https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #35 from Howard Chu <hyc(a)openldap.org> ---
(In reply to mdufour from comment #34)
> Thanks to the test application, I was able to identify a key missing step in
> my description: process2 creates a named database (under a different name)
> after dropping the initial one. I can reproduce the crash by inserting the
> following lines @ 104:
>
> E(mdb_txn_begin(env, NULL, 0, &txn));
> E(mdb_dbi_open(txn, "id2", MDB_CREATE, &dbi));
> E(mdb_txn_commit(txn));
OK, that reproduces it. This patch should fix it, please test, thanks:
diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index 13d1aea39e..f0a65d97ab 100644
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -6670,7 +6670,7 @@ mdb_page_search(MDB_cursor *mc, MDB_val *key, int flags)
MDB_node *leaf = mdb_node_search(&mc2,
&mc->mc_dbx->md_name, &exact);
if (!exact)
- return MDB_NOTFOUND;
+ return MDB_BAD_DBI;
if ((leaf->mn_flags &
(F_DUPDATA|F_SUBDATA)) != F_SUBDATA)
return MDB_INCOMPATIBLE; /* not
a named DB */
rc = mdb_node_read(&mc2, leaf, &data);
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #34 from mdufour(a)audiokinetic.com ---
Thanks to the test application, I was able to identify a key missing step in my
description: process2 creates a named database (under a different name) after
dropping the initial one. I can reproduce the crash by inserting the following
lines @ 104:
E(mdb_txn_begin(env, NULL, 0, &txn));
E(mdb_dbi_open(txn, "id2", MDB_CREATE, &dbi));
E(mdb_txn_commit(txn));
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #33 from Howard Chu <hyc(a)openldap.org> ---
(In reply to mdufour from comment #31)
> I am able to reproduce the crash in a scenario with two processes accessing
> the same LMDB file, where:
>
> - process1 opens a named database.
> - process2 drops this named database.
> - process1 writes to the initial named database (using the dbi it was
> holding on to) -> this is where we crash.
>
> It seems that mdb_page_search returns MDB_NOTFOUND because the named
> database is gone, leaving mc->mc_pg[0] NULL.
Thanks for that info. Unfortunately I still can't reproduce that crash.
I've attached the test code I wrote based on your info.
It forks off a child to do the process2 actions. You must press RETURN when
you're ready for process 1 to proceed. I just get more MDB_NOTFOUND results
when process1 tries to write again.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9193
Bug ID: 9193
Summary: HTML in mailing list description
Product: website
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: website
Assignee: bugs(a)openldap.org
Reporter: ryan(a)openldap.org
Target Milestone: ---
e.g. https://lists.openldap.org/postorius/lists/openldap-devel.openldap.org/
contains code for links and formatting, but all inside of a <pre> block.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #31 from mdufour(a)audiokinetic.com ---
I am able to reproduce the crash in a scenario with two processes accessing the
same LMDB file, where:
- process1 opens a named database.
- process2 drops this named database.
- process1 writes to the initial named database (using the dbi it was holding
on to) -> this is where we crash.
It seems that mdb_page_search returns MDB_NOTFOUND because the named database
is gone, leaving mc->mc_pg[0] NULL.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #30 from mdufour(a)audiokinetic.com ---
We're on revision ce200dca of the main openldap repo from Aug 27, 2023.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #29 from Howard Chu <hyc(a)openldap.org> ---
(In reply to mdufour from comment #28)
> Apologies, in the last message, the provide line of code is indeed 7998, the
> crash location (and not 8183 as written). It is slightly different from the
> official mdb.c due to some unrelated local changes earlier in the file.
You didn't specify which version of LMDB you're using.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #28 from mdufour(a)audiokinetic.com ---
Apologies, in the last message, the provide line of code is indeed 7998, the
crash location (and not 8183 as written). It is slightly different from the
official mdb.c due to some unrelated local changes earlier in the file.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #27 from mdufour(a)audiokinetic.com ---
We are also seeing rare instances of this crash since we released a version of
our product which uses LMDB. Specifically, call stack is:
mdb_cursor_put(MDB_cursor * mc, MDB_val * key, MDB_val * data, unsigned int
flags) Line 7998
mdb_put(MDB_txn * txn, unsigned int dbi, MDB_val * key, MDB_val * data,
unsigned int flags) Line 10107
where line 8183 is
nsize = IS_LEAF2(mc->mc_pg[mc->mc_top]) ? key->mv_size : mdb_leaf_size(env,
key, rdata);
and
mc->mc_top == 0
mc->mc_pg[0] == NULL
rc == -30798
Although we do not have a reproduction case, we do have a full crash dump with
heap of an unoptimized debug build of our application. There is no evidence of
stack corruption (in fact, mc->mc_pg[1] is still 0xcccccccccccccccc as per the
msvc run-time check initialization).
Unfortunately we do not have the matching LMDB file.
Anything we can provide to help narrow down the issue?
--
You are receiving this mail because:
You are on the CC list for the issue.