Hanging processes with Linux Security 11.00 on RHEL/CentOS 7.x - F-Secure Community
<main> <article class="userContent"> <p> </p>Hanging processes with Linux Security 11.00 on RHEL/CentOS 7.x <h3>Symptoms </h3> <p>Linux Security 11.00 on RHEL/CentOS 7.x causes processes to hang when on-access scanning is turned on. The system log warns about one or more processes being blocked for more than 120 seconds. </p> <h3>Diagnosis </h3> <p>The Linux kernel version (3.10) used by RHEL/CentOS 7.x suffers from a subtle but serious bug that has been fixed in later kernel versions. </p> <p>Specifically, the function <strong>fanotify_merge()</strong> has a faulty logic that replaces <strong>fsnotify_event</strong> when <strong>test_event->refcnt</strong> is <strong>2</strong>. The original <strong>test_event</strong> is replaced with a clone and then removed from the notification queue. If the original <strong>test_event</strong> was carrying an <strong>OPEN_PERM</strong> event, it has no chance of being woken up again because only the clone of the event will get a response. </p> <h3>Solution </h3> <p>The bug has been fixed in RHEL/CentOS 7.x. Simply run </p> <p></p><pre class="code codeBlock" spellcheck="false">yum update</pre> <p>to get a current kernel (3.10.0-327.36.1.el7 or later) and reboot. </p> </article> </main>
