Bug 1444947 - Deadlock between topology and schema-compat plugins
Summary: Deadlock between topology and schema-compat plugins
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.4
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Pavel Picka
QA Contact: Pavel Picka
Depends On:
TreeView+ depends on / blocked
Reported: 2017-04-24 15:15 UTC by Petr Vobornik
Modified: 2017-08-01 09:50 UTC (History)
7 users (show)

Fixed In Version: ipa-4.5.0-9.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-08-01 09:50:15 UTC
Target Upstream Version:

Attachments (Terms of Use)
output (1.94 KB, text/plain)
2017-06-08 12:00 UTC, Pavel Picka
no flags Details

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2304 normal SHIPPED_LIVE ipa bug fix and enhancement update 2017-08-01 12:41:35 UTC

Description Petr Vobornik 2017-04-24 15:15:22 UTC
Cloned from upstream: https://pagure.io/freeipa/issue/6821

On Fedora 25
freeipa 4.5.git build

The deadlock occurs 20sec after DS startup. A schedule event (topology plugin) creates a 'iparepltoposegment' entry (thread 36):
  ADD "cn=<vm-1>-to-<vm-2>,cn=domain,cn=topology,cn=ipa,cn=etc,<suffix>"

at the same time a new index (numsubordinates) on IPACA is created (thread 35):
   cn=numsubordinates,cn=index,cn=ipaca,cn=ldbm database,cn=plugins,cn=config
   objectclass: top
   objectclass: nsIndex
   cn: numsubordinates
   nsSystemIndex: true
   nsIndexType: pres

The problem is that thread 36 hold DB locks before attempting to acquire schema-compat map lock (to find groups owning the index).

At the same time thread 35 that holds schema-compat map lock does an internal search to retrieve groups owning the segment.
  -b "cn=groups,cn=accounts,<suffix>"  "member=cn=numsubordinates,cn=index,cn=ipaca,cn=ldbm database,cn=plugins,cn=config"

So the deadlock comes from locks taken in the opposite order.

Comment 2 Petr Vobornik 2017-04-24 15:15:40 UTC
Upstream ticket:

Comment 7 Standa Laznicka 2017-06-07 05:51:57 UTC
This is supposed to be sanity-tested - install and see if it works.

Also, you should test that ipa-compat-manage now behaves the same for both root and non-root users regarding enabling, disabling and checking status of the compat plugin.

Comment 8 Pavel Picka 2017-06-08 12:00:02 UTC
Created attachment 1286128 [details]

Verified on ipa-server-4.5.0-14.el7.x86_64

Comment 9 errata-xmlrpc 2017-08-01 09:50:15 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.