From dcc711bee68b301e4541b8bd8b15d6a735ce6a10 Mon Sep 17 00:00:00 2001 From: Thierry Bordaz Date: Wed, 16 May 2018 16:21:40 +0200 Subject: [PATCH] Ticket 49693 - A DB_DEADLOCK while adding a tombstone (RUV) leads to access of an already freed entry Bug Description: During a ADD, in order to manage DB_DEADLOCK, instead of using the entry provided in the pblock (i.e. 'e') the code uses a couple addingentry/originalentry. Only in the initial attempt addingentry refers to 'e', in the others it refers to a duplicate one. On DB_DEADLOCK, the entry is freed immediately (as it was not in the cache) if we hit a DB_DEADLOCK then 'e' is freed and the next attempt is with a duplicate of 'e'. But if the added entry is a tombstone we log a message dumping 'e', unfortunately 'e' was already freed. Fix Description: Use addingentry->ep_entry instead of 'e'. Also as it is for logging, test if the logging level is set before dumping the entry. https://pagure.io/389-ds-base/issue/49693 Reviewed by: ? Platforms tested: F26 Flag Day: no Doc impact: no --- ldap/servers/slapd/back-ldbm/ldbm_add.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ldap/servers/slapd/back-ldbm/ldbm_add.c b/ldap/servers/slapd/back-ldbm/ldbm_add.c index 412e1d394..5660cfbc8 100644 --- a/ldap/servers/slapd/back-ldbm/ldbm_add.c +++ b/ldap/servers/slapd/back-ldbm/ldbm_add.c @@ -905,10 +905,10 @@ ldbm_back_add(Slapi_PBlock *pb) goto error_return; } } - if (is_tombstone_operation) { + if (is_tombstone_operation && slapi_is_loglevel_set(SLAPI_LOG_DEBUG)) { int len = 0; const char *rs = slapi_entry_get_rdn_const(addingentry->ep_entry); - char *es= slapi_entry2str_with_options(e, &len, SLAPI_DUMP_STATEINFO | SLAPI_DUMP_UNIQUEID); + char *es= slapi_entry2str_with_options(addingentry->ep_entry, &len, SLAPI_DUMP_STATEINFO | SLAPI_DUMP_UNIQUEID); slapi_log_err(SLAPI_LOG_DEBUG, "ldbm_back_add", "now adding entry: %s\n %s\n", rs?rs:"no rdn", es); slapi_ch_free_string(&es); } -- 2.13.6