sophie deadlock

Martin Zuziak <[email protected]> Thu, 20 Jul 2006 13:45:52 +0200
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Hello all

There seems to be a problem in sophie which leads to a deadlock on
receiving SIGHUP.

The SIGHUP handler does too much work. It calls sophie_print which does
some syslog stuff and calls functions which aren't safe. I'm seeing this
problem every few months on my mail server (Suse Linux 9.2 with a 2.6.8
kernel and glibc-2.3.3) and have reproduced it on Suse 10.1 with a
2.6.16 kernel and glibc-2.4.

If I change the SIGHUP handler to just raise a flag and test on that
flag in the main for-loop the problem goes away.

The other signal handlers also call sophie_print but with 1 as the first
argument. So sophie_print doesn't do anything unless you are running in
debugging mode.

To reproduce, simply set up a loop which continuously scans files and
send sophie SIGHUP. It might take a few tries but never fails to
deadlock sophie. How often this problem will hit a production system of
course depends on sophie's load and how often you send SIGHUP.

Sincerely,

Martin Zuziak <[email protected]>