Blame SOURCES/httpd-2.4.34-CVE-2019-0211.patch

a68583
diff --git a/include/scoreboard.h b/include/scoreboard.h
a68583
index 57cf3df..b714a8c 100644
a68583
--- a/include/scoreboard.h
a68583
+++ b/include/scoreboard.h
a68583
@@ -143,7 +143,9 @@ struct process_score {
a68583
     apr_uint32_t lingering_close;   /* async connections in lingering close */
a68583
     apr_uint32_t keep_alive;        /* async connections in keep alive */
a68583
     apr_uint32_t suspended;         /* connections suspended by some module */
a68583
-    int bucket;             /* Listener bucket used by this child */
a68583
+    int bucket;  /* Listener bucket used by this child; this field is DEPRECATED
a68583
+                  * and no longer updated by the MPMs (i.e. always zero).
a68583
+                  */
a68583
 };
a68583
 
a68583
 /* Scoreboard is now in 'local' memory, since it isn't updated once created,
a68583
diff --git a/server/mpm/event/event.c b/server/mpm/event/event.c
a68583
index f07b757..16e39be 100644
a68583
--- a/server/mpm/event/event.c
a68583
+++ b/server/mpm/event/event.c
a68583
@@ -2670,7 +2670,6 @@ static int make_child(server_rec * s, int slot, int bucket)
a68583
 
a68583
     ap_scoreboard_image->parent[slot].quiescing = 0;
a68583
     ap_scoreboard_image->parent[slot].not_accepting = 0;
a68583
-    ap_scoreboard_image->parent[slot].bucket = bucket;
a68583
     event_note_child_started(slot, pid);
a68583
     active_daemons++;
a68583
     retained->total_daemons++;
a68583
@@ -2709,6 +2708,7 @@ static void perform_idle_server_maintenance(int child_bucket, int num_buckets)
a68583
          * that threads_per_child is always > 0 */
a68583
         int status = SERVER_DEAD;
a68583
         int child_threads_active = 0;
a68583
+        int bucket = i % num_buckets;
a68583
 
a68583
         if (i >= retained->max_daemons_limit &&
a68583
             free_length == retained->idle_spawn_rate[child_bucket]) {
a68583
@@ -2732,7 +2732,7 @@ static void perform_idle_server_maintenance(int child_bucket, int num_buckets)
a68583
                  */
a68583
                 if (status <= SERVER_READY && !ps->quiescing && !ps->not_accepting
a68583
                     && ps->generation == retained->mpm->my_generation
a68583
-                    && ps->bucket == child_bucket)
a68583
+                    && bucket == child_bucket)
a68583
                 {
a68583
                     ++idle_thread_count;
a68583
                 }
a68583
@@ -2743,7 +2743,9 @@ static void perform_idle_server_maintenance(int child_bucket, int num_buckets)
a68583
             last_non_dead = i;
a68583
         }
a68583
         active_thread_count += child_threads_active;
a68583
-        if (!ps->pid && free_length < retained->idle_spawn_rate[child_bucket])
a68583
+        if (!ps->pid
a68583
+                && bucket == child_bucket
a68583
+                && free_length < retained->idle_spawn_rate[child_bucket])
a68583
             free_slots[free_length++] = i;
a68583
         else if (child_threads_active == threads_per_child)
a68583
             had_healthy_child = 1;
a68583
@@ -2926,13 +2928,14 @@ static void server_main_loop(int remaining_children_to_start, int num_buckets)
a68583
                 retained->total_daemons--;
a68583
                 if (processed_status == APEXIT_CHILDSICK) {
a68583
                     /* resource shortage, minimize the fork rate */
a68583
-                    retained->idle_spawn_rate[ps->bucket] = 1;
a68583
+                    retained->idle_spawn_rate[child_slot % num_buckets] = 1;
a68583
                 }
a68583
                 else if (remaining_children_to_start) {
a68583
                     /* we're still doing a 1-for-1 replacement of dead
a68583
                      * children with new children
a68583
                      */
a68583
-                    make_child(ap_server_conf, child_slot, ps->bucket);
a68583
+                    make_child(ap_server_conf, child_slot,
a68583
+                               child_slot % num_buckets);
a68583
                     --remaining_children_to_start;
a68583
                 }
a68583
             }
a68583
diff --git a/server/mpm/prefork/prefork.c b/server/mpm/prefork/prefork.c
a68583
index 3fb3284..4517f88 100644
a68583
--- a/server/mpm/prefork/prefork.c
a68583
+++ b/server/mpm/prefork/prefork.c
a68583
@@ -637,8 +637,9 @@ static void child_main(int child_num_arg, int child_bucket)
a68583
 }
a68583
 
