This service will be undergoing maintenance at 00:00 UTC, 2016-09-28. It is expected to last about 1 hours
Bug 240553 - vsftpd has a create/lock race condition which corrupts uploads
vsftpd has a create/lock race condition which corrupts uploads
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: vsftpd (Show other bugs)
5.0
All Linux
medium Severity medium
: ---
: ---
Assigned To: Martin Nagy
: Patch
: 432526 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-05-18 09:06 EDT by Martin Poole
Modified: 2016-07-26 19:46 EDT (History)
5 users (show)

See Also:
Fixed In Version: RHSA-2008-0295
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-05-21 10:16:39 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
patch to handle write race condition on simultaneous upload (1.57 KB, patch)
2007-05-18 09:06 EDT, Martin Poole
no flags Details | Diff
new patch to handle write race condition (2.22 KB, patch)
2007-11-29 03:43 EST, Martin Nagy
no flags Details | Diff

  None (edit)
Description Martin Poole 2007-05-18 09:06:11 EDT
+++ This bug was initially created as a clone of Bug #240550 +++

Description of problem:

There is a race condition in the open/lock code which is triggered when two
clients upload to the same file. The lock is only obtained after the file is
opened and in the case of the second client to causes the client to hang until
the first client completes. The problem is that both opens are performed with
O_TRUNC | O_APPEND which in the second client's case truncates the first
client's progress to that point. Once the first client completes and releases
the lock the second client then appends to whatever the first client uploaded
after the second client performed the open.  This results in a file which is
neither one thing nor the other.

Version-Release number of selected component (if applicable):

vsftpd-2.0.5-10.el5

How reproducible:

Always.

Steps to Reproduce:
1. Simultaneously upload different files from 2 clients to same file on server
2.
3.
  
Actual results:

Uploaded file is combination of tail of first client + second file.

Expected results:

One or the other file.

Additional info:

best reproduced by using large files or limiting upload rate.

-- Additional comment from mpoole@redhat.com on 2007-05-18 08:55 EST --
Created an attachment (id=154992)
patch to handle write race condition on simultaneous upload
Comment 1 Martin Poole 2007-05-18 09:06:12 EDT
Created attachment 154994 [details]
patch to handle write race condition on simultaneous upload
Comment 4 Martin Nagy 2007-11-29 03:43:25 EST
Created attachment 272591 [details]
new patch to handle write race condition

This patch also respects read lock on the file that is being overwritten.
Comment 5 Michal Nowak 2007-11-30 04:21:15 EST
Use RHTS test case
       /CoreOS/vsftpd/regressions/testbug_para_upload
for testing.
Comment 6 RHEL Product and Program Management 2007-12-03 15:42:53 EST
This request was evaluated by Red Hat Product Management for
inclusion, but this component is not scheduled to be updated in
the current Red Hat Enterprise Linux release.  This request will
be reviewed for a future Red Hat Enterprise Linux release.
Comment 7 Martin Nagy 2007-12-04 07:32:10 EST
Fixed in fedora/rawhide (vsftpd-2.0.5-21.fc9).
Comment 8 Martin Nagy 2007-12-06 15:40:23 EST
Re-proposing for 5.2 since vsftpd was approved for 5.2.
Comment 9 RHEL Product and Program Management 2007-12-06 15:45:53 EST
This request was evaluated by Red Hat Product Management for
inclusion, but this component is not scheduled to be updated in
the current Red Hat Enterprise Linux release.  This request will
be reviewed for a future Red Hat Enterprise Linux release.
Comment 10 RHEL Product and Program Management 2007-12-07 10:34:34 EST
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.
Comment 12 Martin Nagy 2007-12-12 03:23:05 EST
This will be fixed in vsftpd-2.0.5-10.el5
Comment 13 Martin Nagy 2007-12-12 05:09:03 EST
Correction:
This will be fixed in vsftpd-2.0.5-11.el5
Comment 17 Martin Nagy 2008-02-12 12:50:38 EST
*** Bug 432526 has been marked as a duplicate of this bug. ***
Comment 18 Brock Noland 2008-02-28 11:21:42 EST
I don't think your patch is fixing the actual problem. The actual problem is
that vsftp is opening the file incorrectly. It should not be using the O_TRUNC
and O_APPEND flags. See my fix in Bug 432526.

int
vsf_sysutil_create_overwrite_file(const char* p_filename)
{
  return open(p_filename, O_CREAT | O_TRUNC | O_WRONLY |
                          O_APPEND | O_NONBLOCK,
              tunable_file_open_mode);
}

Comment 19 errata-xmlrpc 2008-05-21 10:16:39 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2008-0295.html
Comment 20 Issue Tracker 2008-05-21 20:44:59 EDT
Closing based on latest errata. Please re-open if necessary.

Internal Status set to 'Resolved'
Status set to: Closed by Tech
Resolution set to: 'RHEL 5.2'

This event sent from IssueTracker by balkov 
 issue 120992

Note You need to log in before you can comment on or make changes to this bug.