From: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Date: Sat, 28 Feb 2026 17:55:04 +0000 (+0300)
Subject: QReadWriteLock: fix data race on the d_ptr members
X-Git-Tag: archive/raspbian/5.15.15+dfsg-6+rpi1+deb13u1^2~15
X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com//%22mailto:bartha.m.judit%40gmail.com/%22/%22http:/www.example.com/%22mailto:bartha.m.judit%40gmail.com/%22?a=commitdiff_plain;h=f2ed214e307244e5a345e4b60b9236edc160a9af;p=qtbase-opensource-src.git

QReadWriteLock: fix data race on the d_ptr members

Origin: upstream, https://code.qt.io/cgit/qt/qtbase.git/commit?id=80d01c4ccb697b9d
Last-Update: 2025-12-14

The loadRelaxed() at the beginning of tryLockForRead/tryLockForWrite
isn't enough to bring us the non-atomic write of the recursive bool.
Same issue with the std::mutex itself.

Gbp-Pq: Name qreadwritelock_data_race.diff
---

diff --git a/src/corelib/thread/qreadwritelock.cpp b/src/corelib/thread/qreadwritelock.cpp
index 9dd850311..84d73444b 100644
--- a/src/corelib/thread/qreadwritelock.cpp
+++ b/src/corelib/thread/qreadwritelock.cpp
@@ -258,7 +258,10 @@ bool QReadWriteLock::tryLockForRead(int timeout)
             d = val;
         }
         Q_ASSERT(!isUncontendedLocked(d));
-        // d is an actual pointer;
+        // d is an actual pointer; acquire its contents
+        d = d_ptr.loadAcquire();
+        if (!d || isUncontendedLocked(d))
+            continue;
 
         if (d->recursive)
             return d->recursiveLockForRead(timeout);
@@ -365,7 +368,10 @@ bool QReadWriteLock::tryLockForWrite(int timeout)
             d = val;
         }
         Q_ASSERT(!isUncontendedLocked(d));
-        // d is an actual pointer;
+        // d is an actual pointer; acquire its contents
+        d = d_ptr.loadAcquire();
+        if (!d || isUncontendedLocked(d))
+            continue;
 
         if (d->recursive)
             return d->recursiveLockForWrite(timeout);