openldap-bugs

openldap-bugs@openldap.org

1 participants
20965 discussions

Re: ITS#5391 [Fwd: [Berkeley DB Announce] Berkeley DB 4.6.21.1 - Patch Announcement]
by quanah＠zimbra.com 27 Mar '08

27 Mar '08

--On Thursday, March 27, 2008 10:44 PM +0000 bdb(a)oss.oracle.com wrote: > I know you're not using BDB 4.6 with OpenLDAP 2.3, so this patch isn't > strictly relevant to this ITS. It just raises the possibility that there > is a BDB bug involved. Looking at the code for 4.2.52, the mp_fopen.c code is essentially identical to what this patch fixes, so I'd guess it could affect 2.3 releases using bdb 4.2->4.5. And I'm guessing there'll be no patch from Oracle for those much older releases. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

ITS#5391 [Fwd: [Berkeley DB Announce] Berkeley DB 4.6.21.1 - Patch Announcement]
by bdb＠oss.oracle.com 27 Mar '08

27 Mar '08

I know you're not using BDB 4.6 with OpenLDAP 2.3, so this patch isn't strictly relevant to this ITS. It just raises the possibility that there is a BDB bug involved. -------- Original Message -------- Subject: [Berkeley DB Announce] Berkeley DB 4.6.21.1 - Patch Announcement Date: Thu, 27 Mar 2008 18:03:40 -0400 From: bdb(a)oss.oracle.com Reply-To: bdb(a)oss.oracle.com Organization: Oracle Corporation To: <bdb(a)oss.oracle.com> A patch for Berkeley DB release 4.6.21 that fixes a race condition between checkpoint and DB->close() which can result in the checkpoint thread self-deadlocking (SR [#15692]) is now available. We recommend all users of Berkeley DB apply this patch so as to avoid this issue in production. An web page with all patches (currently only one) for Berkeley DB 4.6.21. http://www.oracle.com/technology/products/berkeley-db/xml/update/4.6.21/patc h.4.6.21.html A text file with the patch: http://www.oracle.com/technology/products/berkeley-db/xml/update/4.6.21/patc h.4.6.21.1 regards, the Berkeley DB Team, -greg _____________________________________________________________________ Gregory Burd greg.burd(a)oracle.com Product Manager, Berkeley DB/JE/XML Oracle Corporation _______________________________________________ BDB mailing list BDB(a)oss.oracle.com http://oss.oracle.com/mailman/listinfo/bdb -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5440) back-meta opens too many connections in case of error
by ando＠sys-net.it 26 Mar '08

26 Mar '08

ali.pouya(a)free.fr wrote: > Full_Name: Ali Pouya > Version: 2.4.8 > OS: Linux 2.6 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (145.242.11.3) > > > Hi, > I'm testing the back-meta of OpenLdap 2.4.8 in order to upgrade to this > release. > My client opens a persistent LDAP connection to slapd, binds with an ordinary > account (from the local back-bdb) and begins search operations. > > I notice that if a search operation results in an LDAP error (for example error > 32 : No Such Object), then back-meta opens a new connection to the target > directory for the next operation, leaving the "bad" connection open. > > The conn-ttl and idle-timeout parameters do not close the "bad" connections. > These connections remain there until the client ends its connection. > > This saturates the target servers with unused idle connections. > > Is this a bug or a normal behaviour ? > > I precise that The behaviour is not the same if the client binds with rootdn. 1) Can you post your slapd.conf (sanitized)? 2) What is exactly causing the error? What error is actually being returned from all targets? For back-meta, no such object has some special semantics. Best would be if you can provide a setup that allows to reproduce the critical situation with a very simple test, involving as little targets as possible, along with the LDIF required to populate each target and the operation you used. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

(ITS#5440) back-meta opens too many connections in case of error
by ali.pouya＠free.fr 26 Mar '08

