(ITS#4886) slapd stopping with no error message

[douglas@gpc.edu]

Full_Name: Douglas Jones
Version: 2.3.34
OS: RHEL4 (linux)
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (168.28.202.22)


Without efence, after the server has been runing between 3 and 15 days,
it varies, the sever just stops. Even using ulimit on core size, I did
not have luck getting a core file. Per recomendation of the newgroups,
I used efence and it crashed on the first lookup. I got the following under
gdb:

(previous -d 1 output cut)
>>> dnPrettyNormal: <cn=Write,cn=Waiters,cn=Monitor>
<<< dnPrettyNormal: <cn=Write,cn=Waiters,cn=Monitor>,
<cn=write,cn=waiters,cn=monitor>
>>> dnNormalize: <>
<<< dnNormalize: <>
>>> dnNormalize: <>
<<< dnNormalize: <>
<= str2entry(cn=Write,cn=Waiters,cn=Monitor) -> 0x260d9fd8
backend_startup_one: starting "o=gpc,c=us"
slapd starting
[New Thread 635861936 (LWP 10061)]
[New Thread 631663536 (LWP 10062)]
[New Thread 627465136 (LWP 10063)]
[New Thread 623266736 (LWP 10064)]
[New Thread 619068336 (LWP 10065)]
>>> slap_listener(ldap://:389/)
connection_get(33): got connid=0
connection_read(33): checking for input on id=0
ber_get_next
ber_get_next: tag 0x30 len 16 contents:
ber_get_next
do_bind
ber_scanf fmt ({imt) ber:
ber_scanf fmt (m}) ber:
>>> dnPrettyNormal: <>
<<< dnPrettyNormal: <>, <>
do_bind: version=3 dn="" method=128
send_ldap_result: conn=0 op=0 p=3
send_ldap_response: msgid=30 tag=97 err=0
ber_flush: 14 bytes to sd 33
connection_get(33): got connid=0
connection_read(33): checking for input on id=0
ber_get_next

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 635861936 (LWP 10061)]
ber_get_next (sb=0x25f2ffe8, len=0x25e6427c, ber=0x25f65fd4) at io.c:551
551                     if (*ber->ber_ptr & 0x80) {     /* multi-byte */
(gdb) bt full
#0  ber_get_next (sb=0x25f2ffe8, len=0x25e6427c, ber=0x25f65fd4) at io.c:551
        l = Variable "l" is not available.
(gdb) thread apply all bt

Thread 6 (Thread 619068336 (LWP 10065)):
#0  0x0028e7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x004e7b26 in pthread_cond_wait@@GLIBC_2.3.2 ()
   from /lib/tls/libpthread.so.0
#2  0x0812d25b in ldap_int_thread_pool_wrapper (xpool=0xb725df58)
    at tpool.c:490
#3  0x004e5371 in start_thread () from /lib/tls/libpthread.so.0
#4  0x0036effe in clone () from /lib/tls/libc.so.6

Thread 5 (Thread 623266736 (LWP 10064)):
#0  0x0028e7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x004e7b26 in pthread_cond_wait@@GLIBC_2.3.2 ()
   from /lib/tls/libpthread.so.0
#2  0x0812d25b in ldap_int_thread_pool_wrapper (xpool=0xb725df58)
    at tpool.c:490
#3  0x004e5371 in start_thread () from /lib/tls/libpthread.so.0
#4  0x0036effe in clone () from /lib/tls/libc.so.6

Thread 4 (Thread 627465136 (LWP 10063)):
#0  0x0028e7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x004e7b26 in pthread_cond_wait@@GLIBC_2.3.2 ()
   from /lib/tls/libpthread.so.0
---Type <return> to continue, or q <return> to quit---
#2  0x0812d25b in ldap_int_thread_pool_wrapper (xpool=0xb725df58)
    at tpool.c:490
#3  0x004e5371 in start_thread () from /lib/tls/libpthread.so.0
#4  0x0036effe in clone () from /lib/tls/libc.so.6

Thread 3 (Thread 631663536 (LWP 10062)):
#0  0x0028e7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x0036ba19 in mprotect () from /lib/tls/libc.so.6
#2  0x0814fb3f in Page_AllowAccess (address=0x25fa8000, size=475136)
    at page.c:149
#3  0x0814f6be in free (address=0xb7ea4ff0) at efence.c:694
#4  0x003232b5 in tzset_internal () from /lib/tls/libc.so.6
#5  0x00323d0e in tzset () from /lib/tls/libc.so.6
#6  0x003288ae in strftime_l () from /lib/tls/libc.so.6
#7  0x0036af6b in vsyslog () from /lib/tls/libc.so.6
#8  0x0036b4df in syslog () from /lib/tls/libc.so.6
#9  0x0806ab08 in slap_send_ldap_result (op=0x25f61e58, rs=0x25a66230)
    at result.c:585
#10 0x08075952 in fe_op_bind (op=0x25f61e58, rs=0x25a66230) at bind.c:327
#11 0x0807523d in do_bind (op=0x25f61e58, rs=0x25a66230) at bind.c:200
#12 0x0805eac4 in connection_operation (ctx=0x25a662b0, arg_v=0x25f61e58)
    at connection.c:1133
#13 0x0812d1df in ldap_int_thread_pool_wrapper (xpool=0xb725df58)
---Type <return> to continue, or q <return> to quit---
    at tpool.c:478
#14 0x004e5371 in start_thread () from /lib/tls/libpthread.so.0
#15 0x0036effe in clone () from /lib/tls/libc.so.6

Thread 2 (Thread 635861936 (LWP 10061)):
#0  ber_get_next (sb=0x25f2ffe8, len=0x25e6427c, ber=0x25f65fd4) at io.c:551
#1  0x0805eed0 in connection_read (s=33) at connection.c:1528
#2  0x0805baa2 in slapd_daemon_task (ptr=0x0) at daemon.c:2461
#3  0x004e5371 in start_thread () from /lib/tls/libpthread.so.0
#4  0x0036effe in clone () from /lib/tls/libc.so.6

Thread 1 (Thread -1208731424 (LWP 10058)):
#0  0x0028e7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x004e60fd in pthread_join () from /lib/tls/libpthread.so.0
#2  0x0805c621 in slapd_daemon () at daemon.c:2572
#3  0x0804dc9f in main (argc=13, argv=0xbff6ac14) at main.c:860
------------------------------------------------------------------------------------

It did return the names to my client, which was good, but just crashed after
(during) that. Please let me know if I can do anythin else. Thanks!