37bb687ae1f195c757a28aec40fa43afb..0fb31225bf02e86b2309f3b4ca63f432c89bcdb2 100644 (file)
--- a/lib/pool_alloc.c
+++ b/lib/pool_alloc.c
@@ -255,6 +255,7 @@ pool_free_old(alloc_pool_t p, void *addr)
                                cur->free -= skew;
                        }
                        next = cur->next;
+                       cur->next = NULL;
                }
        } else {
                next = cur->next;