Issue 7797 - crash with slapo-collect with existing attribute
Summary: crash with slapo-collect with existing attribute
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: 2.4.39
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-06 22:59 UTC by danno@umich.edu
Modified: 2015-07-02 17:44 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description danno@umich.edu 2014-02-06 22:59:39 UTC
Full_Name: Dan Pritts
Version: 2.4.39
OS: centos 6.x x64
URL: ftp://ftp.openldap.org/incoming/bugreport-danno-20140206.tgz
Submission from: (NULL) (141.211.81.142)


Hi,

I'm attempting to use slapo-collect.  In actual use I want to combine it with
the translucent overlay, but for the purposes of debugging I am just using a bdb
with local info.

If the collective attribute is defined already in a dn, slapd crashes hard.  

Even with "any" logging enabled, nothing useful appears to be logged.  

I made some small hacks on the nis.schema and core.schema so that the attributes
I want to be "collectives" can be defined on the parent OU's.  (homeDirectory,
loginShell,gecos)

I've uploaded the config file, an ldif i used to populate the db, session output
showing a successful search and a failed one, and the syslog from the deceased
slapd.  

thanks
danno
Comment 1 danno@umich.edu 2014-02-07 23:03:12 UTC
Requested stacktrace is below.

[root@cnsutil0 yum.repos.d]# gdb 
/pub/src/openldap-2.4.39/servers/slapd/slapd
GNU gdb (GDB) Red Hat Enterprise Linux (7.2-60.el6_4.1)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /pub/src/openldap-2.4.39/servers/slapd/slapd...done.
(gdb) run -d 0 -h ldaps:/// -u ldap -f 
/usr/local/pkg/openldap-2.4.39/etc/openldap/slapd-bugreport.conf -n 
slapd-bugreport
Starting program: /pub/src/openldap-2.4.39/servers/slapd/slapd -d 0 -h 
ldaps:/// -u ldap -f 
/usr/local/pkg/openldap-2.4.39/etc/openldap/slapd-bugreport.conf -n 
slapd-bugreport
[Thread debugging using libthread_db enabled]
[New Thread 0x7ffff549d700 (LWP 13453)]
[New Thread 0x7ffff4c9c700 (LWP 13455)]
[New Thread 0x7fffeffff700 (LWP 13456)]
slapd: attr.c:484: attr_merge: Assertion `( nvals == ((void *)0) && 
(*a)->a_nvals == (*a)->a_vals ) || ( nvals != ((void *)0) && ( ( 
(*a)->a_vals == ((void *)0) && (*a)->a_nvals == ((void *)0) ) || ( 
(*a)->a_nvals != (*a)->a_vals ) ) )' failed.

