Bug 1431207

Summary: ns-slapd killed by SIGABRT
Product: Red Hat Enterprise Linux 7 Reporter: Viktor Ashirov <vashirov>
Component: 389-ds-baseAssignee: wibrown <wibrown>
Status: CLOSED ERRATA QA Contact: Viktor Ashirov <vashirov>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: 7.4CC: mreynolds, nhosoi, nkinder, rmeggins
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 389-ds-base-1.3.6.1-5.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-08-01 21:14:10 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
stacktrace.txt
none
coredump.bz2 none

Description Viktor Ashirov 2017-03-10 15:23:51 UTC 
Created attachment 1261952 [details]
stacktrace.txt

Description of problem:

ns-slapd crashes during full acceptance tests:

{   "signal": 6
,   "executable": "/usr/sbin/ns-slapd"
,   "stacktrace":
      [ {   "crash_thread": true
        ,   "frames":
              [ {   "address": 139733868061175
                ,   "build_id": "ad449ea6ef65b63d5b5ab55d67bd5750de19f0e4"
                ,   "build_id_offset": 217591
                ,   "function_name": "raise"
                ,   "file_name": "/usr/lib64/libc-2.17.so"
                }
              , {   "address": 139733868067048
                ,   "build_id": "ad449ea6ef65b63d5b5ab55d67bd5750de19f0e4"
                ,   "build_id_offset": 223464
                ,   "function_name": "abort"
                ,   "file_name": "/usr/lib64/libc-2.17.so"
                }
              , {   "address": 139733868322631
                ,   "build_id": "ad449ea6ef65b63d5b5ab55d67bd5750de19f0e4"
                ,   "build_id_offset": 479047
                ,   "function_name": "__libc_message"
                ,   "file_name": "/usr/lib64/libc-2.17.so"
                }
              , {   "address": 139733868353049
                ,   "build_id": "ad449ea6ef65b63d5b5ab55d67bd5750de19f0e4"
                ,   "build_id_offset": 509465
                ,   "function_name": "_int_free"
                ,   "file_name": "/usr/lib64/libc-2.17.so"
                }
              , {   "address": 139733910099041
                ,   "build_id": "e5d8782e2fcfaf259b364a8a58ca0480b64c79b6"
                ,   "build_id_offset": 349281
                ,   "function_name": "slapi_ch_free"
                ,   "file_name": "/usr/lib64/dirsrv/libslapd.so.0.1.0"
                }
              , {   "address": 139733910670130
                ,   "build_id": "e5d8782e2fcfaf259b364a8a58ca0480b64c79b6"
                ,   "build_id_offset": 920370
                ,   "function_name": "vattr_map_entry_free"
                ,   "file_name": "/usr/lib64/dirsrv/libslapd.so.0.1.0"
                }
              , {   "address": 139733910670173
                ,   "build_id": "e5d8782e2fcfaf259b364a8a58ca0480b64c79b6"
                ,   "build_id_offset": 920413
                ,   "function_name": "vattr_he_cleanup_fn"
                ,   "file_name": "/usr/lib64/dirsrv/libslapd.so.0.1.0"
                }
              , {   "address": 139733885201264
                ,   "build_id": "f64ea169c894416678f317e4024f07e5c5c152e7"
                ,   "build_id_offset": 7024
                ,   "function_name": "PL_HashTableEnumerateEntries"
                ,   "file_name": "/usr/lib64/libplds4.so"
                }
              , {   "address": 139733910668370
                ,   "build_id": "e5d8782e2fcfaf259b364a8a58ca0480b64c79b6"
                ,   "build_id_offset": 918610
                ,   "function_name": "vattr_cleanup"
                ,   "file_name": "/usr/lib64/dirsrv/libslapd.so.0.1.0"
                }
              , {   "address": 139733919729662
                ,   "build_id": "39b96c47cbdd971adc9af682b2dff62198f7e540"
                ,   "build_id_offset": 75774
                ,   "function_name": "main"
                ,   "file_name": "/usr/sbin/ns-slapd"
                } ]
        } ]
}

Full stacktrace is attached.


Version-Release number of selected component (if applicable):
389-ds-base-1.3.6.1-1.el7.x86_64

How reproducible:
always

Steps to Reproduce:
It's not clear which test triggers the crash, it happens at shutdown. 

Looks like it was introduced by https://pagure.io/389-ds-base/c/0e48cdf2cd6d1566a7734ce5569274a8dc2bf90d
Comment 2 Viktor Ashirov 2017-03-10 15:27:00 UTC 
Created attachment 1261953 [details]
coredump.bz2
Comment 4 wibrown@redhat.com 2017-03-13 00:58:06 UTC 
I think I need a test to help with this. It looks like something is putting a stack value into the vattr map, which triggers the abort on free. (can't free off the stack).

If we have a test to reproduce this, that would make this a lot easier to track down and resolve, but I can see how the memory leak fixes would resolve this.

The issue is we shouldn't just roll back this fix because we have a lot of leaks, and we need these fixes. It's just a pain that we found it so late :(
Comment 5 mreynolds 2017-03-27 18:37:45 UTC 
Is this fixed? I don't see an upstream ticket?
Comment 6 Viktor Ashirov 2017-03-28 14:05:23 UTC 
I can't reproduce it with the new build. Looks like coverity fixes helped.
Comment 8 Viktor Ashirov 2017-04-06 11:20:32 UTC 
Build tested:
389-ds-base-1.3.6.1-6.el7.x86_64

No crashes were observed with this build, marking as VERIFIED.
Comment 9 errata-xmlrpc 2017-08-01 21:14:10 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2086