26 Mar '08

Full_Name: Ali Pouya Version: 2.4.8 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (145.242.11.3) Hi, I'm testing the back-meta of OpenLdap 2.4.8 in order to upgrade to this release. My client opens a persistent LDAP connection to slapd, binds with an ordinary account (from the local back-bdb) and begins search operations. I notice that if a search operation results in an LDAP error (for example error 32 : No Such Object), then back-meta opens a new connection to the target directory for the next operation, leaving the "bad" connection open. The conn-ttl and idle-timeout parameters do not close the "bad" connections. These connections remain there until the client ends its connection. This saturates the target servers with unused idle connections. Is this a bug or a normal behaviour ? I precise that The behaviour is not the same if the client binds with rootdn. Thanks for your help Best regards Ali

1 0

Re: (ITS#5439) back-bdb race condition
by hyc＠symas.com 25 Mar '08

25 Mar '08

Rein Tollevik wrote: > On Tue, 25 Mar 2008, hyc(a)symas.com wrote: > It now looks to me as if the entire rs->sr_entry was released an reused, > and that the bug probably is in back-bdb. It just always happened when > syncprov was running as this is a master server with mostly writes > except from the reads syncprov does. Which also means that the title on > the bug report is probably misleading :-( > > The reason for my shift of focus is some highly suspicious variables > found in the bdb_search() frame. Look at the value of idflag in bdb_search. (see the comment around 672) Could be a locking bug with ID_NOCACHE in cache.c... > First, ei->bei_e seem to be NULL every time this happen, not the same as > the "e" variable as I would except from looking at the code. Second, > e->e_id is either 0 or ei->bei_id+1, the content of *e is the (more or > less completely initialized) entry following the *ei entry in the > database, while I would expect that ei->bei_id==e->e_id and that > ei->bei_e==e. I don't think the consecutive ID numbers or entries has > anything with the bug to do though, they are probably a result of the > searches reading the entire database. > > I looks to me as if the EntryInfo referred to by ei was released somehow > when slap_send_search_entry() was running, and that the ei->bei_e passed > as rs->rs_entry was first released and then reused for the next entry. > Alternatively that the structures wasn't properly initialized and > thereby appeared free to the second thread. > > I have found a core file that adds to my suspicions, this time with two > active threads. Their stack frames are shown at the end. In this core > file the id variable in the bdb_search() frame is 9318, the second > thread is loading id==9319. The value of the "e" variable in > bdb_search() for the first thread equals the "x" variable of the > entry_decode() frame in the second thread. Since entry_decode() has > just allocated its "x" value it shouldn't have found the same value as > the other thread has unless someone released its "e" entry while it was > still using it. Why this happened I haven't figured out yet. > > The cachsesize directive has its default value, which is way below the > optimal value. The result is that the cache is always full. I don't > know if that can have any influence on the bug? I tried to lower its > value to see if that should help reproducing the problem, but not so > far. > >>> I'm currently trying to gather more information related to this bug, any >>> pointers as to what I should look for is appreciated. I'm posting this bug >>> report now in the hope that the stack frame should enlighten someone with better >>> knowledge of the code than what I have. >> Check for stack overruns, compile without optimization and make sure it's not >> a compiler optimization bug, etc. > > I'll try to run it with a version compiled with only -g and see if the > same thing should happen then. > -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5439) syncprov race condition seg. fault
by rein＠basefarm.no 25 Mar '08