a68583
 
a68583
-static int make_child(server_rec *s, int slot, int bucket)
a68583
+static int make_child(server_rec *s, int slot)
a68583
 {
a68583
+    int bucket = slot % retained->mpm->num_buckets;
a68583
     int pid;
a68583
 
a68583
     if (slot + 1 > retained->max_daemons_limit) {
a68583
@@ -716,7 +717,6 @@ static int make_child(server_rec *s, int slot, int bucket)
a68583
         child_main(slot, bucket);
a68583
     }
a68583
 
a68583
-    ap_scoreboard_image->parent[slot].bucket = bucket;
a68583
     prefork_note_child_started(slot, pid);
a68583
 
a68583
     return 0;
a68583
@@ -732,7 +732,7 @@ static void startup_children(int number_to_start)
a68583
         if (ap_scoreboard_image->servers[i][0].status != SERVER_DEAD) {
a68583
             continue;
a68583
         }
a68583
-        if (make_child(ap_server_conf, i, i % retained->mpm->num_buckets) < 0) {
a68583
+        if (make_child(ap_server_conf, i) < 0) {
a68583
             break;
a68583
         }
a68583
         --number_to_start;
a68583
@@ -741,8 +741,6 @@ static void startup_children(int number_to_start)
a68583
 
a68583
 static void perform_idle_server_maintenance(apr_pool_t *p)
a68583
 {
a68583
-    static int bucket_make_child_record = -1;
a68583
-    static int bucket_kill_child_record = -1;
a68583
     int i;
a68583
     int idle_count;
a68583
     worker_score *ws;
a68583
@@ -789,6 +787,7 @@ static void perform_idle_server_maintenance(apr_pool_t *p)
a68583
     }
a68583
     retained->max_daemons_limit = last_non_dead + 1;
a68583
     if (idle_count > ap_daemons_max_free) {
a68583
+        static int bucket_kill_child_record = -1;
a68583
         /* kill off one child... we use the pod because that'll cause it to
a68583
          * shut down gracefully, in case it happened to pick up a request
a68583
          * while we were counting
a68583
@@ -819,10 +818,7 @@ static void perform_idle_server_maintenance(apr_pool_t *p)
a68583
                     idle_count, total_non_dead);
a68583
             }
a68583
             for (i = 0; i < free_length; ++i) {
a68583
-                bucket_make_child_record++;
a68583
-                bucket_make_child_record %= retained->mpm->num_buckets;
a68583
-                make_child(ap_server_conf, free_slots[i],
a68583
-                           bucket_make_child_record);
a68583
+                make_child(ap_server_conf, free_slots[i]);
a68583
             }
a68583
             /* the next time around we want to spawn twice as many if this
a68583
              * wasn't good enough, but not if we've just done a graceful
a68583
@@ -867,7 +863,7 @@ static int prefork_run(apr_pool_t *_pconf, apr_pool_t *plog, server_rec *s)
a68583
 
