openssh bugs - Sep 2003 - [Bug 651] SCO 3.2v4.2 and OpenSSH 3.7.1p1 --> connection hangs and does not close (ssh2 only)

http://bugzilla.mindrot.org/show_bug.cgi?id=651

           Summary: SCO 3.2v4.2 and OpenSSH 3.7.1p1 --> connection hangs and
                    does not close (ssh2 only)
           Product: Portable OpenSSH
           Version: 3.7p1
          Platform: All
        OS/Version: other
            Status: NEW
          Severity: major
          Priority: P2
         Component: sshd
        AssignedTo: openssh-bugs at mindrot.org
        ReportedBy: vikashb at comparexafrica.co.za


When executing a remote command or when exiting from a shell,
the ssh connection hangs indefinitely, the only way to close the session
is [crontol]+[c] even [~][.] does not work.

This problem only exists when using ssh2 connections.

the server side debug(-d -d -d) :

debug1: Received SIGCHLD.
debug2: channel 0: read failed
debug2: channel 0: close_read
debug2: channel 0: input open -> drain
debug2: channel 0: ibuf_empty delayed efd 12/(0)
debug2: notify_done: reading
debug2: channel 0: read 0 from efd 12
debug2: channel 0: closing read-efd 12
debug2: channel 0: ibuf empty
debug2: channel 0: send eof
debug2: channel 0: input drain -> closed
--->hangs<---
--------------------------------------------

below is a backtrace from gdb:
(gdb) s
326             ret = select((*maxfdp)+1, *readsetp, *writesetp, NULL, tvp);
(gdb) l
321                     tv.tv_usec = 1000 * (max_time_milliseconds % 1000);
322                     tvp = &tv;
323             }
324
325             /* Wait for something to happen, or the timeout to expire. */
326             ret = select((*maxfdp)+1, *readsetp, *writesetp, NULL, tvp);
327
328             if (ret == -1) {
329                     memset(*readsetp, 0, *nallocp);
330                     memset(*writesetp, 0, *nallocp);
(gdb) bt
#0  wait_until_can_do_something (readsetp=0x7ffff8d8, writesetp=0x7ffff8d4,
    maxfdp=0x7ffff8d0, nallocp=0x7ffff8cc, max_time_milliseconds=0)
    at serverloop.c:326
#1  0x8bfc in server_loop2 (authctxt=0x42eaf8) at serverloop.c:770
#2  0x104bb in do_authenticated2 (authctxt=0x42eaf8) at session.c:2152
#3  0xcc19 in do_authenticated (authctxt=0x42eaf8) at session.c:216
#4  0x2eaa in main (ac=6, av=0x7ffffe1c) at sshd.c:1506
(gdb) s

I have no idea how to resolve this.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=651





------- Additional Comments From vikashb at comparexafrica.co.za  2003-10-01
22:00 -------
After spending some more time with this, I have discovered that
gdb always hangs at ret = select((*maxfdp)+1, *readsetp, *writesetp, NULL, tvp);
even on 3.5p1.

After some more tracing, it seems that the connection_closed does not change,
the only place that could possiblity change connection_closed is process_input()
in serverloop.c

I am not sure how this section works, attached is a diff that forces 
connection_closed to be set to 1 if SIGCHLD is received:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
--- serverloop.c.orig   Wed Oct  1 09:04:00 2003
+++ serverloop.c        Wed Oct  1 13:58:24 2003
@@ -82,6 +82,7 @@
 static int connection_closed = 0;      /* Connection to client closed. */
 static u_int buffer_high;      /* "Soft" max buffer size. */
 static int client_alive_timeouts = 0;
+int kill_session = 0;

 /*
  * This SIGCHLD kludge is used to detect when the child exits.  The server
@@ -144,6 +145,7 @@
        int save_errno = errno;
        debug("Received SIGCHLD.");
        child_terminated = 1;
+       kill_session = 1;
 #ifndef _UNICOS
        mysignal(SIGCHLD, sigchld_handler);
 #endif
@@ -345,6 +347,11 @@
 {
        int len;
        char buf[16384];
+
+        /* set connection_closed to 1 if received SIGCHLD */
+        if ( kill_session == 1 ) {
+           connection_closed = 1;
+        }

        /* Read and buffer any input data from the client. */
        if (FD_ISSET(connection_in, readset)) {
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Is this approach incorrect ?



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=651





------- Additional Comments From djm at mindrot.org  2003-10-02 14:02 -------
Are you sure that this is not bug #52 ?



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=651





------- Additional Comments From vikashb at comparexafrica.co.za  2003-10-02
14:23 -------
I'm not sure, 3.4p1 and 3.5p1 worked fine
Bug #52 : ssh hangs on exit after running commands that fork
ssh hangs on exit all the time, whether i use bash, ksh , sh, csh
where i execute a remote command or scp or an interactive shell

Sorry if i'm not very helpful, SCO is a really crappy OS, but I still have
50+ to support and maintain.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.