(ITS#7151) slapd segfaults when terminated

[jvcelak@redhat.com]

Full_Name: Jan Vcelak
Version: 2.4.29 - git ad04676
OS: Linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (193.165.68.229)


I'm getting a slapd segfault when the server is being terminated.

^C4f2c5f43 daemon: shutdown requested and initiated.
4f2c5f43 daemon: closing 7
4f2c5f43 daemon: closing 8
4f2c5f43 slapd shutdown: waiting for 0 operations/tasks to finish
4f2c5f43 slapd shutdown: initiated
4f2c5f43 ====> bdb_cache_release_all
4f2c5f43 slapd destroy: freeing system resources.
make: *** [run] Segmentation fault

Used configuration:

dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /root/re24/server1/run/slapd.args
olcPidFile: /root/re24/server1/run/slapd.pid

dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib64/openldap

dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema

include: file:///etc/openldap/schema/core.ldif

dn: olcDatabase=config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: config
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
 n=auth" manage by * none

dn: olcDatabase={1}bdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcBdbConfig
olcDatabase: bdb
olcSuffix: dc=redhat,dc=bug
olcRootDN: cn=Manager,dc=redhat,dc=bug
olcRootPW: secret
olcDbDirectory: /root/re24/server1/db
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub

Backtrace:

#0  __GI___libc_free (mem=0x185) at malloc.c:2972
        ar_ptr = <optimized out>
        p = <optimized out>
        hook = 0
#1  0x0000555555727d29 in ber_memfree_x (p=0x185, ctx=0x0) at
../../../libraries/liblber/memory.c:152
        __PRETTY_FUNCTION__ = "ber_memfree_x"
#2  0x00007ffff489220a in ldap_int_destroy_global_options () at
../../../libraries/libldap/init.c:496
        gopts = 0x5555559bcfc0
#3  0x00007ffff7df0b1e in _dl_close_worker (map=map@entry=0x555555a811b0) at
dl-close.c:266
        array = 0x7ffff4abe630
        sz = 1
        imap = 0x555555a816c0
        i = <optimized out>
        dl_close_state = pending
        nsid = 0
        ns = 0x7ffff7ffd000
        any_tls = false
        nloaded = 28
        used = '\001' <repeats 24 times>, "\000\000\000\001"
        done = '\001' <repeats 24 times>, "\000\000\000\001"
        maps = {0x7ffff7ffe2a8, 0x7ffff7ffe838, 0x7ffff7ffa658, 0x7ffff7ffab20,
0x7ffff7ff3000, 0x7ffff7ff34d0, 0x7ffff7ff3998, 0x7ffff7ff2000, 0x7ffff7ff24c8,
0x7ffff7ff2990, 0x7ffff7ff1000, 0x7ffff7ff14d0, 0x7ffff7ff1998, 0x7ffff7ff0000,
0x7ffff7ff04c8, 0x7ffff7ff0990, 0x7ffff7fef000, 0x7ffff7fef4c8, 0x7ffff7fef990,
0x7ffff7fee000, 0x7ffff7fee528, 0x7ffff7ffd998, 0x7ffff7fed000, 0x555555a48f30,
0x555555a811b0, 0x555555a816c0, 0x555555a81bd0, 0x555555ac3420}
        idx = <optimized out>
        done_index = <optimized out>
        do_audit = false
        unload_any = <optimized out>
        scope_mem_left = <optimized out>
        unload_global = <optimized out>
        first_loaded = <optimized out>
        r = <optimized out>
        tls_free_start = <optimized out>
        tls_free_end = <optimized out>
#4  0x00007ffff7df151e in _dl_close (_map=0x555555a811b0) at dl-close.c:770
        map = 0x555555a811b0
#5  0x00007ffff7debb66 in _dl_catch_error (objname=0x555555a81160,
errstring=0x555555a81168, mallocedp=0x555555a81158, operate=0x7ffff55660d0
<dlclose_doit>, args=0x555555a811b0) at dl-error.c:178
        errcode = 0
        old = 0x0
        c = {objname = 0x7ffff76100d8 "X\a", errstring = 0x0, malloced = 251,
env = {{__jmpbuf = {93824997658960, -5310358512699590611, 93824997659056,
140737488348192, 0, 0, -5310372595880576979, -5310355285852702675},
__mask_was_saved = -142437680, __saved_mask = {__val = {0, 140737488348192, 0,
0, 93824997688544, 140737351954868, 5, 0, 4116075984, 140737351954868,
93824997690256, 93824997688544, 140737345918272, 140737351980421, 0,
93824997571648}}}}}
        catchp = 0x7ffff7fe9738
#6  0x00007ffff556662c in _dlerror_run (operate=operate@entry=0x7ffff55660d0
<dlclose_doit>, args=0x555555a811b0) at dlerror.c:164
        result = 0x555555a81150
#7  0x00007ffff55660ff in __dlclose (handle=<optimized out>) at dlclose.c:48
No locals.
#8  0x00007ffff76220e1 in _sasl_done_with_plugins () at dlopen.c:541
        libptr = 0x555555a81130
        libptr_next = 0x0
#9  0x00007ffff7619ffb in sasl_done () at common.c:674
No locals.
#10 0x0000555555624d25 in slap_sasl_destroy () at
../../../servers/slapd/sasl.c:1190
No locals.
#11 0x00005555555eebf0 in slap_destroy () at ../../../servers/slapd/init.c:249
        rc = 0
#12 0x000055555558129f in main (argc=6, argv=0x7fffffffe428) at
../../../servers/slapd/main.c:1033
        i = 6
        no_detach = 1
        rc = 0
        urls = 0x555555a480b0 "ldap://ldapserver1.redhat.bug:1389
ldaps://ldapserver1.redhat.bug:1636"
        username = 0x0
        groupname = 0x0
        sandbox = 0x0
        syslogUser = 160
        pid = 32767
        waitfds = {-166376544, 32767}
        g_argc = 6
        g_argv = 0x7fffffffe428
        configfile = 0x0
        configdir = 0x555555a48090 "slapd.d"
        serverName = 0x7fffffffe6bd "slapd"
        serverMode = 1
        scp = 0x0
        scp_entry = 0x0
        debug_unknowns = 0x0
        syslog_unknowns = 0x0
        serverNamePrefix = 0x55555572b818 ""
        l = 1
        slapd_pid_file_unlink = 1
        slapd_args_file_unlink = 1
        firstopt = 0
        __PRETTY_FUNCTION__ = "main"
  Id   Target Id         Frame 
* 1    Thread 0x7ffff7fe9740 (LWP 15364) "slapd" 0x000055555558129f in main
(argc=6, argv=0x7fffffffe428) at ../../../servers/slapd/main.c:1033

OpenLDAP from tag OPENLDAP_REL_ENG_2_4_29
(ad0467699d9054e32a5530e93e28bd4194344d3d), probably also present in previous
versions.

Fedora 17 x86_64, cyrus-sasl-2.1.23-28.fc17.x86_64