Hi,
I would like to report a hideous bug.
We have a series of small Linux servers (mostly openSUSE 11.4 - vanilla kernel 2.6.35.13). They have avast4server 3.2.1 / libavastengine 4.7.6 installed.
We launch avastvpsupdate.sh every 3 hours via cron... and after some days of uptime (60-90 days) we have problems with semaphores (max numbers of semaphore identifiers reached, so apache or postgresql do not start).
This is because the semaphores are allocated by dead PIDs. We discovered that they all belongs to instances of "avastvpsreload".
Here is an example list (output of ipcs -s)
key semid owner perms nsems
0x0052e2c1 131072 postgres 600 17
0x5002db17 43155457 root 666 3
0x5002db23 26116098 root 666 3
0x0052e2c2 163843 postgres 600 17
0x0052e2c3 196612 postgres 600 17
0x0052e2c4 229381 postgres 600 17
0x0052e2c5 262150 postgres 600 17
0x0052e2c6 294919 postgres 600 17
0x0052e2c7 327688 postgres 600 17
0x0052e2c8 360457 postgres 600 17
0x0052e2c9 393226 postgres 600 17
0x0052e2ca 425995 postgres 600 17
0x0052e2cb 458764 postgres 600 17
0x0052e2cc 491533 postgres 600 17
0x0052e2cd 524302 postgres 600 17
0x50024b97 949911567 root 666 3
0x50022489 1488191504 root 666 3
0x5002dad2 851985 root 666 3
0x50021b3c 1710456850 root 666 3
0x5002dafc 1896513555 root 666 3
0x5002dae5 13533204 root 666 3
0x5002db15 2009464853 root 666 3
0x5002f341 2001010710 root 666 3
0x50021c26 28409879 root 666 3
0x5002510d 40861720 root 666 3
0x5002f929 962002969 root 666 3
0x5002f921 2023063578 root 666 3
0x5002dadc 90374171 root 666 3
0x5002f94c 830144540 root 666 3
0x5002db38 106430493 root 666 3
0x5002f394 95092766 root 666 3
0x5002db0a 103841823 root 666 3
0x5002db3b 109936672 root 666 3
0x5002db3c 1101987873 root 666 3
0x5002f603 2017263650 root 666 3
0x5002e15d 2026307619 root 666 3
0x5002dfae 2028601380 root 666 3
0x5002db36 914849829 root 666 3
0x5002db39 833224742 root 666 3
0x5002f4b0 1378648103 root 666 3
0x50020a5e 1438482472 root 666 3
0x5002f95d 1474658345 root 666 3
0x5002f4a6 1732739114 root 666 3
0x5002f6ec 1837432875 root 666 3
0x5002f92b 1942749228 root 666 3
0x5002f98e 536838189 root 666 3
0x50021b16 1350860846 root 666 3
0x50021c30 1389396015 root 666 3
0x5002f9bc 1279230000 root 666 3
0x50021ce5 1437499441 root 666 3
0x50021bed 6422578 root 666 3
0x50021e4a 1535508531 root 666 3
0x5002fa1b 1584594996 root 666 3
0x5002fa03 1500348469 root 666 3
0x50021dda 1632108598 root 666 3
0x500221b0 1728708663 root 666 3
0x50021db0 1669234744 root 666 3
0x500228e5 1765212217 root 666 3
0x50021d0e 1824358458 root 666 3
0x50021bf8 1874591803 root 666 3
0x5002f9b5 1921548348 root 666 3
0x50021ae7 1969029181 root 666 3
0x50022423 2005434430 root 666 3
0x5002220c 2054848575 root 666 3
0x50022435 2115272768 root 666 3
0x50021cc2 2017427521 root 666 3
0x50022bdb 1522925634 root 666 3
0x50022abc 64913475 root 666 3
0x50022e14 100827204 root 666 3
0x5002fa02 159383621 root 666 3
0x50022e03 207159366 root 666 3
0x50022a93 401604679 root 666 3
0x50022a82 437059656 root 666 3
0x50022be3 507052105 root 666 3
0x50021af7 543424586 root 666 3
0x50022b35 588972107 root 666 3
0x50021f95 1329299532 root 666 3
0x50022ba0 1376878669 root 666 3
0x50022ef5 1425899598 root 666 3
0x50022a89 1473642575 root 666 3
0x500235b0 29065296 root 666 3
0x50022b78 1568243793 root 666 3
0x50021f43 1615265874 root 666 3
0x50022bec 1670676563 root 666 3
0x50022c59 1705836628 root 666 3
0x500220c7 1761280085 root 666 3
0x50022bc5 1785004118 root 666 3
0x50022a7f 1852866647 root 666 3
0x50022e4c 1888452696 root 666 3
0x50022ba7 1934295129 root 666 3
0x50022af3 1969455194 root 666 3
0x50022ad7 2029060187 root 666 3
0x500232a5 2066841692 root 666 3
0x50022bc6 2127462493 root 666 3
0x50023551 714866782 root 666 3
0x50022b08 88014943 root 666 3
0x50022b4c 136413280 root 666 3
0x50023158 171245665 root 666 3
0x50022ce2 207618146 root 666 3
0x50023205 266305635 root 666 3
0x50022b8d 314933348 root 666 3
0x5002328d 361824357 root 666 3
0x50023277 398753894 root 666 3
0x50022e1f 458621031 root 666 3
0x50023274 506101864 root 666 3
0x50022cca 565837929 root 666 3
0x5002347b 614957162 root 666 3
0x5002fa29 651231339 root 666 3
0x50023a6e 1377140844 root 666 3
0x50021d89 761987181 root 666 3
0x500238d3 787710062 root 666 3
0x50023777 845807727 root 666 3
0x500238f5 893026416 root 666 3
0x50023bf6 939655281 root 666 3
0x50022c61 977207410 root 666 3
0x5002328c 1059324019 root 666 3
0x50023278 1143832692 root 666 3
0x500235ba 1180762229 root 666 3
0x50023628 1240629366 root 666 3
0x50022d83 1278673015 root 666 3
0x50023e74 1327202424 root 666 3
0x5002340b 1436450938 root 666 3
0x50022d0d 1461780603 root 666 3
0x50023d19 1990426748 root 666 3
0x50023976 2039185533 root 666 3
If we inspect one of those semaphores allocated by root with ipcs -s -i SEMID -p:
Semaphore Array semid=1278673015
uid=0 gid=0 cuid=0 cgid=0
mode=0666, access_perms=0666
nsems = 3
otime = Sun Aug 21 00:00:11 2011
ctime = Sun Aug 21 00:00:11 2011
semnum value ncount zcount pid
0 1 0 0 6793
1 0 0 0 6793
2 0 0 0 6793
PID 6793 is an instance of avastvpsreload, executed on Sun Aug 21, that ran successfully, but closed without cleaning semaphores! (here are the logs):
Aug 21 00:00:11 avastvpsreload[6793]: info: Using the avast! virus signature database reloader for '/var/lib/avast4/400.vps' file
Aug 21 00:00:11 avastvpsreload[6793]: info: uploaded '/var/lib/avast4/400.vps' VPS file
Aug 21 00:00:11 avastvpsreload[6793]: info: started reloading the VPS 110820-1 (date: 20.08.2011)
This semaphore leak does not seem to happen on every update, but on the long run, it can lead to the allocation of the max semid number (usually 128) and lock the server! When this happens, in fact, no software that needs semaphores can run (e.g. apache or posgresql).
Thanks in advance
Andrea Cascio
Nucleus srl