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff4c9c700 (LWP 13455)]
0x00007ffff6c85925 in raise (sig=6) at 
../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
(gdb) bt full
#0 0x00007ffff6c85925 in raise (sig=6) at 
../nptl/sysdeps/unix/sysv/linux/raise.c:64
resultvar = 0
pid = <value optimized out>
selftid = 13455
#1 0x00007ffff6c87105 in abort () at abort.c:92
save_stage = 2
act = {__sigaction_handler = {sa_handler = 0x5a73c0, sa_sigaction = 
0x5a73c0}, sa_mask = {__val = {140737334912189, 140737298668624, 9945192,
140737298668864, 140737333925142, 206158430232, 140737298668880, 
140737298668656, 140737333831240, 206158430256, 140737298668912,
140737085704496, 140737085702200, 0, 8529643138936561962, 
140737488349297}}, sa_flags = -153449043, sa_restorer = 0x6144cc}
sigs = {__val = {32, 0 <repeats 15 times>}}
#2 0x00007ffff6c7ea4e in __assert_fail_base (fmt=<value optimized out>,
assertion=0x5a73c0 "( nvals == ((void *)0) && (*a)->a_nvals == 
(*a)->a_vals ) || ( nvals != ((void *)0) && ( ( (*a)->a_vals == ((void 
*)0) && (*a)->a_nvals == ((void *)0) ) || ( (*a)->a_nvals != 
(*a)->a_vals ) ) )", file=0x6144cc "attr.c", line=<value optimized out>,
function=<value optimized out>) at assert.c:96
str = 0x7fffe8000930 "`\n"
total = 4096
#3 0x00007ffff6c7eb10 in __assert_fail (
assertion=0x5a73c0 "( nvals == ((void *)0) && (*a)->a_nvals == 
(*a)->a_vals ) || ( nvals != ((void *)0) && ( ( (*a)->a_vals == ((void 
*)0) && (*a)->a_nvals == ((void *)0) ) || ( (*a)->a_nvals != 
(*a)->a_vals ) ) )", file=0x6144cc "attr.c", line=484, function=0x5a74a9 
"attr_merge") at assert.c:105
No locals.
#4 0x0000000000429b22 in attr_merge (e=<value optimized out>, 
desc=<value optimized out>, vals=0x7fffe8015010, nvals=0x0) at attr.c:481
i = 0
a = 0xc11ca8
__PRETTY_FUNCTION__ = "attr_merge"
#5 0x0000000000528a9d in collect_response (op=0x7fffe8013b40, 
rs=0x7ffff4c9b950) at collect.c:404
vals = 0x7fffe8015010
idx = <value optimized out>
on = 0x97c680
ci = 0x97c060
#6 0x0000000000484488 in over_back_response (op=0x7fffe8013b40, 
rs=0x7ffff4c9b950) at backover.c:237
oi = <value optimized out>
on = 0x97c680
rc = 32768
be = 0x7ffff4c9a6b0
db = {bd_info = 0x97c4a0, bd_self = 0x97a850,
be_ctrls = 
"\000\000\000\001\001\001\000\001\000\000\001\000\000\001\001\000\001", 
'\000' <repeats 15 times>, "\001", be_flags = 2312,
be_restrictops = 0, be_requires = 0, be_ssf_set = {sss_ssf = 0, 
sss_transport = 0, sss_tls = 0, sss_sasl = 0, sss_update_ssf = 0,
sss_update_transport = 0, sss_update_tls = 0, sss_update_sasl = 0, 
sss_simple_bind = 0}, be_suffix = 0x942590, be_nsuffix = 0x97af80,
be_schemadn = {bv_len = 0, bv_val = 0x0}, be_schemandn = {bv_len = 0, 
bv_val = 0x0}, be_rootdn = {bv_len = 44,
bv_val = 0x97c300 "cn=Manager,dc=adsroot,dc=itd,dc=umich,dc=edu"}, 
be_rootndn = {bv_len = 44,
bv_val = 0x97c360 "cn=manager,dc=adsroot,dc=itd,dc=umich,dc=edu"}, 
be_rootpw = {bv_len = 38,
bv_val = 0x97b200 "{SSHA}RRCj1QvzdwlpWoZPapidy4XLgWUlS+m1"}, 
be_max_deref_depth = 15, be_def_limit = {lms_t_soft = 3600, lms_t_hard = 0,
lms_s_soft = 500, lms_s_hard = 0, lms_s_unchecked = -1, lms_s_pr = 0, 
lms_s_pr_hide = 0, lms_s_pr_total = 0}, be_limits = 0x0,
be_acl = 0x97c180, be_dfltaccess = ACL_READ, be_extra_anlist = 0x0, 
be_update_ndn = {bv_len = 0, bv_val = 0x0}, be_update_refs = 0x0,
be_pending_csn_list = 0xbd9390, be_pcl_mutex = {__data = {__lock = 0, 
__count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0,
__list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 
times>, __align = 0}, be_syncinfo = 0x0, be_pb = 0x0,
