radiusd deadlock on recvfrom on port 1814

[Ryan Melendez]

Hey,

I've had FreeRADIUS Version 1.1.0 hang twice recently.  The core dumps
are very similar in that it appears that main is waiting on some stuff
from port 1814.  Honestly I don't know what 1814 is really for (proxy
port?) but it seems as if fd_isset says so we should expect some data on
that socket.  Unless something _else_ had already received that data.

I hadn't noticed this before I added radrelay and another radiusd
process on the same box.  Both radiusd processes are bound to different
virtual interfaces and radrelay is duplicating acct packets from one to
the other.  It's not obvious why there would be a race condition on that
socket, but my guess is something is going on there.  It seems as though
both radiusd processes are using the same descriptors for each of their
three sockets.  I've included some debug info from the core files.

Is this a know bug or can it be fixed with a configuration change?



Thanks,
Ryan
----------------------------------------------------------------------
Process One:
(gdb) print *(rad_listen_t *) mainconfig.listen
$1 = {next = 0x458023e8, ipaddr = 486477016, type = RAD_LISTEN_AUTH,
port = 1812, fd = 3}
(gdb) print *(rad_listen_t *) mainconfig.listen->next
$2 = {next = 0x4580eef8, ipaddr = 486477016, type = RAD_LISTEN_ACCT,
port = 1813, fd = 4}
(gdb) print *(rad_listen_t *) mainconfig.listen->next->next
$3 = {next = 0x0, ipaddr = 486477016, type = RAD_LISTEN_PROXY, port =
1814, fd = 5}

Process Two:
gdb) print *(rad_listen_t *) mainconfig.listen
$2 = {next = 0x8117fe0, ipaddr = 1459555544, type = RAD_LISTEN_AUTH,
port = 1812, fd = 3}
(gdb) print *(rad_listen_t *) mainconfig.listen->next
$3 = {next = 0x8117ff8, ipaddr = 1459555544, type = RAD_LISTEN_ACCT,
port = 1813, fd = 4}
(gdb) print *(rad_listen_t *) mainconfig.listen->next->next
$4 = {next = 0x0, ipaddr = 1459555544, type = RAD_LISTEN_PROXY, port =
1814, fd = 5}

Process One:
(gdb) info threads
* 6 process 11191  0x0804d145 in main (argc=1166077688, argv=0xbfffd0c0)
at radiusd.c:1323
  5 process 19865  0x401c8d0b in sem_wait at GLIBC_2.0 ()
from /lib/tls/libpthread.so.0
  4 process 19864  0x401c8d0b in sem_wait at GLIBC_2.0 ()
from /lib/tls/libpthread.so.0
  3 process 19863  0x401c8d0b in sem_wait at GLIBC_2.0 ()
from /lib/tls/libpthread.so.0
  2 process 19862  0x401c8d0b in sem_wait at GLIBC_2.0 ()
from /lib/tls/libpthread.so.0
  1 process 19861  0x401c8d0b in sem_wait at GLIBC_2.0 ()
from /lib/tls/libpthread.so.0
(gdb) bt
#0  0x401c99fe in recvfrom () from /lib/tls/libpthread.so.0
#1  0x4004e6d1 in rad_recv (fd=5) at radius.c:1044
#2  0x0804d145 in main (argc=1166077688, argv=0xbfffd0c0) at
radiusd.c:1323
(gdb) print *(rad_listen_t *) listener
$22 = {next = 0x0, ipaddr = 486477016, type = RAD_LISTEN_PROXY, port =
1814, fd = 5}
(gdb) frame 1
#1  0x4004e6d1 in rad_recv (fd=5) at radius.c:1044
1044    radius.c: No such file or directory.
        in radius.c
(gdb) info locals
packet = (RADIUS_PACKET *) 0x4780dc38
saremote = {sin_family = 0, sin_port = 0, sin_addr = {s_addr = 0},
sin_zero = "\000\000\000\000\000\000\000"}
totallen = 263
salen = 16
attr = (uint8_t *) 0x0
count = -1073758352
host_ipaddr = "\000\000\000\000��������۾\005\b"
seen_eap = 0
data = "stuff"...
--