openssh bugs - Jul 2003 - [Bug 585] sshd core dumping on IRIX 6.5.18 with VerifyReverseMapping enabled

http://bugzilla.mindrot.org/show_bug.cgi?id=585





------- Additional Comments From dtucker at zip.com.au  2003-07-07 00:32 -------
dmalloc (http://dmalloc.com/) claims to work on IRIX.  It's likely to
increase
the CPU and memory load, though.

I've built with dmalloc on Linux thusly:
LDFLAGS=-ldmalloc ./configure && make
eval `dmalloc -l /path/to/log high`
./sshd [options]



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=585





------- Additional Comments From ktaylor at daac.gsfc.nasa.gov  2003-07-14 21:41
-------
I believe I built openssh with -ldmalloc 

I ran the command you suggested, but there's nothing being logged to that
log file.

I've never used dmalloc before, so I'm not sure what I'm doing. 

Do you have anything special that needs to be set up in your .dmallocrc?




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=585





------- Additional Comments From dtucker at zip.com.au  2003-07-14 22:35 -------
No, I don't have a .dmallocrc.  Here is exactly what I did:

# eval `dmalloc -l /tmp/dmalloc.log high`
# ./sshd -d -p 2022
[debugging output snipped]
# ls -l /tmp/dmalloc.log
-rw-r--r--    1 dtucker  dtucker     39314 Jul 14 22:13 /tmp/dmalloc.log

There might be a couple of logging problems: there will be log per connection 
plus one for the master daemon (the dmalloc docs say you can use "%d"
for a pid
but that didn't work for me) and the logging will be done partly as the user
not
root.

Even without the logging dmalloc will be useful as it should abort the ssh 
session (with a core dump) as soon as it detects a problem, rather some time 
later.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=585





------- Additional Comments From ktaylor at daac.gsfc.nasa.gov  2003-07-15 00:13
-------

well, I got a core dump and ran dbx against it and it doesn't look like
anything
different to me. The corefile size was significantly larger (28MB vs 3MB for the
other)...so I assume dmalloc was working.
>  0 realfree(0x10152388, 0x101520e8, 0x0, 0x6e686463, 0x6e686460, 0x1,
0x10166968, 0x0)
["/xlv86/patches/5015/work/irix/lib/libc/libc_n32_M4/gen/malloc.c":538,
0xfb24694]
   1 cleanfree(0x0, 0x101520e8, 0x0, 0x6e686463, 0x6e686460, 0x1, 0x10166968,
0x0)
["/xlv86/patches/5015/work/irix/lib/libc/libc_n32_M4/gen/malloc.c":944,
0xfb24eac]
   2 __malloc(0x260, 0x101520e8, 0x0, 0x6e686463, 0x6e686460, 0x1, 0x10166968,
0x0)
["/xlv86/patches/5015/work/irix/lib/libc/libc_n32_M4/gen/malloc.c":230,
0xfb240e0]
   3 _malloc(0x0, 0x101520e8, 0x0, 0x6e686463, 0x6e686460, 0x1, 0x10166968, 0x0)
["/xlv86/patches/5015/work/irix/lib/libc/libc_n32_M4/gen/malloc.c":186,
0xfb23f4c]
   4 xmalloc(size = 608)
["/usr/local/src/security/openssh-3.6.1p1/xmalloc.c":28, 0x10065934]
   5 login_alloc_entry(pid = 77144314, username = 0x101520e8 =
"ktaylor",
hostname = 0x10152368 =
"66-44-105-44.s806.apx2.lnhd`.md.dialup.rcn.com", line 0x1014a20c =
"/dev/ttyq51")
["/usr/local/src/security/openssh-3.6.1p1/loginrec.c":325, 0x10048aa0]
   6 record_login(pid = 77144314, ttyname = 0x1014a20c =
"/dev/ttyq51", user 0x101520e8 = "ktaylor", uid = ####, host
= 0x10152368 "66-44-105-44.s806.apx2.lnhd`.md.dialup.rcn.com", addr =
0x7ffed410, addrlen 16)
["/usr/local/src/security/openssh-3.6.1p1/sshlogin.c":72, 0x1002be58]
   7 mm_record_login(s = 0x1014a1d8, pw = 0x1015dbc8)
["/usr/local/src/security/openssh-3.6.1p1/monitor.c":1030, 0x10042c24]
   8 mm_answer_pty(socket = 7, m = 0x7ffed500)
["/usr/local/src/security/openssh-3.6.1p1/monitor.c":1080, 0x10042ecc]
   9 monitor_read(pmonitor = 0x10152780, ent = 0x10137730, pent = (nil))
["/usr/local/src/security/openssh-3.6.1p1/monitor.c":371, 0x10040ef4]
   10 monitor_child_postauth(pmonitor = 0x10152780)
["/usr/local/src/security/openssh-3.6.1p1/monitor.c":334, 0x10040d4c]
   11 privsep_postauth(authctxt = 0x10151570)
["/usr/local/src/security/openssh-3.6.1p1/sshd.c":665, 0x10025f18]
   12 main(ac = 3, av = 0x7ffedf04)
["/usr/local/src/security/openssh-3.6.1p1/sshd.c":1533, 0x10028a28]
   13 __start()
["/xlv55/kudzu-apr12/work/irix/lib/libc/libc_n32_M4/csu/crt1text.s":177,
0x100249e8]




