openssh bugs - Sep 2014 - [Bug 2280] New: openssh-6.6p1 compression throwing Segmentation fault

https://bugzilla.mindrot.org/show_bug.cgi?id=2280

            Bug ID: 2280
           Summary: openssh-6.6p1 compression throwing Segmentation fault
           Product: Portable OpenSSH
           Version: 6.6p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: lojha at csc.com

[soetest1 at nrpz01lx953 ~]$ /opt/soe/local/openssh-6.6p1/bin/ssh -V
OpenSSH_6.6p1-hpn14v5, OpenSSL 1.0.1h 5 Jun 2014
[soetest1 at nrpz01lx953 ~]$ /opt/soe/local/openssh-6.6p1/bin/ssh -l
soetest1 -C XX.XX.XX.XX
SECURITY NOTICE

Use of this system, its equipment, and resources is monitored at all
times. All programs and information held on this system are private and
confidential to CSC Corporation, and are only lawfully available to
authorised users for authorised purposes only.

It is a criminal offence to obtain unauthorised access to any program
or information within this system and/or to make any unauthorised
modifications whatsoever to the contents of this computer system.
If you are not an authorised user you are violating the regulations of
this system and can, and will be prosecuted to the full extent of the
law. Please disconnect immediately.

Password:
Segmentation fault (core dumped)
[soetest1 at nrpz01lx953 ~]$

Not getting any pointer to troubleshoot this error. Any help would be
highly appreciated!!

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2280

--- Comment #1 from lalit <lojha at csc.com> ---
Below are the logs captured via syslog-ng:

Sep 22 01:58:38 nrpz01lx953 kernel: User process fault: interruption
code 0x20010 in libnss_files-2.17.so[3fffd07d000+d000]
Sep 22 01:58:38 nrpz01lx953 kernel: failing address: 2AAFD23D000
Sep 22 01:58:38 nrpz01lx953 kernel: CPU: 0 PID: 17947 Comm: ssh Not
tainted 3.10.0-123.el7.s390x #1
Sep 22 01:58:38 nrpz01lx953 kernel: task: 0000000073895aa0 ti:
00000000738bc000 task.ti: 00000000738bc000
Sep 22 01:58:38 nrpz01lx953 kernel: User PSW : 0705000180000000
000002aafd23d698 (0x2aafd23d698)
Sep 22 01:58:38 nrpz01lx953 kernel:           R:0 T:1 IO:1 EX:1 Key:0
M:1 W:0 P:1 AS:0 CC:0 PM:0 EA:3
User GPRS: 000003fffd34ec08 000002aae8ceb870 0000000000002550
0000000000002550
Sep 22 01:58:38 nrpz01lx953 kernel:           0000000000002550
000002aaf73659e0 0000000000000010 000002aae8db1c5c
Sep 22 01:58:38 nrpz01lx953 kernel:           000002aaf73616a0
000002aa00000034 000002aaf7361670 000002aae8db2090
Sep 22 01:58:38 nrpz01lx953 kernel:           000003fffd5a7f40
000002aae8db88e0 000002aae8ceed20 000003ffffc52480
Sep 22 01:58:38 nrpz01lx953 kernel: User Code: Bad PSW.
Sep 22 01:58:38 nrpz01lx953 kernel: Last Breaking-Event-Address:
Sep 22 01:58:38 nrpz01lx953 kernel: [<000002aae8ceb878>] 0x2aae8ceb878
Sep 22 01:58:38 nrpz01lx953 abrt-hook-ccpp: Saved core dump of pid
17947 (/opt/soe/local/openssh-6.6p1/bin/ssh) to
/var/tmp/abrt/ccpp-2014-09-22-01:58:38-17947 (3444736 bytes)
Sep 22 01:58:38 nrpz01lx953 abrt-server: Package 'SOE_openssh' isn't
signed with proper key
Sep 22 01:58:38 nrpz01lx953 abrt-server: 'post-create' on
'/var/tmp/abrt/ccpp-2014-09-22-01:58:38-17947' exited with 1
Sep 22 01:58:38 nrpz01lx953 abrt-server: Deleting problem directory
'/var/tmp/abrt/ccpp-2014-09-22-01:58:38-17947'

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2280

lalit <lojha at csc.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |lojha at csc.com

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2280

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org

--- Comment #2 from Damien Miller <djm at mindrot.org> ---
Why do you think this crash is related to compression? The trace seems
to indicate it crashes during a getpw* call.