25 Mar '08

On Tue, 25 Mar 2008, hyc(a)symas.com wrote: > rein(a)basefarm.no wrote: >> We have bin hit by what looks like a race condition bug in syncprov. We got >> some core dumps all showing stack frames like the one at the end. As such nasty >> bugs tends to do it have behaved OK after I restarted slapd with more debug >> output :-( (trace + stats + stats2 + sync). >> >> >> Note the a=0xBAD argument to attr_find(), which I expect is the result of some >> other thread freeing the attribute list it was called with while it was >> processing it. The rs->sr_entry->e_attrs argument passed to attr_find() as the >> original "a" argument by findpres_cb() looks like a perfectly valid structure, >> as are all the attributes found by following the a_next pointer. The list is >> terminated by an attribute with a NULL a_next value, none of the a_next values >> are 0xBAD. > > I don't believe that's the cause. Notice that arg0 in stack frame #9 is also > 0xbad, even though it is shown correctly in frames 8 and 10. Something else is > going on. I don't know how I managed to overlook the strange 0xbad argument in frame #9, and I really haven't any explanation as to why it shows that value. But if I am on the right track in my assumptions below I currently writes is off as an unexpected result of optimization. It now looks to me as if the entire rs->sr_entry was released an reused, and that the bug probably is in back-bdb. It just always happened when syncprov was running as this is a master server with mostly writes except from the reads syncprov does. Which also means that the title on the bug report is probably misleading :-( The reason for my shift of focus is some highly suspicious variables found in the bdb_search() frame. First, ei->bei_e seem to be NULL every time this happen, not the same as the "e" variable as I would except from looking at the code. Second, e->e_id is either 0 or ei->bei_id+1, the content of *e is the (more or less completely initialized) entry following the *ei entry in the database, while I would expect that ei->bei_id==e->e_id and that ei->bei_e==e. I don't think the consecutive ID numbers or entries has anything with the bug to do though, they are probably a result of the searches reading the entire database. I looks to me as if the EntryInfo referred to by ei was released somehow when slap_send_search_entry() was running, and that the ei->bei_e passed as rs->rs_entry was first released and then reused for the next entry. Alternatively that the structures wasn't properly initialized and thereby appeared free to the second thread. I have found a core file that adds to my suspicions, this time with two active threads. Their stack frames are shown at the end. In this core file the id variable in the bdb_search() frame is 9318, the second thread is loading id==9319. The value of the "e" variable in bdb_search() for the first thread equals the "x" variable of the entry_decode() frame in the second thread. Since entry_decode() has just allocated its "x" value it shouldn't have found the same value as the other thread has unless someone released its "e" entry while it was still using it. Why this happened I haven't figured out yet. The cachsesize directive has its default value, which is way below the optimal value. The result is that the cache is always full. I don't know if that can have any influence on the bug? I tried to lower its value to see if that should help reproducing the problem, but not so far. >> I'm currently trying to gather more information related to this bug, any >> pointers as to what I should look for is appreciated. I'm posting this bug >> report now in the hope that the stack frame should enlighten someone with better >> knowledge of the code than what I have. > > Check for stack overruns, compile without optimization and make sure it's not > a compiler optimization bug, etc. I'll try to run it with a version compiled with only -g and see if the same thing should happen then. Rein Acive thread when segmentation fault occured: #0 0x0807d03a in attr_find (a=0xbad, desc=0x81e8680) at attr.c:665 #1 0xb7a656f6 in findpres_cb (op=0xac05cba4, rs=0xac05cb68) at syncprov.c:546 #2 0x0808416d in slap_response_play (op=0xac05cba4, rs=0xac05cb68) at result.c:307 #3 0x0808555b in slap_send_search_entry (op=0xac05cba4, rs=0xac05cb68) at result.c:770 #4 0x080f2cdc in