https://bugs.openldap.org/show_bug.cgi?id=9378
Issue ID: 9378
Summary: Crash in mdb_put() / mdb_page_dirty()
Product: LMDB
Version: 0.9.26
Hardware: All
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: liblmdb
Assignee: bugs(a)openldap.org
Reporter: nate(a)kde.org
Target Milestone: ---
The KDE Baloo file indexer uses lmdb as its database (source code available at
https://invent.kde.org/frameworks/baloo). Our most common crash, with over 100
duplicate bug reports, is in lmdb. Here's the bug report tracking it:
https://bugs.kde.org/show_bug.cgi?id=389848.
The version of lmdb does not seem to matter much. We have bug reports from Arch
users with lmdb 0.9.26 as well as bug reports from people using many earlier
versions.
Here's an example backtrace, taken from
https://bugs.kde.org/show_bug.cgi?id=426195:
#6 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#7 0x00007f3c0bbb9859 in __GI_abort () at abort.c:79
#8 0x00007f3c0b23ba83 in mdb_assert_fail (env=0x55e2ad710600,
expr_txt=expr_txt@entry=0x7f3c0b23e02f "rc == 0",
func=func@entry=0x7f3c0b23e978 <__func__.7221> "mdb_page_dirty",
line=line@entry=2127, file=0x7f3c0b23e010 "mdb.c") at mdb.c:1542
#9 0x00007f3c0b2306d5 in mdb_page_dirty (mp=<optimized out>,
txn=0x55e2ad7109f0) at mdb.c:2114
#10 mdb_page_dirty (txn=0x55e2ad7109f0, mp=<optimized out>) at mdb.c:2114
#11 0x00007f3c0b231966 in mdb_page_alloc (num=num@entry=1,
mp=mp@entry=0x7f3c0727aee8, mc=<optimized out>) at mdb.c:2308
#12 0x00007f3c0b231ba3 in mdb_page_touch (mc=mc@entry=0x7f3c0727b420) at
mdb.c:2495
#13 0x00007f3c0b2337c7 in mdb_cursor_touch (mc=mc@entry=0x7f3c0727b420) at
mdb.c:6523
#14 0x00007f3c0b2368f9 in mdb_cursor_put (mc=mc@entry=0x7f3c0727b420,
key=key@entry=0x7f3c0727b810, data=data@entry=0x7f3c0727b820,
flags=flags@entry=0) at mdb.c:6657
#15 0x00007f3c0b23976b in mdb_put (txn=0x55e2ad7109f0, dbi=5,
key=key@entry=0x7f3c0727b810, data=data@entry=0x7f3c0727b820,
flags=flags@entry=0) at mdb.c:9022
#16 0x00007f3c0c7124c5 in Baloo::DocumentDB::put
(this=this@entry=0x7f3c0727b960, docId=<optimized out>,
docId@entry=27041423333263366, list=...) at ./src/engine/documentdb.cpp:79
#17 0x00007f3c0c743da7 in Baloo::WriteTransaction::replaceDocument
(this=0x55e2ad7ea340, doc=..., operations=operations@entry=...) at
./src/engine/writetransaction.cpp:232
#18 0x00007f3c0c736b16 in Baloo::Transaction::replaceDocument
(this=this@entry=0x7f3c0727bc10, doc=..., operations=operations@entry=...) at
./src/engine/transaction.cpp:295
#19 0x000055e2ac5d6cbc in Baloo::UnindexedFileIndexer::run
(this=0x55e2ad79ca20) at
/usr/include/x86_64-linux-gnu/qt5/QtCore/qrefcount.h:60
#20 0x00007f3c0c177f82 in QThreadPoolThread::run (this=0x55e2ad717f20) at
thread/qthreadpool.cpp:99
#21 0x00007f3c0c1749d2 in QThreadPrivate::start (arg=0x55e2ad717f20) at
thread/qthread_unix.cpp:361
#22 0x00007f3c0b29d609 in start_thread (arg=<optimized out>) at
pthread_create.c:477
#23 0x00007f3c0bcb6103 in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:95
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9037
Howard Chu <hyc(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |TEST
--- Comment #37 from Howard Chu <hyc(a)openldap.org> ---
Fixed in git
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #36 from mdufour(a)audiokinetic.com ---
This patch does fix the crash in my application repro case as well. We'll
integrate it in our next minor release. Thanks much!