be_cf_ocs = 0x84b340, be_private = 0x97a9f0, be_next = {stqe_next = 0x0}}
#7 0x000000000042fa8e in slap_response_play (op=0x7fffe8013b40, 
rs=0x7ffff4c9b950) at result.c:491
sc_next = 0x0
sc_nextp = 0x7ffff4c9a840
rc = 32768
sc = 0x7ffff4c9a840
scp = 0x7ffff4b1a028
#8 0x0000000000431fb8 in slap_send_search_entry (op=0x7fffe8013b40, 
rs=0x7ffff4c9b950) at result.c:995
berbuf = {
buffer = 
"Р\261\364\377\177\000\000\020\023\001\350\377\177\000\000\020\027\301\000\000\000\000\000\243\000\000\000\000\000\000\000\006", 
'\000' <repeats 23 times>"\250, 
M\001\350\377\177\000\000@\241\261\364\377\177\000\000\t", '\000' 
<repeats 20 times>, 
"\001\000\000@;\001\350\377\177\000\000\324e\365R\006\000\000\000\270ؿ\000\000\000\000\000\240M\001\350\377\177\000\000\360\251\227", 
'\000' <repeats 21 times>"\360, 
\251\227\000\000\000\000\000\330M\001\350\377\177\000\000P\271\311\364\377\177\000\000@;\001\350\377\177\000\000\270ؿ\000\000\000\000\000\005\000\000\000\000\000\000\000r\344C", 
'\000' <repeats 13 times>, "\005", '\000' <repeats 38 times>, ialign = 
-189685552, lalign = 140737298669776, falign = -1.12585231e+32,
dalign = 6.9533464361235288e-310, palign = 0x7ffff4b1a0d0 "\020\027\301"}
ber = 0x7ffff4b1a0c0
a = <value optimized out>
i = <value optimized out>
j = <value optimized out>
rc = 0
---Type <return> to continue, or q <return> to quit---
bytes = <value optimized out>
userattrs = <value optimized out>
acl_state = {as_desc = 0x0, as_access = ACL_NONE, as_vd_acl = 0x0, 
as_vd_acl_present = 0, as_vd_acl_count = 0, as_vd_mask = 1,
as_result = -1, as_fe_done = 0}
attrsonly = <value optimized out>
ad_entry = 0x923790
e_flags = 0x0
#9 0x0000000000497160 in bdb_search (op=0x7fffe8013b40, 
rs=0x7ffff4c9b950) at search.c:1014
bois = {boi_oe = {oe_next = {sle_next = 0x0}, oe_key = 0x97a9f0}, 
boi_txn = 0x0, boi_locks = 0x0, boi_err = 0, boi_acl_cache = 0 '\000',
boi_flag = 1 '\001'}
blis = {bli_next = 0x0, bli_lock = {off = 0, ndx = 295, gen = 13, mode = 
DB_LOCK_READ}, bli_id = 5, bli_flag = 0}
scopeok = <value optimized out>
bdb = <value optimized out>
id = 5
cursor = 1
lastid = 18446744073709551615
candidates = {1, 5, 3, 4, 5, 6, 0 <repeats 131066 times>}
scopes = {0 <repeats 64944 times>, 140737085708896, 140737300240256, 6, 
140737300240272, 140737334911689, 140737333785703, 140737334911690,
1, 1, 0, 0, 0, 0, 0, 140737300239984, 0, 140737334911686, 0, 0, 0, 
140737300240092, 140737300240120, 0, 140737300240152, 0, 0, 0,
140737333983582, 140737085708896, 140737300240480, 4294967295, 
140737300240752, 5943820, 140737333785703, 23, 0, 0, 140737300239944, 0, 32,
0, 0, 17638794651555069952, 42949675439, 13446, 0, 140737300239939, 0, 
0, 140737300239939, 0, 140737300239944, 100, 0, 140737334911687, 0,
0, 47244640256, 0 <repeats 24 times>, 5943843, 0, 0, 47244640256, 0 
<repeats 85 times>, 140737334182606, 0, 0, 140737300240085, 0, 0, 2,
140737300240512, 25769803776, 4106852054, 0, 3905804171320334016, 
140737300240086, 140737337225952, 140737300240479, 9405680,
140737300240000, 206158430224, 140737300240496, 140737300240304, 0, 0, 
0, 0, 0, 0, 0, 0, 0, 61787399520256, 0, 0, 140737334911683,
140737085709516, 140737085709516, 140737337227968, 7, 8187, 
140737334178082, 8192, 140733193388032, 140737300240389, 140733193388032,
4106852357, 4294967297, 206158430224, 140737300240976, 140737300240784, 
140737085709488, 85, 140737085702176, 8208, 140737085717696, 8208,
140737334012430, 140737300240304, 8180, 140737085702176, 
140737085709504, 69, 140737085709488, 80, 140737334013397, 
140737337241216, 90, 1,