bdb_search (op=0xac05cba4, rs=0xac05cb68) at search.c:870 #5 0x080db72b in overlay_op_walk (op=0xac05cba4, rs=0xac05cb68, which=op_search, oi=0x8274218, on=0x8274318) at backover.c:653 #6 0x080dbcaf in over_op_func (op=0xac05cba4, rs=0xac05cb68, which=op_search) at backover.c:705 #7 0x080dbdef in over_op_search (op=0xac05cba4, rs=0xac05cb68) at backover.c:727 #8 0x080d9570 in glue_sub_search (op=0xac05cba4, rs=0xac05cb68, b0=0xac05cba4, on=0xac05cba4) at backglue.c:340 #9 0x080da131 in glue_op_search (op=0xbad, rs=0xac05cb68) at backglue.c:459 #10 0x080db6d5 in overlay_op_walk (op=0xac05cba4, rs=0xac05cb68, which=op_search, oi=0x8271860, on=0x8271a60) at backover.c:643 #11 0x080dbcaf in over_op_func (op=0xac05cba4, rs=0xac05cb68, which=op_search) at backover.c:705 #12 0x080dbdef in over_op_search (op=0xac05cba4, rs=0xac05cb68) at backover.c:727 #13 0xb7a65ff4 in syncprov_findcsn (op=0x85085b8, mode=FIND_PRESENT) at syncprov.c:700 #14 0xb7a670a0 in syncprov_op_search (op=0x85085b8, rs=0xac05e1c0) at syncprov.c:2277 #15 0x080db6d5 in overlay_op_walk (op=0x85085b8, rs=0xac05e1c0, which=op_search, oi=0x8271860, on=0x8271b60) at backover.c:643 #16 0x080dbcaf in over_op_func (op=0x85085b8, rs=0xac05e1c0, which=op_search) at backover.c:705 #17 0x080dbdef in over_op_search (op=0x85085b8, rs=0xac05e1c0) at backover.c:727 #18 0x08076554 in fe_op_search (op=0x85085b8, rs=0xac05e1c0) at search.c:368 #19 0x080770e4 in do_search (op=0x85085b8, rs=0xac05e1c0) at search.c:217 #20 0x08073e28 in connection_operation (ctx=0xac05e2b8, arg_v=0x85085b8) at connection.c:1084 #21 0x08074f14 in connection_read_thread (ctx=0xac05e2b8, argv=0x3d) at connection.c:1211 #22 0xb7fb5546 in ldap_int_thread_pool_wrapper (xpool=0x81ee240) at tpool.c:663 #23 0xb7c80371 in start_thread () from /lib/tls/libpthread.so.0 #24 0xb7c17ffe in clone () from /lib/tls/libc.so.6 Thead loading the next entry: #0 0x08123ef6 in avl_find (root=0x81e7940, data=0xae7a62e8, fcmp=0x80b8871 <attr_index_name_cmp>) at avl.c:541 #1 0x080b7852 in at_bvfind (name=0xae7a62e8) at at.c:130 #2 0x080b5fd8 in slap_bv2ad (bv=0xae7a6354, ad=0xae7a6360, text=0xae7a6364) at ad.c:189 #3 0x0807eef5 in entry_decode (eh=0xae7a63bc, e=0xae7a64a8) at entry.c:859 #4 0x0810d849 in bdb_id2entry (be=0xae8666c0, tid=0x0, locker=0xb742da7c, id=9319, e=0xae7a64a8) at id2entry.c:169 #5 0x08104ffb in bdb_cache_find_id (op=0xae866ba4, tid=0x0, id=9319, eip=0xae7a6614, flag=2, locker=0xb742da7c, lock=0xae7a65f4) at cache.c:834 #6 0x080f2682 in bdb_search (op=0xae866ba4, rs=0xae866b68) at search.c:684 #7 0x080db72b in overlay_op_walk (op=0xae866ba4, rs=0xae866b68, which=op_search, oi=0x8274218, on=0x8274318) at backover.c:653 #8 0x080dbcaf in over_op_func (op=0xae866ba4, rs=0xae866b68, which=op_search) at backover.c:705 #9 0x080dbdef in over_op_search (op=0xae866ba4, rs=0xae866b68) at backover.c:727 #10 0x080d9570 in glue_sub_search (op=0xae866ba4, rs=0xae866b68, b0=0x81e7930, on=0xae866ba4) at backglue.c:340 #11 0x080da131 in glue_op_search (op=0xfffffffa, rs=0xae866b68) at backglue.c:459 #12 0x080db6d5 in overlay_op_walk (op=0xae866ba4, rs=0xae866b68, which=op_search, oi=0x8271860, on=0x8271a60) at backover.c:643 #13 0x080dbcaf in over_op_func (op=0xae866ba4, rs=0xae866b68, which=op_search) at backover.c:705 #14 0x080dbdef in over_op_search (op=0xae866ba4, rs=0xae866b68) at backover.c:727 #15 0xb7a65ff4 in syncprov_findcsn (op=0x8508e60, mode=FIND_PRESENT) at syncprov.c:700 #16 0xb7a670a0 in syncprov_op_search (op=0x8508e60, rs=0xae8681c0) at syncprov.c:2277 #17 0x080db6d5 in overlay_op_walk (op=0x8508e60, rs=0xae8681c0, which=op_search, oi=0x8271860, on=0x8271b60) at backover.c:643 #18 0x080dbcaf in over_op_func (op=0x8508e60, rs=0xae8681c0, which=op_search) at backover.c:705 #19 0x080dbdef in over_op_search (op=0x8508e60, rs=0xae8681c0) at backover.c:727 #20 0x08076554 in fe_op_search (op=0x8508e60, rs=0xae8681c0) at search.c:368 #21 0x080770e4 in do_search (op=0x8508e60, rs=0xae8681c0) at search.c:217 #22 0x08073e28 in connection_operation (ctx=0xae8682b8, arg_v=0x8508e60) at connection.c:1084 #23 0x08074f14 in connection_read_thread (ctx=0xae8682b8, argv=0x54) at connection.c:1211 #24 0xb7fb5546 in ldap_int_thread_pool_wrapper (xpool=0x81ee240) at tpool.c:663 #25 0xb7c80371 in start_thread () from /lib/tls/libpthread.so.0 #26 0xb7c17ffe in clone () from /lib/tls/libc.so.6

