Bug 3417 - Crash of sshd with exit code 6 SIGABRT
Summary: Crash of sshd with exit code 6 SIGABRT
Status: NEW
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 8.0p1
Hardware: ARM Linux
: P5 critical
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-04-07 21:03 AEST by narcislachausse
Modified: 2022-04-11 17:08 AEST (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description narcislachausse 2022-04-07 21:03:25 AEST
Hello, 

I am currently using the v8.0p1 openssh version and during automate testing of the system found a crash of sshd with the occurence: 4 times in 460 cycles.

The following stacktrace has been extracted:
=======================================================================
Core was generated by `sshd: [net]                                               '.
Program terminated with signal SIGABRT, Aborted.
 
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
        set = {__val = {0, 0, 96, 67, 101, 213, 243, 129, 67, 152, 37, 
            232, 91, 226, 87, 184, 10, 116, 186, 106, 98, 129, 131, 101, 
            21, 199, 54, 106, 25, 74, 243, 116}}
        pid = <optimized out>
        tid = <optimized out>
        ret = <optimized out>

#1  0xb6bf2e74 in __GI_abort () at abort.c:79
        save_stage = 1
        act =  
{__sigaction_handler = {sa_handler = 0x152, 
            sa_sigaction = 0x152}, sa_mask = {__val = {3067101776, 7, 0, 
              344, 3067103204, 61, 2147410092, 91, 43, 360, 110, 
              3070047952, 5, 43, 0, 335, 0, 124, 0, 119, 1311297405, 44, 
              2136970460, 44, 2136970460, 2147483400, 2147445960, 
              3066275400, 2147445960, 3066258516, 253, 273}}, 
          sa_flags = 2147483400, sa_restorer = 0x7f5f94dc}
        sigs = {__val = {32, 0 <repeats 31 times>}}

#2  0x7f5f8a94 in __subvsi3 ( 
a=<optimized out>, b=<optimized out>)
    at ../../../libgcc/libgcc2.c:119
        w = <optimized out>

#3  0x7f5f72a4 in strlcpy ()
No symbol table info available.
 
#4  0x7f5d7494 in xstrdup ()
No symbol table info available.
 
#5  0x7f5cf884 in match_list ()
No symbol table info available.
 
#6  0x7f5e35fc in kex_names_cat ()
No symbol table info available.
 
#7  0x7f5e37cc in kex_assemble_names ()
No symbol table info available.
 
#8  0x7f592c40 in assemble_algorithms ()
No symbol table info available.
 
#9  0x7f597fb4 in copy_set_server_options ()
No symbol table info available.
 
#10 0x7f5ae578 in mm_getpwnamallow ()
No symbol table info available.
 
#11 0x7f59eaf8 in input_userauth_request ()
No symbol table info available.
=======================================================================

Thank you in advance,
Narcis
Comment 1 Damien Miller 2022-04-08 12:03:40 AEST
Do you have reproduction instructions for these crashes?

If not, are you able to reproduce the crashes with a recent version? 8.0 is three years old. We're releasing openssh-9.0 later today.
Comment 2 narcislachausse 2022-04-08 22:22:38 AEST
(In reply to Damien Miller from comment #1)
> Do you have reproduction instructions for these crashes?
> 
> If not, are you able to reproduce the crashes with a recent version?
> 8.0 is three years old. We're releasing openssh-9.0 later today.

Hello,

this issue was reproduced when keeping the system/OS alive ~3 minutes from start-Up. 

The test would be:
1-> start the system/OS (all services up & running)
2-> after 3 minutes check for crashes
3-> crash found 4 times in 460 runs
4-> reboot the system -> back to 1 again

Actually, I didn't tried the latest versions due to the project restrictions, but I would like to understand what is happening
Comment 3 Darren Tucker 2022-04-11 16:52:29 AEST
(In reply to narcislachausse from comment #2)
[...]
> 1-> start the system/OS (all services up & running)

Which particular system/OS?  All you've given us is "Linux" on "Other" hardware.  Which distro and version?  What exactly is the "other" hardware?  Has the OpenSSH been modified by the vendor?
Comment 4 narcislachausse 2022-04-11 16:57:55 AEST
(In reply to Darren Tucker from comment #3)
> (In reply to narcislachausse from comment #2)
> [...]
> > 1-> start the system/OS (all services up & running)
> 
> Which particular system/OS?  All you've given us is "Linux" on
> "Other" hardware.  Which distro and version?  What exactly is the
> "other" hardware?  Has the OpenSSH been modified by the vendor?

Hello,

The OS is the following: linux 4.9 running on a ARMv7-A (32bit) with a Cortex A7 CPU.
No, the openssh did not suffered any modifications.
Comment 5 Darren Tucker 2022-04-11 17:08:03 AEST
(In reply to narcislachausse from comment #4)
[...]
> The OS is the following:
> linux 4.9 

That's a kernel.  What about the rest of it?  is there a distro or is this hand built?  What libc does it use?  Which compiler?  What OpenSSH configure options were used?

> running on a ARMv7-A (32bit) with a Cortex A7 CPU.

updated the hardware to "ARM".  We have a 32bit ARM device in our test farm so it's unlikely to be a problem specific to ARM.