From 2136ba8dd18e72bfbe037517c10187bfe695628f Mon Sep 17 00:00:00 2001 From: Thierry Bordaz Date: Thu, 24 May 2018 15:36:34 +0200 Subject: [PATCH] Ticket 49768 - Under network intensive load persistent search can erronously decrease connection refcnt Bug Description: If a connection enters in turbo mode (because of high traffic) or a worker reads several requests in the read buffer (more_data), the thread keeps processing connection. In that condition it should not decrease the refcnt. In case the operation is a persistent search, it decreases systematically the refcnt. So refcnt can become lower than the actual number of threads active on the connection. Most of the time it can create messages like Attempt to release connection that is not acquired In some rare case, if the a connection is out of the active list but a remaining thread tries to remove it again it can lead to a crash Fix Description: The fix consist, when processing a PS, to decrease the refcnt at the condition the connection is not in turbo mode or in more_data. https://pagure.io/389-ds-base/issue/49768 Reviewed by: Mark Reynolds Platforms tested: F26 Flag Day: no Doc impact: no --- ldap/servers/slapd/connection.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c index c54e7c26c..1dbb49f06 100644 --- a/ldap/servers/slapd/connection.c +++ b/ldap/servers/slapd/connection.c @@ -1811,9 +1811,17 @@ connection_threadmain() slapi_counter_increment(ops_completed); /* If this op isn't a persistent search, remove it */ if (op->o_flags & OP_FLAG_PS) { - PR_EnterMonitor(conn->c_mutex); - connection_release_nolock(conn); /* psearch acquires ref to conn - release this one now */ - PR_ExitMonitor(conn->c_mutex); + /* Release the connection (i.e. decrease refcnt) at the condition + * this thread will not loop on it. + * If we are in turbo mode (dedicated to that connection) or + * more_data (continue reading buffered req) this thread + * continues to hold the connection + */ + if (!thread_turbo_flag && !more_data) { + PR_EnterMonitor(conn->c_mutex); + connection_release_nolock(conn); /* psearch acquires ref to conn - release this one now */ + PR_ExitMonitor(conn->c_mutex); + } /* ps_add makes a shallow copy of the pb - so we * can't free it or init it here - just set operation to NULL. * ps_send_results will call connection_remove_operation_ext to free it -- 2.17.1