(ITS#7524) Seg fault of slapd with back-meta traffic - openldap-bugs

12 Feb 2013


      Full_Name: Jorge Perez Burgos
Version: 2.4.32
OS: SLES 10
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (195.235.15.243)
PROBLEM
Sending high load traffic to several slapd servers that are proxying the traffic
to only one slapd. It can seen that in this situation originating servers crash
sporadically.
POSSIBLE SOLUTION
In back-meta/conn.c in the method meta_back_retry it seems that the binding flag
is not set properly in the following situation:
/* restore the "binding" flag, in case */
                 if ( binding ) {
                     LDAP_BACK_CONN_BINDING_SET( msc );
                 }
if ( rc == LDAP_SUCCESS ) {
                         quarantine = 0;
rc = meta_back_single_dobind( op, rs, mcp, candidate,
                                 sendok, mt->mt_nretries, 0 );
Setting the binding flag before calling meta_back_single_dobind seems to solve
the issue  (LDAP_BACK_CONN_BINDING_SET( msc );)
CORE DUMP TRACE
This is the backtrace of the core dumped.
Program terminated with signal 6, Aborted.
#0  0x00002ad023473f45 in raise () from /lib64/libc.so.6
(gdb) bt
#0  0x00002ad023473f45 in raise () from /lib64/libc.so.6
#1  0x00002ad023475340 in abort () from /lib64/libc.so.6
#2  0x00002ad02346d486 in __assert_fail () from /lib64/libc.so.6
#3  0x000000000051cfe1 in meta_back_bind_op_result (op=0x69d2580,
rs=0x2aab95e57c70, mc=0x2aab62a44740, candidate=2, msgid=1, sendok=<value
optimized out>, dolock=0) at bind.c:392
#4  0x000000000051d130 in meta_back_proxy_authz_bind (mc=0x2aab62a44740,
candidate=2, op=0x69d2580, rs=0x2aab95e57c70, sendok=LDAP_BACK_DONTSEND,
dolock=0) at bind.c:1590
#5  0x000000000051d37b in meta_back_single_dobind (op=0x69d2580,
rs=0x2aab95e57c70, mcp=0x2aab95e56920, candidate=2, sendok=LDAP_BACK_DONTSEND,
nretries=<value optimized out>, dolock=0) at bind.c:605
#6  0x000000000052714d in meta_back_retry (op=0x69d2580, rs=0x2aab95e57c70,
mcp=0x2aab95e56920, candidate=2, sendok=LDAP_BACK_DONTSEND) at conn.c:769
#7  0x00000000004db025 in meta_back_search (op=0x69d2580, rs=0x2aab95e57c70) at
search.c:1154
#8  0x00000000004636d9 in fe_op_search (op=0x69d2580, rs=0x2aab95e57c70) at
search.c:402
#9  0x00000000004c4e02 in overlay_op_walk (op=0x69d2580, rs=0x2aab95e57c70,
which=op_search, oi=0x8088000, on=0x0) at backover.c:671
#10 0x00000000004c5307 in over_op_func (op=0x69d2580, rs=0x2aab95e57c70,
which=op_search) at backover.c:723
#11 0x0000000000463ee5 in do_search (op=0x69d2580, rs=0x2aab95e57c70) at
search.c:247
#12 0x0000000000460f45 in connection_operation (ctx=0x2aab95e57e50, arg_v=<value
optimized out>) at connection.c:1308
#13 0x0000000000461e05 in connection_read_thread (ctx=0x2aab95e57e50,
argv=<value optimized out>) at connection.c:1444
#14 0x000000000055cb7c in ldap_int_thread_pool_wrapper (xpool=0x8028000) at
tpool.c:688
#15 0x00002ad022ec92a3 in start_thread () from /lib64/libpthread.so.0
#16 0x00002ad02350549d in clone () from /lib64/libc.so.6