Obtaining a full backtrace using a debugger from the core file produced
would be the best way to diagnose this. I guess this is a RHEL host -
what architecture is it? (s390?)

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2280

--- Comment #3 from lalit <lojha at csc.com> ---
Hi Thanks for reply..here is the output of uname -a

[soetest1 at nrpz01lx953 ~]$ uname -a
Linux nrpz01lx953.cmi.csc.com 3.10.0-123.el7.s390x #1 SMP Mon May 5
11:18:08 EDT 2014 s390x s390x s390x GNU/Linux
[soetest1 at nrpz01lx953 ~]$


How can i get full backtrace using a debugger ?

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2280

--- Comment #4 from lalit <lojha at csc.com> ---
if I gdb /opt/soe/local/openssh-6.6p1/bin/ssh

[soetest1 at nrpz01lx953 ~]$ gdb /opt/soe/local/openssh-6.6p1/bin/ssh
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-51.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show
copying"
and "show warranty" for details.
This GDB was configured as "s390x-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /opt/soe/local/openssh-6.6p1/bin/ssh...(no
debugging symbols found)...done.
(gdb) run -l soetest1 -C 10.2.3.144
Starting program: /opt/soe/local/openssh-6.6p1/bin/ssh -l soetest1 -C
10.2.3.144
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
SECURITY NOTICE

Use of this system, its equipment, and resources is monitored at all
times. All programs and information held on this system are private and
confidential to CSC Corporation, and are only lawfully available to
authorised users for authorised purposes only.

It is a criminal offence to obtain unauthorised access to any program
or information within this system and/or to make any unauthorised
modifications whatsoever to the contents of this computer system.
If you are not an authorised user you are violating the regulations of
this system and can, and will be prosecuted to the full extent of the
law. Please disconnect immediately.

Password:

Program received signal SIGSEGV, Segmentation fault.
0x000002aafdc93698 in ?? ()
Missing separate debuginfos, use: debuginfo-install
SOE_openssh-6.6p1-0.s390x
(gdb)

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2280

Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at zip.com.au

--- Comment #5 from Darren Tucker <dtucker at zip.com.au> ---
(In reply to lalit from comment #4)
[...]
> Program received signal SIGSEGV, Segmentation fault.
> 0x000002aafdc93698 in ?? ()
it looks like the binary has be stripped of debug symbols.  The one in
the build directory should still have them.

*HOWEVER* your binary identifies itself as "OpenSSH_6.6p1-hpn14v5",
which means it is built from modified source that is not supplied by
the OpenSSH team.  Can you reproduce your problem with a binary built
from unmodified source from openssh.com?  If not then we cannot help
you, you need to talk to whoever supplied the modified code.
> Missing separate debuginfos, use: debuginfo-install
> SOE_openssh-6.6p1-0.s390x
> (gdb)
Assuming you get a clean build with debug symbols and get this far you
want to enter "bt" to get a stack trace.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2280

Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|NEW                         |RESOLVED

--- Comment #6 from Darren Tucker <dtucker at zip.com.au> ---
You will need to seek help from whoever supplied you with the modified
version of OpenSSH.  Please reopen this bug if you can reproduce with a
binary built from an unmodified source tree from openssh.com.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2280

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #7 from Damien Miller <djm at mindrot.org> ---
Close all resolved bugs after 7.3p1 release

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.