3892320864, 140733193388056, 140737300240512, 140737300240432, 
3892320864, 24, 140737300240544, 140737300240464, 140737085708896, 11275264,
4294967295, 11, 18446744073709551528, 2050, 16, 1, 5886190, 4294967324, 
140737019656096, 16, 5886457, 0, 18446744073709533616, 9405680, 0,
0, 0, 0, 0, 0, 0, 0, 0, 140737085709504, 0, 0, 68, 140737085709504, 
1391814088, 0, 140737085782848, 12572856...}
e = 0xbfd8b8
base = {e_id = 2, e_name = {bv_len = 8589934592, bv_val = 0x0}, e_nname 
= {bv_len = 42,
bv_val = 0x7fffe80055c0 "ou=umich,dc=adsroot,dc=itd,dc=umich,dc=edu"}, 
e_attrs = 0x0, e_ocflags = 0, e_bv = {bv_len = 0, bv_val = 0x0},
e_private = 0x7fffe4103230}
e_root = <value optimized out>
matched = 0x0
ei = 0x7fffe8004350
attrs = <value optimized out>
realbase = {bv_len = 42, bv_val = 0x7fffe80055c0 
"ou=umich,dc=adsroot,dc=itd,dc=umich,dc=edu"}
mask = <value optimized out>
stoptime = 1391817700
manageDSAit = <value optimized out>
tentries = 1
nentries = 1
idflag = 0
lock = {off = 317176, ndx = 295, gen = 13, mode = DB_LOCK_READ}
opinfo = <value optimized out>
ltid = 0x7fffe8013f00
oex = <value optimized out>
#10 0x0000000000484797 in overlay_op_walk (op=0x7fffe8013b40, 
rs=0x7ffff4c9b950, which=op_search, oi=0x97c4a0, on=0x0) at backover.c:671
func = <value optimized out>
rc = 32768
#11 0x0000000000485177 in over_op_func (op=0x7fffe8013b40, rs=<value 
optimized out>, which=<value optimized out>) at backover.c:723
oi = <value optimized out>
on = <value optimized out>
be = 0x97a850
db = {bd_info = 0x846a80, bd_self = 0x97a850,
be_ctrls = 
"\000\000\000\001\001\001\000\001\000\000\001\000\000\001\001\000\001", 
'\000' <repeats 15 times>, "\001", be_flags = 2312,
be_restrictops = 0, be_requires = 0, be_ssf_set = {sss_ssf = 0, 
sss_transport = 0, sss_tls = 0, sss_sasl = 0, sss_update_ssf = 0,
sss_update_transport = 0, sss_update_tls = 0, sss_update_sasl = 0, 
sss_simple_bind = 0}, be_suffix = 0x942590, be_nsuffix = 0x97af80,
be_schemadn = {bv_len = 0, bv_val = 0x0}, be_schemandn = {bv_len = 0, 
bv_val = 0x0}, be_rootdn = {bv_len = 44,
bv_val = 0x97c300 "cn=Manager,dc=adsroot,dc=itd,dc=umich,dc=edu"}, 
be_rootndn = {bv_len = 44,
bv_val = 0x97c360 "cn=manager,dc=adsroot,dc=itd,dc=umich,dc=edu"}, 
be_rootpw = {bv_len = 38,
bv_val = 0x97b200 "{SSHA}RRCj1QvzdwlpWoZPapidy4XLgWUlS+m1"}, 
be_max_deref_depth = 15, be_def_limit = {lms_t_soft = 3600, lms_t_hard = 0,
lms_s_soft = 500, lms_s_hard = 0, lms_s_unchecked = -1, lms_s_pr = 0, 
lms_s_pr_hide = 0, lms_s_pr_total = 0}, be_limits = 0x0,
be_acl = 0x97c180, be_dfltaccess = ACL_READ, be_extra_anlist = 0x0, 
be_update_ndn = {bv_len = 0, bv_val = 0x0}, be_update_refs = 0x0,
---Type <return> to continue, or q <return> to quit---
be_pending_csn_list = 0xbd9390, be_pcl_mutex = {__data = {__lock = 0, 
__count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0,
__list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 
times>, __align = 0}, be_syncinfo = 0x0, be_pb = 0x0,
be_cf_ocs = 0x84b340, be_private = 0x97a9f0, be_next = {stqe_next = 0x0}}
cb = {sc_next = 0x0, sc_response = 0x484420 <over_back_response>, 
sc_cleanup = 0, sc_private = 0x97c4a0}
sc = <value optimized out>
rc = 32768
__PRETTY_FUNCTION__ = "over_op_func"
#12 0x0000000000422981 in fe_op_search (op=0x7fffe8013b40, 
rs=0x7ffff4c9b950) at search.c:402
bd = 0x853ac0
#13 0x00000000004231ac in do_search (op=0x7fffe8013b40, 
rs=0x7ffff4c9b950) at search.c:247
base = {bv_len = 42, bv_val = 0x7fffe80123c8 
"ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu"}
siz = 9
off = 0
i = <value optimized out>
#14 0x00000000004207c9 in connection_operation (ctx=0x7ffff4c9bab0, 
