richton@nbcs.rutgers.edu wrote:
Full_Name: Aaron Richton Version: RE24 OS: Solaris 9 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (128.6.31.135)
Sol9+libumem+RE24 (current). I have five core files all with an aborting thread showing:
current thread: t@8 [1] __lwp_kill(0x0, 0x6, 0x0, 0xfffffff8, 0x0, 0xfb3feec1), at 0xff31feb0 [2] Abort(0xfb3fef18, 0xfb3fef18, 0x3a, 0x39, 0x81010100, 0xff00), at 0xff056f9c [3] panic(0xff065e34, 0x0, 0x0, 0x1, 0x0, 0xfb3ff139), at 0xff057094 [4] _ceil_prio_inherit(0xef, 0x0, 0x10807258, 0xff078000, 0xff0613bc, 0x0), at 0xff05ff10 [5] mutex_lock_internal(0xad, 0x0, 0xff040e00, 0x23, 0x7, 0x10fed159), at 0xff0614bc =>[6] ldap_pvt_thread_mutex_lock(mutex = 0x10807258), line 296 in "thr_posix.c" [7] syncprov_op_mod(op = 0xfb3ff8e8, rs = 0xfb3ff5a0), line 1965 in "syncprov.c" [8] overlay_op_walk(op = 0xfb3ff8e8, rs = 0xfb3ff5a0, which = op_modify, oi = 0x1083b088, on = 0x1083ad88), line 659 in "backover.c" [9] over_op_func(op = 0xfb3ff8e8, rs = 0xfb3ff5a0, which = op_modify), line 721 in "backover.c" [10] over_op_modify(op = 0xfb3ff8e8, rs = 0xfb3ff5a0), line 755 in "backover.c" [11] syncrepl_updateCookie(si = 0x10417a88, op = 0xfb3ff8e8, pdn = 0x10845b68, syncCookie = 0xfb3ff710), line 3045 in "syncrepl.c" [12] do_syncrep2(op = 0xfb3ff8e8, si = 0x10417a88), line 1177 in "syncrepl.c" [13] do_syncrepl(ctx = 0xfb3ffe0c, arg = 0x10807d08), line 1358 in "syncrepl.c" [14] connection_read_thread(ctx = 0xfb3ffe0c, argv = 0x1c), line 1254 in "connection.c" [15] ldap_int_thread_pool_wrapper(xpool = 0x10491f08), line 685 in "tpool.c"
In Frame 7, mt->mt_mods = 0xdeadbeef. Looks like libumem caught a post-free() access.
Looks like someone else got to the end of the modifications list and destroyed everything...
p.