From 970711fde95bee3de1e4a5e0b557c3132d0c3e3f Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com>

Date: Tue, 6 Feb 2018 11:39:01 +0100

Subject: [PATCH 59/59] Fix SEGFAULT when running in a container as PID 1

When vsftpd is running in a container as PID 1, it is possible

that it will get SIGCHILD for processes, which were not directly

created by it, but by some of its children. These processes will

not be in the s_p_pid_ip_hash hash table, and thus trying to

delete the entry from the hash table in standalone.c:handle_sigchld()

will result in segmentation fault.

I can quite easily reproduce it with the upstream vsftpd and default

configuration, except for isolate=NO and isolate_network=NO being set

(it seems to me that network namespaces take a long time to create

and destroy, which hides the race condition), on a quad-core machine.

When connecting to vsftpd in a loop like this:

$ while true; do echo -en '' | nc localhost 21; done

vsftpd crashes after a couple of seconds.

---

 standalone.c | 18 +++++++++++++-----

 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/standalone.c b/standalone.c

index 3b65ea2..3f35e9e 100644

--- a/standalone.c

+++ b/standalone.c

@@ -270,13 +270,21 @@ handle_sigchld(void* duff)

     if (reap_one)

     {

       struct vsf_sysutil_ipaddr* p_ip;

-      /* Account total number of instances */

-      --s_children;

-      /* Account per-IP limit */

       p_ip = (struct vsf_sysutil_ipaddr*)

         hash_lookup_entry(s_p_pid_ip_hash, (void*)&reap_one);

-      drop_ip_count(p_ip);      

-      hash_free_entry(s_p_pid_ip_hash, (void*)&reap_one);

+      /* If we are running in a container as PID 1, it is possible

+       * that we will get SIGCHILD for processes, which were not

+       * created directly by our process and which are not in the

+       * s_p_pid_ip_hash hash table.

+       */

+      if (p_ip)

+      {

+        /* Account total number of instances */

+        --s_children;

+        /* Account per-IP limit */

+        drop_ip_count(p_ip);

+        hash_free_entry(s_p_pid_ip_hash, (void*)&reap_one);

+      }

     }

   }

 }

-- 

2.14.4