openldap-bugs

openldap-bugs@openldap.org

1 participants
20965 discussions

(ITS#8456) slapacl segfaults with mdb if object does not exists
by best＠univention.de 28 Jun '16

28 Jun '16

Full_Name: Florian Best Version: 2.4.42+dfsg-2.210.201511060842 OS: UCS 4.1-2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (82.198.197.8) Running the following command causes a segfault. There is no object for the DN provided with "-b". gdb --args slapacl -D uid=Administator,cn=users,dc=school,dc=local -b uid=doesnotexists,dc=school,dc=local -d0 -u jejectClass:univentionAdminUserSettings Program received signal SIGSEGV, Segmentation fault. 0x00007ffff013fbc8 in mdb_txn_begin () from /usr/lib/ldap/back_mdb.so (gdb) bt #0 0x00007ffff013fbc8 in mdb_txn_begin () from /usr/lib/ldap/back_mdb.so #1 0x00007ffff3a3a8d0 in mdb_opinfo_get () from /usr/lib/ldap/back_mdb.so #2 0x00007ffff013aac6 in mdb_entry_get () from /usr/lib/ldap/back_mdb.so #3 0x0000000000498267 in overlay_entry_get_ov () #4 0x00000000004982e7 in ?? () #5 0x000000000043f236 in fe_acl_group %)%9 #6 0x000000000043cd28 in backend_group () #7 0x0000000000453d9c in slap_access_allowed () #8 0x00000000004980cd in ?? () #9 0x0000000000450d8c in access_allowed_mask () #10 0x000000000049f793 in slapacl () #11 0x00000000004160bf in main ()

1 0

Re: (ITS#8452) LMDB: mdb_env_copyfd2 can deadlock due to missing mdb_env_cthr_toggle check
by h.b.furuseth＠usit.uio.no 28 Jun '16

28 Jun '16

On 28. juni 2016 13:06, Lorenz Bauer wrote: > I had a look at your changes, it seems like they obsolete my other bug report > as well. Good, I'll close that. > At the same time, I think you are introducing a double free? In copyfd1, if > memalign (and friends) fails you goto done, which then proceeds to free(). > Same for the case where CreateMutex or CreateFree return an error, since they > happen before allocation, but also goto done. In those cases the code leaves the HANDLE or pointer = NULL. free(NULL) does nothing. The "done:" code omits CloseHandle when the handle is NULL. Hmm. Unless failed posix_memalign() may put garbage in the destination pointer. Probably not, but can tweak the code to be safe just in case. -- Hallvard

1 0

Re: (ITS#8452) LMDB: mdb_env_copyfd2 can deadlock due to missing mdb_env_cthr_toggle check
by lorenz＠cloudflare.com 28 Jun '16

28 Jun '16

--94eb2c033d26fe88ce053654a1b2 Content-Type: text/plain; charset=UTF-8 I had a look at your changes, it seems like they obsolete my other bug report as well. At the same time, I think you are introducing a double free? In copyfd1, if memalign (and friends) fails you goto done, which then proceeds to free(). Same for the case where CreateMutex or CreateFree return an error, since they happen before allocation, but also goto done. -- Lorenz On 28 June 2016 at 11:09, Hallvard Breien Furuseth <h.b.furuseth(a)usit.uio.no > wrote: > Looks like a dup of ITS#8209. I've pushed a fix to > mdb.master. Hadn't gotten around to testing it properly. > > -- > Hallvard > --94eb2c033d26fe88ce053654a1b2 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">I had a look at your changes, it seems like they obsolete = my other bug report as well.<div><br></div><div>At the same time, I think y= ou are introducing a double free? In copyfd1, if memalign (and friends) fai= ls you goto done, which then proceeds to free(). Same for the case where Cr= eateMutex or CreateFree return an error, since they happen before allocatio= n, but also goto done.</div><div><br></div><div>--</div><div>Lorenz</div></= div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On 28 June 20= 16 at 11:09, Hallvard Breien Furuseth <span dir=3D"ltr"><<a href=3D"mail= to:h.b.furuseth@usit.uio.no" target=3D"_blank">h.b.furuseth(a)usit.uio.no</a>= ></span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0= 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Looks like a dup of IT= S#8209.=C2=A0 I've pushed a fix to<br> mdb.master.=C2=A0 Hadn't gotten around to testing it properly.<span cla= ss=3D"HOEnZb"><font color=3D"#888888"><br> <br> -- <br> Hallvard<br> </font></span></blockquote></div><br></div> --94eb2c033d26fe88ce053654a1b2--

