Bug 1889 - bug in packet.c sometimes cause segfault
Summary: bug in packet.c sometimes cause segfault
Status: CLOSED WONTFIX
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 6.2p1
Hardware: All All
: P2 normal
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks: V_6_3
  Show dependency treegraph
 
Reported: 2011-04-15 19:49 AEST by jchadima
Modified: 2015-08-11 23:05 AEST (History)
5 users (show)

See Also:


Attachments
patch solving the problem (498 bytes, patch)
2011-04-15 19:50 AEST, jchadima
no flags Details | Diff
new patch (841 bytes, patch)
2011-04-21 06:27 AEST, jchadima
no flags Details | Diff
patch solving the problem (498 bytes, patch)
2011-04-21 06:33 AEST, jchadima
no flags Details | Diff
Backtrace for openssh 6.2p1 (382 bytes, text/plain)
2013-12-20 19:51 AEDT, Alexander Zaytsev
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description jchadima 2011-04-15 19:49:16 AEST
There is an assumption that active_state is assigned before calling packet_connection_is_on_socket. Sometimes (early crashes) it is not true.
Comment 1 jchadima 2011-04-15 19:50:35 AEST
Created attachment 2028 [details]
patch solving the problem
Comment 2 jchadima 2011-04-21 06:27:42 AEST
Created attachment 2032 [details]
new patch

The new approach how to solve the selinux problem.
Comment 3 jchadima 2011-04-21 06:33:09 AEST
Created attachment 2033 [details]
patch solving the problem

the patch change was by mistake ... bad bz#
the original patch fits the problem
Comment 4 Damien Miller 2011-05-06 10:55:09 AEST
How can we reproduce these crashes? I'd prefer to fix the underlying problem by ensuring things are initialised correctly to retuning potentially wrong information from packet_connection_is_on_socket().
Comment 5 jchadima 2011-05-06 21:20:22 AEST
we touch the problem experimenting with the audit of crypto keys.
Comment 6 Damien Miller 2011-09-06 10:34:14 AEST
Retarget unresolved bugs/features to 6.0 release
Comment 7 Damien Miller 2011-09-06 10:36:28 AEST
Retarget unresolved bugs/features to 6.0 release
Comment 8 Damien Miller 2011-09-06 10:39:02 AEST
Retarget unresolved bugs/features to 6.0 release

(try again - bugzilla's "change several" isn't)
Comment 9 Damien Miller 2012-02-24 10:34:23 AEDT
Retarget from 6.0 to 6.1
Comment 10 Damien Miller 2012-02-24 10:38:01 AEDT
Retarget 6.0 => 6.1
Comment 11 Damien Miller 2012-09-07 11:37:59 AEST
Retarget uncompleted bugs from 6.1 => 6.2
Comment 12 Damien Miller 2012-09-07 11:40:28 AEST
Retarget bugs from 6.1 => 6.2
Comment 13 Damien Miller 2013-03-08 10:23:34 AEDT
retarget to openssh-6.3
Comment 14 Damien Miller 2013-07-22 14:34:51 AEST
on second thoughts, I'm going to leave this. The is-socket of the packet code is undefined until you call packet_set_connection() and trying to ascertain it before you've set a socket is wrong.

Our code will never do this, so the crash is irrelevant to stock openssh. Your code shouldn't either, but if you insist then you should apply the patch in your own tree :/
Comment 15 Alexander Zaytsev 2013-12-20 19:51:04 AEDT
Created attachment 2395 [details]
Backtrace for openssh 6.2p1
Comment 16 Alexander Zaytsev 2013-12-20 19:54:38 AEDT
Hi, I have this problem in following case:
- sshd config file contains a line: 
  ListenAddress 0.0.0.0
- after that this record was changed (this host has 3 DNS records): 
  ListenAddress 192.168.0.101
  ListenAddress 192.168.0.102
  ListenAddress 192.168.0.103
- a restart of sshd prints in syslog:
  error: Bind to port 22 on 192.168.0.101 failed: Address already in use.
  error: Bind to port 22 on 192.168.0.102 failed: Address already in use.
  error: Bind to port 22 on 192.168.0.103 failed: Address already in use.
- method packet_set_connection() is not called, the code of server_listen() detects true condition "if (!num_listen_socks)", but method packet_connection_is_on_socket() from packet.c tries to use incorrect operation: if (active_state->connection_in == active_state->connection_out)
  
I don't know why ports are not available for bind, restart script use "start" and "stop" calls with a delay 2 seconds. It is a quite rare case, I have a reproduction ~5% only on OS starting. The proposed patch resolves this problem.
Comment 17 Alexander Zaytsev 2014-01-24 01:29:30 AEDT
I think, this fault should be fixed. But it is not critical issue. In my case, the fault was provoked by multi start of sshd. The short summary of this problem - there is a crash if the process can't bind all IP addresses from configuration file.
Comment 18 Damien Miller 2015-08-11 23:05:00 AEST
Set all RESOLVED bugs to CLOSED with release of OpenSSH 7.1