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=585





------- Additional Comments From dtucker at zip.com.au  2003-07-15 00:49 -------
Some googling shows that openssh is not the only thing with these symptoms:
http://opendx.npaci.edu/mail/opendx-dev/2000.01/msg00068.html
http://mail.python.org/pipermail/python-bugs-list/2003-April/017283.html

The second is the same release of IRIX and hints at a cause in netdb.h relating 
to getaddrinfo/getnameinfo.

Try commenting out "#define HAVE_GETADDRINFO 1" in config.h and
recompiling.

What signal is it dying with, SIGSEGV or SIGBUS?  Is your resolver configured 
for pure DNS/hosts or NIS?  Can SGI any help?  10 bucks says the IRIX 
getaddrinfo is trashing memory.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=585





------- Additional Comments From ktaylor at daac.gsfc.nasa.gov  2003-07-15 00:56
-------
I thought we tried reubuilding with the openssh getaddrinfo...but our config.h
says otherwise. I'll give it another go.

It is dying with SIGSEGV

We're using hosts/dns, no nis here.

I can try SGI, but just like everyone else, as soon as you mention some third
party software they don't want to hear it.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=585





------- Additional Comments From ktaylor at daac.gsfc.nasa.gov  2003-07-15 01:23
-------
ok. I commented out the getaddrinfo line from config.h reran the make (binary is
a little larger) and still got a core dump, which looks about the same:
>  0 realfree(0x10166d70, 0x101523b0, 0x0, 0x6e686463, 0x6e686460, 0x1,
0x10166d80, 0x0)
["/xlv86/patches/5015/work/irix/lib/libc/libc_n32_M4/gen/malloc.c":538,
0xfb24694]
   1 cleanfree(0x0, 0x101523b0, 0x0, 0x6e686463, 0x6e686460, 0x1, 0x10166d80,
0x0)
["/xlv86/patches/5015/work/irix/lib/libc/libc_n32_M4/gen/malloc.c":944,
0xfb24eac]
   2 __malloc(0x260, 0x101523b0, 0x0, 0x6e686463, 0x6e686460, 0x1, 0x10166d80,
0x0)
["/xlv86/patches/5015/work/irix/lib/libc/libc_n32_M4/gen/malloc.c":230,
0xfb240e0]
   3 _malloc(0x0, 0x101523b0, 0x0, 0x6e686463, 0x6e686460, 0x1, 0x10166d80, 0x0)
["/xlv86/patches/5015/work/irix/lib/libc/libc_n32_M4/gen/malloc.c":186,
0xfb23f4c]
   4 xmalloc(size = 608)
["/usr/local/src/security/openssh-3.6.1p1/xmalloc.c":28, 0x10065994]
   5 login_alloc_entry(pid = 78265682, username = 0x101523b0 =
"ktaylor",
hostname = 0x10166d50 =
"66-44-42-202.s710.apx1.lnhd`.md.dialup.rcn.com", line 0x1014a25c =
"/dev/ttyq70")
["/usr/local/src/security/openssh-3.6.1p1/loginrec.c":325, 0x10048b00]
   6 record_login(pid = 78265682, ttyname = 0x1014a25c =
"/dev/ttyq70", user 0x101523b0 = "ktaylor", uid = ####, host
= 0x10166d50 "66-44-42-202.s710.apx1.lnhd`.md.dialup.rcn.com", addr =
0x7ffed410, addrlen 16)
["/usr/local/src/security/openssh-3.6.1p1/sshlogin.c":72, 0x1002beb8]
   7 mm_record_login(s = 0x1014a228, pw = 0x1015d960)
["/usr/local/src/security/openssh-3.6.1p1/monitor.c":1030, 0x10042c84]
   8 mm_answer_pty(socket = 7, m = 0x7ffed500)
["/usr/local/src/security/openssh-3.6.1p1/monitor.c":1080, 0x10042f2c]
   9 monitor_read(pmonitor = 0x101527a0, ent = 0x10137770, pent = (nil))
