Issue 8472 - slapd killed after ldapadd
Summary: slapd killed after ldapadd
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: 2.4.44
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-02 11:30 UTC by dominik.spychalski@googlemail.com
Modified: 2019-07-24 18:59 UTC (History)
0 users

See Also:


Attachments
gdb.txt (9.53 KB, text/plain)
2017-07-14 09:02 UTC, Russell Knighton
Details

Note You need to log in before you can comment on or make changes to this issue.
Description dominik.spychalski@googlemail.com 2016-08-02 11:30:33 UTC
Full_Name: Dominik Spychalski
Version: 2.4.44
OS: Ubuntu 14.04
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (141.12.66.96)


When trying to delete the olcDbIndex-Entry (to add it afterwards with additional
indexes) in olcDatabase={1}mdb,cn=config:

dn: olcDatabase={1}mdb,cn=config
changeType: modify
delete: olcDbIndex

ldapadd -x -D cn=config -w *** -f del.ldif

the slapd process gets killed with the error message:

57a08182 ch_calloc of 1 elems of 0 bytes failed
slapd: ch_malloc.c:107: ch_calloc: Assertion `0' failed.

If I try to add an additional olcDbIndex with other values, everything works
fine.
Comment 1 Quanah Gibson-Mount 2017-03-17 20:30:45 UTC
moved from Incoming to Software Bugs
Comment 2 Russell Knighton 2017-07-14 09:02:06 UTC
Hi Support

It appears I have just manage to hit the exact same issue as Dominik
here. I have attached a back-trace for this issue to this email:
gdb.txt (though I'm not sure how ITS will handle an attachment - will
repost if necessary).

---------------------------------------------
Command as it was used/run:
---------------------------------------------
ldapmodify -Z -D cn=admin,dc=sk,dc=lan -w[redacted] -H ldapi:///
dn: olcDatabase={1}mdb,cn=config
delete: olcDbIndex

modifying entry "olcDatabase={1}mdb,cn=config"
ldap_result: Can't contact LDAP server (-1)

----------------------------------------------------------------------------------------------
Debug function call trace from the exact moment LDAP aborted:
----------------------------------------------------------------------------------------------
59687dbf connection_get(22): got connid=1002
59687dbf connection_read(22): checking for input on id=1002
ber_get_next
ber_get_next: tag 0x30 len 58 contents:
59687dbf op tag 0x66, time 1500020159
ber_get_next
59687dbf conn=1002 op=2 do_modify
ber_scanf fmt ({m) ber:
ber_scanf fmt ({e{m[W]}}) ber:
59687dbf >>> dnPrettyNormal: <olcDatabase={1}mdb,cn=config>
59687dbf <<< dnPrettyNormal: <olcDatabase={1}mdb,cn=config>,
<olcDatabase={1}mdb,cn=config>
59687dbf >>> dnNormalize: <cn=sysadmin,ou=groups,dc=sk,dc=lan>
59687dbf <<< dnNormalize: <cn=sysadmin,ou=groups,dc=sk,dc=lan>
59687dbf mdb_dn2entry("cn=sysadmin,ou=groups,dc=sk,dc=lan")
59687dbf => mdb_dn2id("cn=sysadmin,ou=groups,dc=sk,dc=lan")
59687dbf <= mdb_dn2id: got id=0xf
59687dbf => mdb_entry_decode:
59687dbf <= mdb_entry_decode
59687dbf mdb_entry_get: rc=0
59687dbf >>> dnNormalize: <cn=sys-replication,ou=system,dc=sk,dc=lan>
59687dbf <<< dnNormalize: <cn=sys-replication,ou=system,dc=sk,dc=lan>
59687dbf mdb_dn2entry("cn=sys-replication,ou=system,dc=sk,dc=lan")
59687dbf => mdb_dn2id("cn=sys-replication,ou=system,dc=sk,dc=lan")
59687dbf <= mdb_dn2id: got id=0x9
59687dbf => mdb_entry_decode:
59687dbf <= mdb_entry_decode
59687dbf mdb_entry_get: rc=16
59687dbf syncprov_matchops: sid 002 fscope 1 rc 6
59687dbf oc_check_required entry (olcDatabase={1}mdb,cn=config),
objectClass "olcMdbConfig"
59687dbf oc_check_allowed type "objectClass"
59687dbf oc_check_allowed type "olcDatabase"
59687dbf oc_check_allowed type "olcDbDirectory"
59687dbf oc_check_allowed type "olcSuffix"
59687dbf oc_check_allowed type "olcAccess"
59687dbf oc_check_allowed type "olcLastMod"
59687dbf oc_check_allowed type "olcLimits"
59687dbf oc_check_allowed type "olcRootDN"
59687dbf oc_check_allowed type "olcRootPW"
59687dbf oc_check_allowed type "olcSyncrepl"
59687dbf oc_check_allowed type "olcMirrorMode"
59687dbf oc_check_allowed type "olcDbCheckpoint"
59687dbf oc_check_allowed type "olcDbMaxSize"
59687dbf oc_check_allowed type "structuralObjectClass"
59687dbf oc_check_allowed type "entryUUID"
59687dbf oc_check_allowed type "creatorsName"
59687dbf oc_check_allowed type "createTimestamp"
59687dbf oc_check_allowed type "entryCSN"
59687dbf oc_check_allowed type "modifiersName"
59687dbf oc_check_allowed type "modifyTimestamp"
59687dbf ch_calloc of 1 elems of 0 bytes failed
slapd: ../../../../servers/slapd/ch_malloc.c:107: ch_calloc: Assertion
`0' failed.
Aborted