1 0

Re: ACLs broken by ITS#5419
by hyc＠symas.com 25 Mar '08

25 Mar '08

Rein Tollevik wrote: > On Mon, 24 Mar 2008, Howard Chu wrote: > >> rein(a)basefarm.no wrote: >>> The change to servers/slapd/backend.c for ITS#5416 seem to have broken the >>> ability for group and set statements in access control lines to refer to >>> entries >>> outside the backend currently being operated on. >> That ability was never intended in the first place. Historically, backends in >> slapd have been treated as isolated DSAs with no connection to each other. >> They've required special mechanisms (like back-relay or slapo-glue) to be >> joined. > > Yes, I know, the change that allowed this was imo the one that made sets > and groups really useful. Our database configuration still has traces of > the workarounds the lack of this feature once forced us to make.. > > But, the latest change also removes this ability for databases subordinate > to the same common superior (i.e using the slapo-glue). If I understand > you correct it is a bug that glue'ed databases cannot refer to each other, > although I still consider it a bug (or at least a huge drawback) if this > would no longer be generally possible. Actually, looking back over CVS, it seems this ability has existed since OpenLDAP 2.0, intended or not. Will have to work up a better solution to restore that behavior. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5439) syncprov race condition seg. fault
by hyc＠symas.com 25 Mar '08