1 0

Re: (ITS#8452) LMDB: mdb_env_copyfd2 can deadlock due to missing mdb_env_cthr_toggle check
by lorenz＠cloudflare.com 28 Jun '16

28 Jun '16

--001a1143e19852a7140536547685 Content-Type: text/plain; charset=UTF-8 Thanks for the fix, and my bad for not finding the bug report. I didn't use the ITS interface properly. -- Lorenz On 28 June 2016 at 11:09, Hallvard Breien Furuseth <h.b.furuseth(a)usit.uio.no > wrote: > Looks like a dup of ITS#8209. I've pushed a fix to > mdb.master. Hadn't gotten around to testing it properly. > > -- > Hallvard > --001a1143e19852a7140536547685 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Thanks for the fix, and my bad for not finding the bug rep= ort. I didn't use the ITS interface properly.<div><br></div><div>--</di= v><div>Lorenz<br><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">= On 28 June 2016 at 11:09, Hallvard Breien Furuseth <span dir=3D"ltr"><<a= href=3D"mailto:h.b.furuseth@usit.uio.no" target=3D"_blank">h.b.furuseth@us= it.uio.no</a>></span> wrote:<br><blockquote class=3D"gmail_quote" style= =3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Looks li= ke a dup of ITS#8209.=C2=A0 I've pushed a fix to<br> mdb.master.=C2=A0 Hadn't gotten around to testing it properly.<span cla= ss=3D"HOEnZb"><font color=3D"#888888"><br> <br> -- <br> Hallvard<br> </font></span></blockquote></div><br></div></div></div> --001a1143e19852a7140536547685--

1 0

Re: (ITS#8452) LMDB: mdb_env_copyfd2 can deadlock due to missing mdb_env_cthr_toggle check
by h.b.furuseth＠usit.uio.no 28 Jun '16

28 Jun '16

Looks like a dup of ITS#8209. I've pushed a fix to mdb.master. Hadn't gotten around to testing it properly. -- Hallvard

1 0

(ITS#8455) LMDB: mdb_env_copyfd1 leaks memory and pthread state if mdb_txn_begin fails
by lmb＠cloudflare.com 28 Jun '16

28 Jun '16

Full_Name: Lorenz Bauer Version: git c367c1f69685 OS: OS X URL: https://gist.github.com/lmb/c48dcdb74b4bc9bf4ecae1d70553d623 Submission from: (NULL) (2a06:98c0:1000:1200:1160:b579:2042:d902) In case that mdb_txn_begin fails (e.g. due to no more reader slots available), mdb_env_copyfd1 leaks my.mc_wbuf[0]. From the pthread_create man pages, it seems like it also leaks pthread state, since the created thread is never joined. The linked gist contains a test case, valgrind output which confirms that the buffer is leaked, and a patch. The patch properly frees the buffer, and always joins the thread. If the thread was never created pthread_join simply returns an error, which is ignored anyways. I think the same logic holds on Windows.

1 0

(ITS#8454) audit-log overlay man pag needs some improvement
by elecharny＠apache.org 27 Jun '16

27 Jun '16

Full_Name: Emmanuel Lecharny Version: 2.4.44 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.235.65.101) The current slapo-auditlog could be improve a bit by providing some more context about the audit log file content. Typically, the first like contains important informations like : - the operation - the timestamp - the database suffix - the modifiers' name - and the connection ID When this connection ID is -1, it would be interesting in the man page to inform the users that this update is an internal update (ie, something caused by an internal slapd update, not an user update). A simple sentence could be : "A 'conn=-1' in the first line tells that this is an internal operation, not an user initiated operation".