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #35 from Howard Chu <hyc(a)openldap.org> ---
(In reply to mdufour from comment #34)
> Thanks to the test application, I was able to identify a key missing step in
> my description: process2 creates a named database (under a different name)
> after dropping the initial one. I can reproduce the crash by inserting the
> following lines @ 104:
>
> E(mdb_txn_begin(env, NULL, 0, &txn));
> E(mdb_dbi_open(txn, "id2", MDB_CREATE, &dbi));
> E(mdb_txn_commit(txn));
OK, that reproduces it. This patch should fix it, please test, thanks:
diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index 13d1aea39e..f0a65d97ab 100644
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -6670,7 +6670,7 @@ mdb_page_search(MDB_cursor *mc, MDB_val *key, int flags)
MDB_node *leaf = mdb_node_search(&mc2,
&mc->mc_dbx->md_name, &exact);
if (!exact)
- return MDB_NOTFOUND;
+ return MDB_BAD_DBI;
if ((leaf->mn_flags &
(F_DUPDATA|F_SUBDATA)) != F_SUBDATA)
return MDB_INCOMPATIBLE; /* not
a named DB */
rc = mdb_node_read(&mc2, leaf, &data);
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #34 from mdufour(a)audiokinetic.com ---
Thanks to the test application, I was able to identify a key missing step in my
description: process2 creates a named database (under a different name) after
dropping the initial one. I can reproduce the crash by inserting the following
lines @ 104:
E(mdb_txn_begin(env, NULL, 0, &txn));
E(mdb_dbi_open(txn, "id2", MDB_CREATE, &dbi));
E(mdb_txn_commit(txn));
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #33 from Howard Chu <hyc(a)openldap.org> ---
(In reply to mdufour from comment #31)
> I am able to reproduce the crash in a scenario with two processes accessing
> the same LMDB file, where:
>
> - process1 opens a named database.
> - process2 drops this named database.
> - process1 writes to the initial named database (using the dbi it was
> holding on to) -> this is where we crash.
>
> It seems that mdb_page_search returns MDB_NOTFOUND because the named
> database is gone, leaving mc->mc_pg[0] NULL.
Thanks for that info. Unfortunately I still can't reproduce that crash.
I've attached the test code I wrote based on your info.
It forks off a child to do the process2 actions. You must press RETURN when
you're ready for process 1 to proceed. I just get more MDB_NOTFOUND results
when process1 tries to write again.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9193
Bug ID: 9193
Summary: HTML in mailing list description
Product: website
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: website
Assignee: bugs(a)openldap.org
Reporter: ryan(a)openldap.org
Target Milestone: ---
e.g. https://lists.openldap.org/postorius/lists/openldap-devel.openldap.org/
contains code for links and formatting, but all inside of a <pre> block.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #31 from mdufour(a)audiokinetic.com ---
I am able to reproduce the crash in a scenario with two processes accessing the
same LMDB file, where:
- process1 opens a named database.
- process2 drops this named database.
- process1 writes to the initial named database (using the dbi it was holding
on to) -> this is where we crash.
It seems that mdb_page_search returns MDB_NOTFOUND because the named database
is gone, leaving mc->mc_pg[0] NULL.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9037
--- Comment #30 from mdufour(a)audiokinetic.com ---
We're on revision ce200dca of the main openldap repo from Aug 27, 2023.
--
You are receiving this mail because:
You are on the CC list for the issue.