(ITS#8514) segfault for large entries

[steffen.hofmann@fu-berlin.de]

Full_Name: Steffen Hofmann
Version: 2.4.44
OS: Debian 3.16.36-1+deb8u1
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (91.65.185.225)


When searching large entries (e.g. >65kb) slapd segfaults.

from log:
ber_flush2 failed errno=11 reason="Resource temporarily unavailable"

from strace:
816254 write(9, "<deleted content>"..., 105957) = 67160
816254 write(9, "<deleted content>"..., 38797) = -1 EAGAIN (Resource temporarily
unavailable)
816254 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR,
si_addr=0x7efd4f9438d0} ---

from coredump:
#0  0x00002aaec12318d0 in ?? ()
#1  0x000000000044d2d7 in slap_writewait_play (op=0x2aafb41041b0) at
result.c:294
#2  send_ldap_ber (op=op@entry=0x2aafb41041b0, ber=ber@entry=0x2aafaeca3000) at
result.c:367
#3  0x0000000000450550 in slap_send_search_entry (op=0x2aafb41041b0,
rs=0x2aafaee34a70) at result.c:1430
#4  0x00000000004d135b in mdb_search (op=<oimimized out>, rs=0x2aafaee34a70) at
search.c:1086
#5  0x00000000004a2f4d in overlay_op_walk (op=0x2aafb41041b0, rs=0x2aafaee34a70,
which=op_search, oi=0x1907760, on=0x0) at backover.c:677
#6  0x00000000005a83e2 in slapi_op_func (op=0x2aafb41041b0, rs=0x2aafaee334c0)
at slapi_overlay.c:650
#7  0x00000000004a2f0a in overlay_op_walk (op=op@entry=0x2aafb41041b0,
rs=0x2aafaee34a70, which=op_search, oi=0x1907760, on=0x1907940) at
backover.c:661
#8  0x00000000004a3087 in over_op_func (op=0x2aafb41041b0, rs=<optimized out>,
which=which@entry=op_search) at backover.c:730
#9  0x00000000004a31aa in over_op_search (op=<optimized out>, rs=<optimized
out>) at backover.c:757
#10 0x00000000004414aa in fe_op_search (op=0x2aafb41041b0, rs=0x2aafaee34a70) at
search.c:402
#11 0x00000000004a2f4d in overlay_op_walk (op=op@entry=0x2aafb41041b0,
rs=0x2aafaee34a70, which=op_search, oi=0x18a1430, on=0x0) at backover.c:677
#12 0x00000000004a3087 in over_op_func (op=0x2aafb41041b0, rs=<optimized out>C C
which=which@entry=op_search) at backover.c:730
#13 0x00000000004a31aa in over_op_search (op=<optimized out>, rs=<optimized
out>) at backover.c:757
#14 0x000000000044100c in do_search (op=0x2aafb41041b0, rs=0x2aafaee34a70) at
search.c:247
#15 0x000000000043eca6 in connection_operation (ctx=ctx@entry=0x2aafaee34b90,
arg_v=arg_v@entry=0x2aafb41041b0) at connection.c:1158
#16 0x000000000043fa4b in connection_read_thread (ctx=0x2aafaee34b90, argv=0x9)
at connection.c:1294
#17 0x0000000000570293 in ldap_int_thread_pool_wrapper (xpool=0x184bd30) at
tpool.c:696
#18 0x00002aaebcc360a4 in start_thread () from
/lib/x86_64-linux-gnu/libpthread.so.0
#19 0x00002aaebcf3362d in clone () from /lib/x86_64-linux-gnu/libc.so.6
(gdb) up
#1  0x000000000044d2d7 in slap_writewait_play (op=0x2aafb41041b0) at
result.c:294
294                             sc->sc_writewait( op, sc );
(gdb) list
289     {
290             slap_callback   *sc = op->o_callback;
291
292             for ( ; sc; sc = sc->sc_next ) {
293                     if ( sc->sc_writewait )
294                             sc->sc_writewait( op, sc );
295             }
296     }
297
298     static long send_ldap_ber(

I think, the change that cause the error was made with the new function
slap_writewait_play in the version 2.4.40 in servers/slapd/result.c

I hope it is helpful.

Steffen