a68583
     if (one_process) {
a68583
         AP_MONCONTROL(1);
a68583
-        make_child(ap_server_conf, 0, 0);
a68583
+        make_child(ap_server_conf, 0);
a68583
         /* NOTREACHED */
a68583
         ap_assert(0);
a68583
         return !OK;
a68583
@@ -976,8 +972,7 @@ static int prefork_run(apr_pool_t *_pconf, apr_pool_t *plog, server_rec *s)
a68583
                     /* we're still doing a 1-for-1 replacement of dead
a68583
                      * children with new children
a68583
                      */
a68583
-                    make_child(ap_server_conf, child_slot,
a68583
-                               ap_get_scoreboard_process(child_slot)->bucket);
a68583
+                    make_child(ap_server_conf, child_slot);
a68583
                     --remaining_children_to_start;
a68583
                 }
a68583
 #if APR_HAS_OTHER_CHILD
a68583
diff --git a/server/mpm/worker/worker.c b/server/mpm/worker/worker.c
a68583
index 7804efc..79b2769 100644
a68583
--- a/server/mpm/worker/worker.c
a68583
+++ b/server/mpm/worker/worker.c
a68583
@@ -1311,7 +1311,6 @@ static int make_child(server_rec *s, int slot, int bucket)
a68583
         worker_note_child_lost_slot(slot, pid);
a68583
     }
a68583
     ap_scoreboard_image->parent[slot].quiescing = 0;
a68583
-    ap_scoreboard_image->parent[slot].bucket = bucket;
a68583
     worker_note_child_started(slot, pid);
a68583
     return 0;
a68583
 }
a68583
@@ -1360,6 +1359,7 @@ static void perform_idle_server_maintenance(int child_bucket, int num_buckets)
a68583
         int any_dead_threads = 0;
a68583
         int all_dead_threads = 1;
a68583
         int child_threads_active = 0;
a68583
+        int bucket = i % num_buckets;
a68583
 
a68583
         if (i >= retained->max_daemons_limit &&
a68583
             totally_free_length == retained->idle_spawn_rate[child_bucket]) {
a68583
@@ -1392,7 +1392,7 @@ static void perform_idle_server_maintenance(int child_bucket, int num_buckets)
a68583
                 if (status <= SERVER_READY &&
a68583
                         !ps->quiescing &&
a68583
                         ps->generation == retained->mpm->my_generation &&
a68583
-                        ps->bucket == child_bucket) {
a68583
+                        bucket == child_bucket) {
a68583
                     ++idle_thread_count;
a68583
                 }
a68583
                 if (status >= SERVER_READY && status < SERVER_GRACEFUL) {
a68583
@@ -1402,6 +1402,7 @@ static void perform_idle_server_maintenance(int child_bucket, int num_buckets)
a68583
         }
a68583
         active_thread_count += child_threads_active;
a68583
         if (any_dead_threads
a68583
+                && bucket == child_bucket
a68583
                 && totally_free_length < retained->idle_spawn_rate[child_bucket]
a68583
                 && free_length < MAX_SPAWN_RATE / num_buckets
a68583
                 && (!ps->pid               /* no process in the slot */
a68583
@@ -1587,14 +1588,15 @@ static void server_main_loop(int remaining_children_to_start, int num_buckets)
a68583
                 ps->quiescing = 0;
a68583
                 if (processed_status == APEXIT_CHILDSICK) {
a68583
                     /* resource shortage, minimize the fork rate */
a68583
-                    retained->idle_spawn_rate[ps->bucket] = 1;
a68583
+                    retained->idle_spawn_rate[child_slot % num_buckets] = 1;
a68583
                 }
a68583
                 else if (remaining_children_to_start
a68583
                     && child_slot < ap_daemons_limit) {
a68583
                     /* we're still doing a 1-for-1 replacement of dead
a68583
                      * children with new children
a68583
                      */
a68583
-                    make_child(ap_server_conf, child_slot, ps->bucket);
a68583
+                    make_child(ap_server_conf, child_slot,
a68583
+                               child_slot % num_buckets);
a68583
                     --remaining_children_to_start;
a68583
                 }
a68583
             }