arg_v=0x7fffe8013b40) at connection.c:1155
rc = 80
cancel = <value optimized out>
op = 0x7fffe8013b40
rs = {sr_type = REP_SEARCH, sr_tag = 0, sr_msgid = 0, sr_err = 0, 
sr_matched = 0x0, sr_text = 0x0, sr_ref = 0x0, sr_ctrls = 0x0, sr_un = {
sru_search = {r_entry = 0xbfd958, r_attr_flags = 17, r_operational_attrs 
= 0x0, r_attrs = 0x7fffe8014e10, r_nentries = 0, r_v2ref = 0x0},
sru_sasl = {r_sasldata = 0xbfd958}, sru_extended = {r_rspoid = 0xbfd958 
"\005", r_rspdata = 0x11}}, sr_flags = 3}
tag = 99
opidx = SLAP_OP_SEARCH
conn = 0xac0c00
memctx = 0x7fffe8013a20
memctx_null = 0x0
memsiz = 1048576
__PRETTY_FUNCTION__ = "connection_operation"
#15 0x0000000000420fe5 in connection_read_thread (ctx=0x7ffff4c9bab0, 
argv=<value optimized out>) at connection.c:1291
rc = <value optimized out>
cri = {op = 0x7fffe8013b40, func = 0, arg = 0x0, ctx = 0x7ffff4c9bab0, 
nullop = <value optimized out>}
s = <value optimized out>
#16 0x0000000000572810 in ldap_int_thread_pool_wrapper (xpool=0x928330) 
at tpool.c:688
pool = 0x928330
task = 0x7ffff0000a20
work_list = <value optimized out>
ctx = {ltu_id = 140737300252416, ltu_key = {{ltk_key = 0x41f4d0, 
ltk_data = 0x7fffe8013910, ltk_free = 0x41f5a0 <conn_counter_destroy>}, {
ltk_key = 0x470780, ltk_data = 0x7fffe8013a20, ltk_free = 0x4707a0 
<slap_sl_mem_destroy>}, {ltk_key = 0x433880, ltk_data = 0x0,
ltk_free = 0x433660 <slap_op_q_destroy>}, {ltk_key = 0xbd93b0, ltk_data 
= 0x7fffe8013f00, ltk_free = 0x4d6d00 <bdb_reader_free>}, {
ltk_key = 0x4950d0, ltk_data = 0x7fffee7fe010, ltk_free = 0x4951a0 
<search_stack_free>}, {ltk_key = 0x0, ltk_data = 0x0,
ltk_free = 0} <repeats 24 times>, {ltk_key = 0x0, ltk_data = 
0x7ffff6fef06a, ltk_free = 0}, {ltk_key = 0x0, ltk_data = 0x0,
ltk_free = 0}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0}}}
kctx = <value optimized out>
keyslot = 258
hash = <value optimized out>
__PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper"
#17 0x00007ffff6fee9d1 in start_thread (arg=0x7ffff4c9c700) at 
pthread_create.c:301
__res = <value optimized out>
pd = 0x7ffff4c9c700
now = <value optimized out>
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140737300252416, 
-8145800067874208241, 140737308634272, 140737300253120, 0, 3,
8145785136454125071, 8145780284905833999}, mask_was_saved = 0}}, priv = 
{pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0,
cleanup = 0x0, canceltype = 0}}}
not_first_call = <value optimized out>
pagesize_m1 = <value optimized out>
sp = <value optimized out>
freesize = <value optimized out>
#18 0x00007ffff6d3bb6d in clone () at 
../sysdeps/unix/sysv/linux/x86_64/clone.S:115
No locals.

Comment 2 Ondřej Kuzník 2014-09-23 20:12:09 UTC
On Fri, Feb 07, 2014 at 11:04:06PM +0000, danno@umich.edu wrote:
> Requested stacktrace is below.

Hi,                                                                                                                                                                                                 
I've uploaded a fix to
ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20140923-ITS-7797.patch
could you confirm it fixes the issue for you?

Cheers,
Ondrej

Comment 3 Howard Chu 2014-12-12 01:35:59 UTC
changed notes
changed state Open to Test
moved from Incoming to Software Bugs
Comment 4 Quanah Gibson-Mount 2014-12-12 19:42:39 UTC
changed notes
changed state Test to Release
Comment 5 OpenLDAP project 2015-07-02 17:44:53 UTC
fixed in master
fixed in RE25
fixed in RE24
Comment 6 Quanah Gibson-Mount 2015-07-02 17:44:53 UTC
changed notes
changed state Release to Closed