Created attachment 1262854 [details]
pstack.

Created attachment 1263342 [details]
second pstack

Thanks for the logs, I now understand when this is happening and I can reproduce

the leak comes from managing the min csn in the ruv, which is set when a replica receives the first change for its replicaid.

in the logs we see:
[04/Apr/2017:15:25:15.102326426 +0300] conn=18 op=2 MOD dn="o=ipaca"
[04/Apr/2017:15:25:15.141517718 +0300] conn=18 op=2 RESULT err=20 tag=103 nentries=0 etime=0 csn=58e39de9000104a10000

which is failing. If I setup a replica and apply as a first change an operation which is failing I can reproduce the hang

yes, it fixes my testcase. 

But did you adopt the patch to 1.3.5 ? the error log functions are different

Hi,

I had to create a new diff because the original one was not applying but it's the same:

@@ -3670,6 +3670,7 @@ abort_csn_callback(const CSN *csn, void 
         int rc = csnplRemove(r->min_csn_pl, csn);
         if (rc) {
             slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "csnplRemove failed");
+            replica_unlock(r->repl_lock);
             return;
         }
     }

(In reply to German Parente from comment #23)
> Hi,
> 
> I had to create a new diff because the original one was not applying but
> it's the same:
> 
> @@ -3670,6 +3670,7 @@ abort_csn_callback(const CSN *csn, void 
>          int rc = csnplRemove(r->min_csn_pl, csn);
>          if (rc) {
>              slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "csnplRemove
> failed");
> +            replica_unlock(r->repl_lock);
>              return;
>          }
>      }

perfect

*** Bug 1442799 has been marked as a duplicate of this bug. ***

*** Bug 1435710 has been marked as a duplicate of this bug. ***

Build tested:
389-ds-base-1.3.6.1-13.el7.x86_64
ipa-server-4.5.0-10.el7.x86_64

Verification steps:
1. Install IPA server on one machine
2. Install IPA replica on another machine.
ipa-replica-install should be successful:
[root@vm-idm-003 ~]# ipa-replica-install
WARNING: conflicting time&date synchronization service 'chronyd' will
be disabled in favor of ntpd

Password for admin.ENG.BOS.REDHAT.COM:
Run connection check to master
Connection check OK

[...]

Upgrading IPA:. Estimated time: 1 minute 30 seconds
  [1/9]: stopping directory server
  [2/9]: saving configuration
  [3/9]: disabling listeners
  [4/9]: enabling DS global lock
  [5/9]: starting directory server
  [6/9]: upgrading server
  [7/9]: stopping directory server
  [8/9]: restoring configuration
  [9/9]: starting directory server
Done.
Restarting the KDC

3. Check ipa.service status:
[root@vm-idm-003 ~]# systemctl status ipa
● ipa.service - Identity, Policy, Audit
   Loaded: loaded (/usr/lib/systemd/system/ipa.service; enabled; vendor preset: disabled)
   Active: active (exited) since Tue 2017-05-09 15:44:40 IST; 55min ago
  Process: 1293 ExecStart=/usr/sbin/ipactl start (code=exited, status=0/SUCCESS)
 Main PID: 1293 (code=exited, status=0/SUCCESS)

[...]

May 09 15:44:40 vm-idm-003.lab.eng.pnq.redhat.com systemd[1]: Started Identity, Policy, Audit.
Hint: Some lines were ellipsized, use -l to show in full.


Result. IPA replica was successfully installed and no deadlock has happened.
Marking as verified.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2086

If this bug requires doc text for errata release, please set the 'Doc Type' and provide draft text according to the template in the 'Doc Text' field. The documentation team will review, edit, and approve the text.

If this bug does not require doc text, please set the 'requires_doc_text' flag to '-'.