25 Mar '08

rein(a)basefarm.no wrote: > Full_Name: Rein Tollevik > Version: CVS head > OS: CentOS 4.4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (81.93.160.250) > > > We have bin hit by what looks like a race condition bug in syncprov. We got > some core dumps all showing stack frames like the one at the end. As such nasty > bugs tends to do it have behaved OK after I restarted slapd with more debug > output :-( (trace + stats + stats2 + sync). > > The configuration is a master server with multiple bdb backend databases all > being subordinate to the same glue database where syncprov is used. One of the > backends is a syncrepl consumer from another server, the server is master for > the other backends. There are multiple consumers for the syncprov suffix, which > I assume is what causes the race condition to happen. > > Note the a=0xBAD argument to attr_find(), which I expect is the result of some > other thread freeing the attribute list it was called with while it was > processing it. The rs->sr_entry->e_attrs argument passed to attr_find() as the > original "a" argument by findpres_cb() looks like a perfectly valid structure, > as are all the attributes found by following the a_next pointer. The list is > terminated by an attribute with a NULL a_next value, none of the a_next values > are 0xBAD. I don't believe that's the cause. Notice that arg0 in stack frame #9 is also 0xbad, even though it is shown correctly in frames 8 and 10. Something else is going on. > I'm currently trying to gather more information related to this bug, any > pointers as to what I should look for is appreciated. I'm posting this bug > report now in the hope that the stack frame should enlighten someone with better > knowledge of the code than what I have. Check for stack overruns, compile without optimization and make sure it's not a compiler optimization bug, etc. > > Rein Tollevik > Basefarm AS > > #0 0x0807d03a in attr_find (a=0xbad, desc=0x81e8680) at attr.c:665 > #1 0xb7a656f6 in findpres_cb (op=0xaf068ba4, rs=0xaf068b68) at syncprov.c:546 > #2 0x0808416d in slap_response_play (op=0xaf068ba4, rs=0xaf068b68) at > result.c:307 > #3 0x0808555b in slap_send_search_entry (op=0xaf068ba4, rs=0xaf068b68) at > result.c:770 > #4 0x080f2cdc in bdb_search (op=0xaf068ba4, rs=0xaf068b68) at search.c:870 > #5 0x080db72b in overlay_op_walk (op=0xaf068ba4, rs=0xaf068b68, > which=op_search, oi=0x8274218, on=0x8274318) at backover.c:653 > #6 0x080dbcaf in over_op_func (op=0xaf068ba4, rs=0xaf068b68, which=op_search) > at backover.c:705 > #7 0x080dbdef in over_op_search (op=0xaf068ba4, rs=0xaf068b68) at > backover.c:727 > #8 0x080d9570 in glue_sub_search (op=0xaf068ba4, rs=0xaf068b68, b0=0xaf068ba4, > on=0xaf068ba4) at backglue.c:340 > #9 0x080da131 in glue_op_search (op=0xbad, rs=0xaf068b68) at backglue.c:459 > #10 0x080db6d5 in overlay_op_walk (op=0xaf068ba4, rs=0xaf068b68, > which=op_search, oi=0x8271860, on=0x8271a60) at backover.c:643 > #11 0x080dbcaf in over_op_func (op=0xaf068ba4, rs=0xaf068b68, which=op_search) > at backover.c:705 > #12 0x080dbdef in over_op_search (op=0xaf068ba4, rs=0xaf068b68) at > backover.c:727 > #13 0xb7a65ff4 in syncprov_findcsn (op=0x85c7e60, mode=FIND_PRESENT) at > syncprov.c:700 > #14 0xb7a670a0 in syncprov_op_search (op=0x85c7e60, rs=0xaf06a1c0) at > syncprov.c:2277 > #15 0x080db6d5 in overlay_op_walk (op=0x85c7e60, rs=0xaf06a1c0, which=op_search, > oi=0x8271860, on=0x8271b60) at backover.c:643 > #16 0x080dbcaf in over_op_func (op=0x85c7e60, rs=0xaf06a1c0, which=op_search) at > backover.c:705 > #17 0x080dbdef in over_op_search (op=0x85c7e60, rs=0xaf06a1c0) at > backover.c:727 > #18 0x08076554 in fe_op_search (op=0x85c7e60, rs=0xaf06a1c0) at search.c:368 > #19 0x080770e4 in do_search (op=0x85c7e60, rs=0xaf06a1c0) at search.c:217 > #20 0x08073e28 in connection_operation (ctx=0xaf06a2b8, arg_v=0x85c7e60) at > connection.c:1084 > #21 0x08074f14 in connection_read_thread (ctx=0xaf06a2b8, argv=0x59) at > connection.c:1211 > #22 0xb7fb5546 in ldap_int_thread_pool_wrapper (xpool=0x81ee240) at tpool.c:663 > #23 0xb7c80371 in start_thread () from /lib/tls/libpthread.so.0 > #24 0xb7c17ffe in clone () from /lib/tls/libc.so.6 -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5340) REP_ENTRY_MODIFIABLE bug in dynlist
by ando＠sys-net.it 25 Mar '08