1 0

Re: (ITS#8453) lmdb: fix warning on Apple platforms
by catwell＠archlinux.us 27 Jun '16

27 Jun '16

Actually, ignore this: it's the same as 8407 which you closed as wontfix.= =0A=0ASorry for the noise.=0A=0A-- =0APierre Chapuis

1 0

(ITS#8453) lmdb: fix warning on Apple platforms
by catwell＠archlinux.us 27 Jun '16

27 Jun '16

Full_Name: Pierre Chapuis Version: OS: macOS / iOS URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (90.79.254.46) Apple compilers (and probably others) do not allow calling sprintf with fewer arguments than the format calls for. The warning is: mdb.c:10720:46: warning: data argument not used by format string [-Wformat-extra-args] (int)mr[i].mr_pid, (size_t)mr[i].mr_tid, txnid); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~ /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS9.3.sdk/usr/include/secure/_stdio.h:47:56: note: expanded from macro 'sprintf' __builtin___sprintf_chk (str, 0, __darwin_obsz(str), __VA_ARGS__) ^~~~~~~~~~~ Proposed patch against current LMDB sterer: diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c index 79a958b..84afe4f 100644 --- a/libraries/liblmdb/mdb.c +++ b/libraries/liblmdb/mdb.c @@ -10715,9 +10715,13 @@ mdb_reader_list(MDB_env *env, MDB_msg_func *func, void *ctx) for (i=0; i<rdrs; i++) { if (mr[i].mr_pid) { txnid_t txnid = mr[i].mr_txnid; - sprintf(buf, txnid == (txnid_t)-1 ? - "%10d %"Z"x -\n" : "%10d %"Z"x %"Y"u\n", - (int)mr[i].mr_pid, (size_t)mr[i].mr_tid, txnid); + if (txnid == (txnid_t)-1) { + sprintf(buf, "%10d %"Z"x -\n", + (int)mr[i].mr_pid, (size_t)mr[i].mr_tid); + } else { + sprintf(buf, "%10d %"Z"x %"Z"u\n", + (int)mr[i].mr_pid, (size_t)mr[i].mr_tid, txnid); + } if (first) { first = 0; rc = func(" pid thread txnid\n", ctx);

1 0

(ITS#8452) LMDB: mdb_env_copyfd2 can deadlock due to missing mdb_env_cthr_toggle check
by lmb＠cloudflare.com 27 Jun '16

27 Jun '16

Full_Name: Lorenz Bauer Version: git c367c1f69685 OS: OS X URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2a06:98c0:1000:1200:156f:df88:ee9a:7775) The function mdb_env_copyfd2 with MDB_CP_COMPACT enabled can currently deadlock, since a call to mdb_env_cthr_toggle is not checked. The testcase at https://gist.github.com/lmb/17a528cdadde73fb231a2a1ed84714f7 reproduces this issue as follows: - Use pthread_sigmask to ignore SIGPIPE - Create new pipe - Spawn thread with mdb_env_copyfd2 using MDB_CP_COMPACT - Close read side of the pipe in main thread - Join thread and check rc code On LMDB master the testase e hangs instead of returning EPIPE. The following patch fixes the deadlock, but since I'm not very familiar with the codebase it's likely incorrect. diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c index 79a958b..97ff7c7 100644 --- a/libraries/liblmdb/mdb.c +++ b/libraries/liblmdb/mdb.c @@ -9988,11 +9988,15 @@ mdb_env_copyfd1(MDB_env *env, HANDLE fd) rc = mdb_env_cwalk(&my, &txn->mt_dbs[MAIN_DBI].md_root, 0); if (rc == MDB_SUCCESS && my.mc_wlen[my.mc_toggle]) rc = mdb_env_cthr_toggle(&my, 1); - mdb_env_cthr_toggle(&my, -1); + rc = mdb_env_cthr_toggle(&my, -1); + if (rc) + goto done; pthread_mutex_lock(&my.mc_mutex); while(my.mc_new) pthread_cond_wait(&my.mc_cond, &my.mc_mutex); pthread_mutex_uocock(&my.mc_mutex); + +done: THREAD_FINISH(thr); mdb_txn_abort(txn);

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs