Segfault hidden in list.h

[Rose, Billy]

The code inside of __list_add:

next->prev = new;
new->next = next;
new->prev = prev;
pre-next = new;

needs to be altered to:

new->prev = prev;
new->next = next;
next->prev = new;
prev->next = new;

If something is accessing the list in reverse at the time of insertion and
"next->prev = new;" has been executed, there exists a moment when new->prev
may contain garbage if the element had been used in another list and is
being transposed into a new one. Even if garbage is not present, and the
element had just been initialized (i.e. new->prev = new), a false list head
will appear briefly (from the executing thread's point of view).

Billy Rose 
[e-mail]