#51082 abort when a empty valueset is freed
Closed: wontfix 3 years ago by tbordaz. Opened 3 years ago by tbordaz.

Issue Description

A large valueset (more than 10 values) manages a sorted array. replication purges old values from a valueset (valueset_array_purge). If it purges all the values the valueset is freed (slapi_valueset_done). The problem is that the when it is freed, the number of values accounted by the valueset is not reset and safety checking aborts.

Package Version and Platform

since 1.3.x

Steps to reproduce

Testcase provided with the fix

Actual results

Server abort and dump a core

Expected results

Server should not abort


The problem is detected with debug build, as it runs safety checking.

stack trace is

#0  __GI_abort () at abort.c:107
#1  0x00007fdb4485b241 in PR_Assert (
    s=0x7fdb44e26420 "(vs->sorted == NULL) || (vs->num < VALUESET_ARRAY_SORT_THRESHOLD) || ((vs->num >= VALUESET_ARRAY_SORT_THRESHOLD) && (vs->sorted[0] < vs->num))", file=0x7fdb44e26400 "ldap/servers/slapd/valueset.c", ln=471) at ../../.././nspr/pr/src/io/prlog.c:571
#2  0x00007fdb44df69ce in slapi_valueset_done (vs=0x7fdb00015478) at ldap/servers/slapd/valueset.c:471
#3  0x00007fdb44df75fb in valueset_array_purge (a=0x7fdb00015440, vs=0x7fdb00015478, csn=0x7fdb00017d10) at ldap/servers/slapd/valueset.c:804
#4  0x00007fdb44df7766 in valueset_purge (a=0x7fdb00015440, vs=0x7fdb00015478, csn=0x7fdb00017d10) at ldap/servers/slapd/valueset.c:834
#5  0x00007fdb44d373ce in attr_purge_state_information (entry=0x7fdb00014e40, attr=0x7fdb00015440, csnUpTo=0x7fdb00017d10)
    at ldap/servers/slapd/attr.c:739
#6  0x00007fdb44d5d3d5 in entry_purge_state_information (e=0x7fdb00014e40, csnUpTo=0x7fdb00017d10) at ldap/servers/slapd/entrywsi.c:284
#7  0x00007fdb4197cedb in purge_entry_state_information (pb=0x7fdb00000b60) at ldap/servers/plugins/replication/repl5_plugins.c:558
#8  0x00007fdb4197d283 in multimaster_bepreop_modify (pb=0x7fdb00000b60) at ldap/servers/plugins/replication/repl5_plugins.c:700
#9  0x00007fdb4197cfe3 in multimaster_mmr_preop (pb=0x7fdb00000b60, flags=451) at ldap/servers/plugins/replication/repl5_plugins.c:588
#10 0x00007fdb44db02b5 in plugin_call_mmr_plugin_preop (pb=0x7fdb00000b60, e=0x0, flags=451) at ldap/servers/slapd/plugin_mmr.c:39
#11 0x00007fdb41a83600 in ldbm_back_modify (pb=0x7fdb00000b60) at ldap/servers/slapd/back-ldbm/ldbm_modify.c:635
#12 0x00007fdb44d90e3f in op_shared_modify (pb=0x7fdb00000b60, pw_change=0, old_pw=0x0) at ldap/servers/slapd/modify.c:1022
#13 0x00007fdb44d8f343 in do_modify (pb=0x7fdb00000b60) at ldap/servers/slapd/modify.c:380
#14 0x0000000000418c2b in connection_dispatch_operation (conn=0x445fea8, op=0x4414750, pb=0x7fdb00000b60) at ldap/servers/slapd/connection.c:624
#15 0x000000000041ad0b in connection_threadmain () at ldap/servers/slapd/connection.c:1753
#16 0x00007fdb44874869 in _pt_root (arg=0x444c430) at ../../.././nspr/pr/src/pthreads/ptthread.c:201
#17 0x00007fdb448094c0 in start_thread (arg=<optimized out>) at pthread_create.c:479
#18 0x00007fdb446dc133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Metadata Update from @tbordaz:
- Custom field origin adjusted to None
- Custom field reviewstatus adjusted to None

3 years ago

Metadata Update from @tbordaz:
- Issue assigned to tbordaz

3 years ago

d73b14a..0cb1e04 master

This should be backported all the way to 1.4.1

Metadata Update from @tbordaz:
- Issue set to the milestone: 1.4.1

3 years ago

0222c25..280ba7e 389-ds-base-1.4.3
b940d05..469e141 389-ds-base-1.4.2
b0b4a13..0fb23f3 389-ds-base-1.4.1

Metadata Update from @tbordaz:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

3 years ago

Metadata Update from @mreynolds:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1843090

3 years ago

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/4135

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @spichugi:
- Issue close_status updated to: wontfix (was: fixed)

3 years ago

Login to comment on this ticket.

Metadata