389-ds-base

#49744 Ticket 49736 - Hardening of active connection list
Closed by spichugi. Opened by tbordaz.
tbordaz/389-ds-base Ticket-49736  into  master

Download 49744.patch

Bug Description:
In case of a bug in the management of the connection refcnt
it can happen that there are several attempts to move a connection
out of the active list.

It triggers a crash because when derefencing c->c_prev.
c_prev is never NULL on the active list

Fix Description:
The fix tests if the connection is already out of the active list.
If such case, it just returns.

A potential issue that is not addressed by this fix is:
Thread A and Thread B are using 'c' but c->refcnt=1 (it should be 2)
Thread A "closes" 'c', 'c' is move out of active list (free) because of refcnt=0
A new connection happens selecting the free connection 'c', moving it to the active list.
Thread C is using 'c' from the new connection c->refcnt=1
Thread B "closes" 'c', 'c' is moved out of the active list.
-> new operation coming on 'c' will not be detected
-> Thread C will likely crash when sending result

https://pagure.io/389-ds-base/issue/49736

Reviewed by: ?

Platforms tested: F26

Flag Day: no

Doc impact: no

LGTM, lets get this in for the next respin

So the real issue is that Thread A or B on same connection is not handling the refcnt correctly. One is either: setting it too late, not setting it at all, or lowering it too soon. Do we know which one it is?

thanks for the review Mark. Is it a ack ?

Regarding your question I have no real idea.
I know a corner case that can lead to this crash but it exists other scenario and it is the reason of this hardening.
The corner case was an invalid lowering. It happened if a thread was processing several operations in a raw (turbo mode or more_data).

rebased onto b0e05806232b781eed3ff102485045a358d7659b

Pull-Request has been merged by tbordaz

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/2803

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.