Re: (ITS#6271) syncprov use of freed mutex

[masarati@aero.polimi.it]

richton@nbcs.rutgers.edu wrote:
> Full_Name: Aaron Richton
> Version: RE24
> OS: Solaris 9
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (128.6.31.135)
> 
> 
> Sol9+libumem+RE24 (current). I have five core files all with an aborting thread
> showing:
> 
> current thread: t@8
>   [1] __lwp_kill(0x0, 0x6, 0x0, 0xfffffff8, 0x0, 0xfb3feec1), at 0xff31feb0 
>   [2] Abort(0xfb3fef18, 0xfb3fef18, 0x3a, 0x39, 0x81010100, 0xff00), at
> 0xff056f9c 
>   [3] panic(0xff065e34, 0x0, 0x0, 0x1, 0x0, 0xfb3ff139), at 0xff057094 
>   [4] _ceil_prio_inherit(0xef, 0x0, 0x10807258, 0xff078000, 0xff0613bc, 0x0), at
> 0xff05ff10 
>   [5] mutex_lock_internal(0xad, 0x0, 0xff040e00, 0x23, 0x7, 0x10fed159), at
> 0xff0614bc 
> =>[6] ldap_pvt_thread_mutex_lock(mutex = 0x10807258), line 296 in "thr_posix.c"
>   [7] syncprov_op_mod(op = 0xfb3ff8e8, rs = 0xfb3ff5a0), line 1965 in
> "syncprov.c"
>   [8] overlay_op_walk(op = 0xfb3ff8e8, rs = 0xfb3ff5a0, which = op_modify, oi =
> 0x1083b088, on = 0x1083ad88), line 659 in "backover.c"
>   [9] over_op_func(op = 0xfb3ff8e8, rs = 0xfb3ff5a0, which = op_modify), line
> 721 in "backover.c"
>   [10] over_op_modify(op = 0xfb3ff8e8, rs = 0xfb3ff5a0), line 755 in
> "backover.c"
>   [11] syncrepl_updateCookie(si = 0x10417a88, op = 0xfb3ff8e8, pdn = 0x10845b68,
> syncCookie = 0xfb3ff710), line 3045 in "syncrepl.c"
>   [12] do_syncrep2(op = 0xfb3ff8e8, si = 0x10417a88), line 1177 in "syncrepl.c"
>   [13] do_syncrepl(ctx = 0xfb3ffe0c, arg = 0x10807d08), line 1358 in
> "syncrepl.c"
>   [14] connection_read_thread(ctx = 0xfb3ffe0c, argv = 0x1c), line 1254 in
> "connection.c"
>   [15] ldap_int_thread_pool_wrapper(xpool = 0x10491f08), line 685 in "tpool.c"
> 
> In Frame 7, mt->mt_mods = 0xdeadbeef. Looks like libumem caught a post-free()
> access.

Looks like someone else got to the end of the modifications list and 
destroyed everything...

p.