When one calls aio_write, it internally calls __aio_enqueue_request, which will in turn call aio_create_helper_thread. If thread creation fails, the newly created request (newp in the code) will still be in the requests linked list, but it will be freed later in __aio_enqueue_request.
A subsequent call to aio_write will cause a segmentation fault.
Version-Release number of selected component (if applicable):
glibc-2.5-*.el5
How reproducible:
100%
Steps to Reproduce:
There's a test case from Neil Vachharajani in upstream bugzilla: