Issue

What were you trying to do that didn't work? I was trying to run an Apache HTTPD WebDAV server on RHEL 10 using the default multi-threaded event MPM to handle concurrent file uploads (using mod_dav_fs and a DAVLockDB lock database). Under concurrent write/PUT traffic from multiple clients, the web server crashed repeatedly with segmentation faults (SIGSEGV). We have Sev1 case from the customer reporting the same issue. What is the impact of this issue to you? This is a critical blocker. It makes running a concurrent WebDAV server completely impossible on RHEL 10 because normal, parallel client requests trigger child process crashes, leading to a constant service Denial of Service (DoS). Please provide the package NVR for which the bug is seen: httpd-2.4.63-13.el10.x86_64 (and httpd-core-2.4.63-13.el10.x86_64) apr-util-lmdb-1.6.3-21.el10.x86_64 lmdb-0.9.32-4.el10.x86_64 How reproducible is this bug?: Always (100% reproducible under concurrent load matching or exceeding the active thread count). Steps to reproduce Install httpd, mod_dav, mod_dav_fs, and apr-util-lmdb on RHEL 10: dnf install -y httpd apr-util-lmdb Configure a basic WebDAV share under the default event MPM in /etc/httpd/conf.d/dav_reproduce.conf DAVLockDB /var/lib/dav/DAVLock Alias /dav /var/www/html/dav <Directory /var/www/html/dav> DAV On Require all granted </Directory> Set up the directory ownerships and start the service: # mkdir -p /var/www/html/dav /var/lib/dav # chown -R apache:apache /var/www/html/dav /var/lib/dav # systemctl restart httpd Generate concurrent PUT traffic (concurrency of 100) using a parallel loop: # dd if=/dev/urandom of=/tmp/payload bs=1M count=10 # seq 1 1000 | xargs -n 1 -P 100 -I {} curl -s -o /dev/null -X PUT --data-binary @/tmp/payload <http://localhost/dav/file.bin> Expected results The concurrent uploads should complete successfully with a 100% success rate, and the lock database should safely manage parallel locks without crashing. Actual results The httpd child processes crash repeatedly with segmentation faults. The /var/log/httpd/error_log reports: [core:notice] [pid 40934:tid 40934] AH00051: child pid 41647 exit signal Segmentation fault (11), possible coredump in /etc/httpd Analyzing the coredump in gdb shows the crash occurring in __pthread_mutex_lock_full because multiple worker threads in the same process opened their own MDB_env handles on the same file, corrupting LMDB's shared robust mutexes: 1 #0 0x00007fef27635e2b __pthread_mutex_lock_full (libc.so.6 + 0x97e2b) 2 #1 0x00007fef186096a2 mdb_txn_renew0 (liblmdb.so.0.0.0 + 0xd6a2) 3 #2 0x00007fef18609d27 mdb_txn_begin (liblmdb.so.0.0.0 + 0xdd27) 4 #3 0x00007fef26f3251d vt_lmdb_open (apr_dbm_lmdb-1.so + 0x151d) 5 #4 0x00007fef2719a54b dav_dbm_open_direct (mod_dav_fs.so + 0x654b) 6 #5 0x00007fef2719a5f3 dav_fs_really_open_lockdb (mod_dav_fs.so + 0x65f3)

Release Notes

No. of Comments

Resolution

Unresolved