25 Mar '08

h.b.furuseth(a)usit.uio.no wrote: > h.b.furuseth(a)usit.uio.no writes: >> overlays/dynlist.c lines 371-376 sets REP_ENTRY_MUSTBEFREED in rs->sr_flags >> without duplicating the entry, if REP_ENTRY_MODIFIABLE was set. >> Thus the entry gets freed twice. Breaks test044-dynlist with back-ldif. > > Actually obeying rs->sr_flags seems to be a more general problem - but I > don't know what are bugs and what are my lacking understanding of the > flags. I.e. when can an overlay change REP_ENTRY_MUSTBEFREED, > REP_ENTRY_MUSTRELEASE? Usually backends/overlays that do not set these > flags, don't seem to expect them to change either. In general, callbacks are supposed to know about the existence of rs->sr_flags and deal with them. In detail, callbacks should use mechanisms that allow them to dispose of read-only resources without counting on the fact that rs->sr_* fields will be persistent through the callback chain. So, callbacks that need to modify data should check whether that data is modifiable; if it's not, they should first copy it, and set the rs->sr_flags as appropriate. The main reason for those flags to exist is optimization, otherwise we'd always duplicate data and dispose of it when done. So back-bdb/back-hdb, which are supposed to be the high-end database implementations, will always pass read-only data to the callback chain; however, if an overlay needs to muck with that data, it will first copy it, and set the REP_ENTRY_MODIFYABLE to inform other overlays that data can be freely modified without copying it again. On its own, back-bdb/back-hdb will take care of releasing the original entry without the need to use the value of rs->sr_entry; it'll use its copy of the entry's pointer. The existence of the REP_ENTRY_MUSTRELEASE value is not totally clear to me; it seems to indicate that in some cases callbacks want to pass a read-only entry without providing further cleanup code to release it; it makes sense, since this simple operation can be done by slap_send_search_entry() instead, if all that's required; however, this means that any callback that replaces the entry must remember to release it and must muck with rs->sr_flags accordingly. However, it is not clear what happens when a callback chain is interrupted by slap_null_cb() or similar, without getting to slap_send_search_entry(). This seems to indicate that callbacks should always provide a last resort means to release the resources they set; if read-only, by keeping track of what they sent; if modifiable, by freeing the contents of rs->sr_* if not NULL, setting it to NULL to prevent further cleanup. Similarly, the existence of REP_ENTRY_MUSTBEFREED is not totally clear: in principle as soon as REP_ENTRY_MODIFYABLE is set, it should imply REP_ENTRY_MUSTBEFREED; the only difference in the semantics of the two is that REP_ENTRY_MODIFYABLE without REP_ENTRY_MUSTBEFREED implies that the callback that set the former will take care of freeing the entry; however, other callbacks may further modify it, so freeing temporary data should probably be left to the final handler. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