----------------------
Exact Version:
----------------------
@(#) $OpenLDAP: slapd  (Ubuntu) (May 30 2017 19:20:53) $
    buildd@lgw01-18:/build/openldap-JXEADB/openldap-2.4.42+dfsg/debian/build/servers/slapd

Hope this all helps to diagnose the issue and get a fix out for it. I
appreciate that the version I have is not the latest, but I have seen
nothing in the Changelogs of the latest versions to suggest that a
newer version could actually fix this, and besides, Dominik
experienced the issue in a newer release already (2.4.44)

Full_name: Russell Knighton
Version: 2.4.42
OS: Ubuntu 16.04

-- 
Russell Knighton (Systems Administrator)
SamKnows Ltd, 135 Park St., London, SE1 9EA
Comment 3 Ondřej Kuzník 2017-07-14 14:58:09 UTC
On Fri, Jul 14, 2017 at 09:02:18AM +0000, russell@samknows.com wrote:
> 59687dbf ch_calloc of 1 elems of 0 bytes failed
> slapd: ../../../../servers/slapd/ch_malloc.c:107: ch_calloc: Assertion
> `0' failed.
> Aborted

If no indexes remain, mdb_attr_dbs_open calls ch_calloc(1, 0), but
ch_malloc/ch_calloc do not expect that.

I'd fix ch_calloc/ch_malloc, but depends whether that's the right thing
to do, is it intentional to assert when a zero size is requested?
ber_memalloc has an assert there if LDAP_MEMORY_DEBUG has the second bit
set. Hallvard, Howard?

If it's fine to change the ch_ functions, then a patch is available at
ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170714-ITS-8472.patch

-- 
Ondřej Kuzník
Senior Software Engineer
Symas Corporation                       http://www.symas.com
Packaged, certified, and supported LDAP solutions powered by OpenLDAP

Comment 4 Howard Chu 2017-07-14 15:18:03 UTC
ondra@mistotebe.net wrote:
> On Fri, Jul 14, 2017 at 09:02:18AM +0000, russell@samknows.com wrote:
>> 59687dbf ch_calloc of 1 elems of 0 bytes failed
>> slapd: ../../../../servers/slapd/ch_malloc.c:107: ch_calloc: Assertion
>> `0' failed.
>> Aborted
> 
> If no indexes remain, mdb_attr_dbs_open calls ch_calloc(1, 0), but
> ch_malloc/ch_calloc do not expect that.
> 
> I'd fix ch_calloc/ch_malloc, but depends whether that's the right thing
> to do, is it intentional to assert when a zero size is requested?

Yes.

> ber_memalloc has an assert there if LDAP_MEMORY_DEBUG has the second bit
> set. Hallvard, Howard?
> 
> If it's fine to change the ch_ functions, then a patch is available at
> ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170714-ITS-8472.patch

No.

In this case, back-mdb never expects the number of indexed attributes to be 
zero. (At the least, objectclass must always have an equality index.) back-mdb 
can be patched to avoid this particular crash. But as a rule, you're expected 
to make all changes to the index config in a single Modify op. Not delete all 
the indices in one operation, and then define new indices in a new operation.

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

Comment 5 Howard Chu 2019-01-25 18:12:57 UTC
changed notes
changed state Open to Test
Comment 6 Quanah Gibson-Mount 2019-01-31 23:48:05 UTC
changed notes
changed state Test to Release
Comment 7 OpenLDAP project 2019-07-24 18:59:44 UTC
fixed in master
fixed in RE24 (2.4.48)
Comment 8 Quanah Gibson-Mount 2019-07-24 18:59:44 UTC
changed notes
changed state Release to Closed