["/usr/local/src/security/openssh-3.6.1p1/monitor.c":371, 0x10040f54]
   10 monitor_child_postauth(pmonitor = 0x101527a0)
["/usr/local/src/security/openssh-3.6.1p1/monitor.c":334, 0x10040dac]
   11 privsep_postauth(authctxt = 0x10151590)
["/usr/local/src/security/openssh-3.6.1p1/sshd.c":665, 0x10025f78]
   12 main(ac = 3, av = 0x7ffedf04)
["/usr/local/src/security/openssh-3.6.1p1/sshd.c":1533, 0x10028a88]
   13 __start()
["/xlv55/kudzu-apr12/work/irix/lib/libc/libc_n32_M4/csu/crt1text.s":177,
0x10024a48]




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=585





------- Additional Comments From ktaylor at daac.gsfc.nasa.gov  2003-07-15 01:29
-------
If I can find the time, I've got something I may try. 

http://freeware.sgi.com has openssh-3.5p1 available. I don't know if the
problem
existed at that time, if it did, I can download the sgi release of it and see
what the source code differences are and see if that points to something.

Of course, if 3.5p1 direct from openssh works fine, then we're still stuck.




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=585





------- Additional Comments From ktaylor at daac.gsfc.nasa.gov  2003-07-15 22:33
-------

I've been trying several different things today and set this line in
config.h

#define BROKEN_GETADDRINFO

(in addition to the other GETADDRINFO line in config.h)

and I get this error...

"../openbsd-compat/fake-getaddrinfo.h", line 40: error(1143):
declaration is
          incompatible with "const char *gai_strerror(int)" (declared
at line
          147 of "/usr/include/netdb.h")
  char *gai_strerror(int ecode);
        ^




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=585





------- Additional Comments From ktaylor at daac.gsfc.nasa.gov  2003-07-15 23:20
-------
ok, I don't really want to jinx anything by posting this, but I think
it's
starting to work now.

After I set the #define BROKEN_GETADDRINFO line, I got that error message listed
in the last message...what I did to get it to compile was to comment out the
offending line in /usr/include/netdb.h...just to get it to compile, and that
made it happy.

At this point it does look like a problem with SGI's getaddrinfo, BUT
getting
the fake-addrinfo to build into ssh requires at least the BROKEN_ADDRINFO define
to be set, and if someone can offer a clean way to get the openbsd-compat stuff
to build (rather than editing the system headers), that would be a good
solution.

I hope that this new binary is really working and my hopes haven't been
prematurely raised. :)



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=585





------- Additional Comments From ktaylor at daac.gsfc.nasa.gov  2003-07-17 00:04
-------
I found that making these changes gets the stuff built without modifying any
system includes:

openbsd-compat/fake-getaddrinfo.h

40c40
< char *gai_strerror(int ecode);
---
> const char *gai_strerror(int ecode);

openbsd-compat/fake-getaddrinfo.c

18c18
< char *gai_strerror(int ecode)
---
> const char *gai_strerror(int ecode)



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.