Bug 2280 - openssh-6.6p1 compression throwing Segmentation fault
Summary: openssh-6.6p1 compression throwing Segmentation fault
Status: CLOSED INVALID
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh (show other bugs)
Version: 6.6p1
Hardware: Other Linux
: P5 enhancement
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-09-22 17:17 AEST by lalit
Modified: 2016-08-02 10:42 AEST (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description lalit 2014-09-22 17:17:19 AEST
[soetest1@nrpz01lx953 ~]$ /opt/soe/local/openssh-6.6p1/bin/ssh -V
OpenSSH_6.6p1-hpn14v5, OpenSSL 1.0.1h 5 Jun 2014
[soetest1@nrpz01lx953 ~]$ /opt/soe/local/openssh-6.6p1/bin/ssh -l soetest1 -C XX.XX.XX.XX
SECURITY NOTICE

Use of this system, its equipment, and resources is monitored at all
times. All programs and information held on this system are private and
confidential to CSC Corporation, and are only lawfully available to
authorised users for authorised purposes only.

It is a criminal offence to obtain unauthorised access to any program
or information within this system and/or to make any unauthorised
modifications whatsoever to the contents of this computer system.
If you are not an authorised user you are violating the regulations of
this system and can, and will be prosecuted to the full extent of the
law. Please disconnect immediately.

Password:
Segmentation fault (core dumped)
[soetest1@nrpz01lx953 ~]$

Not getting any pointer to troubleshoot this error. Any help would be highly appreciated!!
Comment 1 lalit 2014-09-22 17:30:41 AEST
Below are the logs captured via syslog-ng:

Sep 22 01:58:38 nrpz01lx953 kernel: User process fault: interruption code 0x20010 in libnss_files-2.17.so[3fffd07d000+d000]
Sep 22 01:58:38 nrpz01lx953 kernel: failing address: 2AAFD23D000
Sep 22 01:58:38 nrpz01lx953 kernel: CPU: 0 PID: 17947 Comm: ssh Not tainted 3.10.0-123.el7.s390x #1
Sep 22 01:58:38 nrpz01lx953 kernel: task: 0000000073895aa0 ti: 00000000738bc000 task.ti: 00000000738bc000
Sep 22 01:58:38 nrpz01lx953 kernel: User PSW : 0705000180000000 000002aafd23d698 (0x2aafd23d698)
Sep 22 01:58:38 nrpz01lx953 kernel:           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:1 AS:0 CC:0 PM:0 EA:3
User GPRS: 000003fffd34ec08 000002aae8ceb870 0000000000002550 0000000000002550
Sep 22 01:58:38 nrpz01lx953 kernel:           0000000000002550 000002aaf73659e0 0000000000000010 000002aae8db1c5c
Sep 22 01:58:38 nrpz01lx953 kernel:           000002aaf73616a0 000002aa00000034 000002aaf7361670 000002aae8db2090
Sep 22 01:58:38 nrpz01lx953 kernel:           000003fffd5a7f40 000002aae8db88e0 000002aae8ceed20 000003ffffc52480
Sep 22 01:58:38 nrpz01lx953 kernel: User Code: Bad PSW.
Sep 22 01:58:38 nrpz01lx953 kernel: Last Breaking-Event-Address:
Sep 22 01:58:38 nrpz01lx953 kernel: [<000002aae8ceb878>] 0x2aae8ceb878
Sep 22 01:58:38 nrpz01lx953 abrt-hook-ccpp: Saved core dump of pid 17947 (/opt/soe/local/openssh-6.6p1/bin/ssh) to /var/tmp/abrt/ccpp-2014-09-22-01:58:38-17947 (3444736 bytes)
Sep 22 01:58:38 nrpz01lx953 abrt-server: Package 'SOE_openssh' isn't signed with proper key
Sep 22 01:58:38 nrpz01lx953 abrt-server: 'post-create' on '/var/tmp/abrt/ccpp-2014-09-22-01:58:38-17947' exited with 1
Sep 22 01:58:38 nrpz01lx953 abrt-server: Deleting problem directory '/var/tmp/abrt/ccpp-2014-09-22-01:58:38-17947'
Comment 2 Damien Miller 2014-09-22 19:23:25 AEST
Why do you think this crash is related to compression? The trace seems to indicate it crashes during a getpw* call.

Obtaining a full backtrace using a debugger from the core file produced would be the best way to diagnose this. I guess this is a RHEL host - what architecture is it? (s390?)
Comment 3 lalit 2014-09-22 20:07:43 AEST
Hi Thanks for reply..here is the output of uname -a

[soetest1@nrpz01lx953 ~]$ uname -a
Linux nrpz01lx953.cmi.csc.com 3.10.0-123.el7.s390x #1 SMP Mon May 5 11:18:08 EDT 2014 s390x s390x s390x GNU/Linux
[soetest1@nrpz01lx953 ~]$


How can i get full backtrace using a debugger ?
Comment 4 lalit 2014-09-22 21:42:32 AEST
if I gdb /opt/soe/local/openssh-6.6p1/bin/ssh

[soetest1@nrpz01lx953 ~]$ gdb /opt/soe/local/openssh-6.6p1/bin/ssh
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-51.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "s390x-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /opt/soe/local/openssh-6.6p1/bin/ssh...(no debugging symbols found)...done.
(gdb) run -l soetest1 -C 10.2.3.144
Starting program: /opt/soe/local/openssh-6.6p1/bin/ssh -l soetest1 -C 10.2.3.144
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
SECURITY NOTICE

Use of this system, its equipment, and resources is monitored at all
times. All programs and information held on this system are private and
confidential to CSC Corporation, and are only lawfully available to
authorised users for authorised purposes only.

It is a criminal offence to obtain unauthorised access to any program
or information within this system and/or to make any unauthorised
modifications whatsoever to the contents of this computer system.
If you are not an authorised user you are violating the regulations of
this system and can, and will be prosecuted to the full extent of the
law. Please disconnect immediately.

Password:

Program received signal SIGSEGV, Segmentation fault.
0x000002aafdc93698 in ?? ()
Missing separate debuginfos, use: debuginfo-install SOE_openssh-6.6p1-0.s390x
(gdb)
Comment 5 Darren Tucker 2014-09-23 00:54:24 AEST
(In reply to lalit from comment #4)
[...]
> Program received signal SIGSEGV, Segmentation fault.
> 0x000002aafdc93698 in ?? ()

it looks like the binary has be stripped of debug symbols.  The one in the build directory should still have them.

*HOWEVER* your binary identifies itself as "OpenSSH_6.6p1-hpn14v5", which means it is built from modified source that is not supplied by the OpenSSH team.  Can you reproduce your problem with a binary built from unmodified source from openssh.com?  If not then we cannot help you, you need to talk to whoever supplied the modified code.

> Missing separate debuginfos, use: debuginfo-install
> SOE_openssh-6.6p1-0.s390x
> (gdb)

Assuming you get a clean build with debug symbols and get this far you want to enter "bt" to get a stack trace.
Comment 6 Darren Tucker 2015-05-08 13:57:38 AEST
You will need to seek help from whoever supplied you with the modified version of OpenSSH.  Please reopen this bug if you can reproduce with a binary built from an unmodified source tree from openssh.com.
Comment 7 Damien Miller 2016-08-02 10:42:25 AEST
Close all resolved bugs after 7.3p1 release