(ITS#5439) syncprov race condition seg. fault
by rein＠basefarm.no 25 Mar '08

25 Mar '08

Full_Name: Rein Tollevik Version: CVS head OS: CentOS 4.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.93.160.250) We have bin hit by what looks like a race condition bug in syncprov. We got some core dumps all showing stack frames like the one at the end. As such nasty bugs tends to do it have behaved OK after I restarted slapd with more debug output :-( (trace + stats + stats2 + sync). The configuration is a master server with multiple bdb backend databases all being subordinate to the same glue database where syncprov is used. One of the backends is a syncrepl consumer from another server, the server is master for the other backends. There are multiple consumers for the syncprov suffix, which I assume is what causes the race condition to happen. Note the a=0xBAD argument to attr_find(), which I expect is the result of some other thread freeing the attribute list it was called with while it was processing it. The rs->sr_entry->e_attrs argument passed to attr_find() as the original "a" argument by findpres_cb() looks like a perfectly valid structure, as are all the attributes found by following the a_next pointer. The list is terminated by an attribute with a NULL a_next value, none of the a_next values are 0xBAD. I'm currently trying to gather more information related to this bug, any pointers as to what I should look for is appreciated. I'm posting this bug report now in the hope that the stack frame should enlighten someone with better knowledge of the code than what I have. Rein Tollevik Basefarm AS #0 0x0807d03a in attr_find (a=0xbad, desc=0x81e8680) at attr.c:665 #1 0xb7a656f6 in findpres_cb (op=0xaf068ba4, rs=0xaf068b68) at syncprov.c:546 #2 0x0808416d in slap_response_play (op=0xaf068ba4, rs=0xaf068b68) at result.c:307 #3 0x0808555b in slap_send_search_entry (op=0xaf068ba4, rs=0xaf068b68) at result.c:770 #4 0x080f2cdc in bdb_search (op=0xaf068ba4, rs=0xaf068b68) at search.c:870 #5 0x080db72b in overlay_op_walk (op=0xaf068ba4, rs=0xaf068b68, which=op_search, oi=0x8274218, on=0x8274318) at backover.c:653 #6 0x080dbcaf in over_op_func (op=0xaf068ba4, rs=0xaf068b68, which=op_search) at backover.c:705 #7 0x080dbdef in over_op_search (op=0xaf068ba4, rs=0xaf068b68) at backover.c:727 #8 0x080d9570 in glue_sub_search (op=0xaf068ba4, rs=0xaf068b68, b0=0xaf068ba4, on=0xaf068ba4) at backglue.c:340 #9 0x080da131 in glue_op_search (op=0xbad, rs=0xaf068b68) at backglue.c:459 #10 0x080db6d5 in overlay_op_walk (op=0xaf068ba4, rs=0xaf068b68, which=op_search, oi=0x8271860, on=0x8271a60) at backover.c:643 #11 0x080dbcaf in over_op_func (op=0xaf068ba4, rs=0xaf068b68, which=op_search) at backover.c:705 #12 0x080dbdef in over_op_search (op=0xaf068ba4, rs=0xaf068b68) at backover.c:727 #13 0xb7a65ff4 in syncprov_findcsn (op=0x85c7e60, mode=FIND_PRESENT) at syncprov.c:700 #14 0xb7a670a0 in syncprov_op_search (op=0x85c7e60, rs=0xaf06a1c0) at syncprov.c:2277 #15 0x080db6d5 in overlay_op_walk (op=0x85c7e60, rs=0xaf06a1c0, which=op_search, oi=0x8271860, on=0x8271b60) at backover.c:643 #16 0x080dbcaf in over_op_func (op=0x85c7e60, rs=0xaf06a1c0, which=op_search) at backover.c:705 #17 0x080dbdef in over_op_search (op=0x85c7e60, rs=0xaf06a1c0) at backover.c:727 #18 0x08076554 in fe_op_search (op=0x85c7e60, rs=0xaf06a1c0) at search.c:368 #19 0x080770e4 in do_search (op=0x85c7e60, rs=0xaf06a1c0) at search.c:217 #20 0x08073e28 in connection_operation (ctx=0xaf06a2b8, arg_v=0x85c7e60) at connection.c:1084 #21 0x08074f14 in connection_read_thread (ctx=0xaf06a2b8, argv=0x59) at connection.c:1211 #22 0xb7fb5546 in ldap_int_thread_pool_wrapper (xpool=0x81ee240) at tpool.c:663 #23 0xb7c80371 in start_thread () from /lib/tls/libpthread.so.0 #24 0xb7c17ffe in clone () from /lib/tls/libc.so.6

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs