(ITS#8350) lmdb SIGBUS error on full partition and possible double free issue

[jeremiah.morrill@econnect.tv]

Full_Name: Jeremiah Morrill
Version: 0.9
OS: Linux (Ubuntu14)
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (70.173.183.164)


Two possible issues.  Semi-related.

The first:
On a full storage partition, when creating a new database, I get a SIGBUS.  I
believe it is caused by the locks successfully mmap()ing, but not really having
the storage to back it.  I hacked in a "posix_fallocate" to make sure the
storage space is there and it appeared to fix it.  I have no idea what the
unintended consequences of this change may be.

Here is the diff:

 void
@@ -4863,6 +4868,14 @@ mdb_env_setup_locks(MDB_env *env, char *lpath, int mode,
int *excl)
 		void *m = mmap(NULL, rsize, PROT_READ|PROT_WRITE, MAP_SHARED,
 			env->me_lfd, 0);
 		if (m == MAP_FAILED) goto fail_errno;
+    	
+    	rc = posix_fallocate(env->me_lfd, 0, rsize);
+    	
+    	if (rc) {
+        	munmap(m, rsize);
+        	goto fail;
+    	}
+    	
 		env->me_txns = m;
 #endif
 	}


I'm not sure if this next one is an issue or just incorrect usage on my part. 
So take with a grain of salt.  

After getting an EIO (deliberate out of storage space) from a mdb_txn_commit,
the transaction would be mdb_txn_abort()ed. I then would close then env which
would get a SIGABORT from a double-free on the env_close0 with env->txn0.

The hack I put in there to avoid this was in the mdb_txn_end.  I check if txn ==
env->me_txn0, and if it is, to set env->me_txn0 to NULL.

Here's the diff:

@@ -3244,12 +3244,17 @@ mdb_txn_end(MDB_txn *txn, unsigned mode)
 		}
 		pthread_mutex_unlock(&env->me_rpmutex);
 		tl[0].mid = 0;
-		if (mode & MDB_END_FREE)
+    	if (mode & MDB_END_FREE)
 			free(tl);
 	}
 #endif
-	if (mode & MDB_END_FREE)
-		free(txn);
+    if (mode & MDB_END_FREE) {
+        /* avoid double free on env close */
+        if(txn == env->me_txn0){
+            env->me_txn0 = NULL;
+        }
+        free(txn);
+    }
 }