openssh bugs - Dec 2007 - [Bug 1398] New: slave ssh sessions enter a never-ending blocking state

https://bugzilla.mindrot.org/show_bug.cgi?id=1398

           Summary: slave ssh sessions enter a never-ending blocking state
    Classification: Unclassified
           Product: Portable OpenSSH
           Version: 4.7p1
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: ssh
        AssignedTo: bitbucket at mindrot.org
        ReportedBy: gregory_shively at fanniemae.com


Created an attachment (id=1388)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1388)
Patch to close client_fd

I've currently looking at increasing the MAX_SESSIONS to increase the
number of slave ssh processes to be multiplex where I ran into the
default maximum filehandle limit on a test machine (Solaris 8). I've
found a similiar set of patches in the cvs repos that is similiar to a
dirty patch that I came up with; so I've been implementing the patch in
the repos. The patch includes clientloop.c at 1.182,  monitor_fdpass.h at 1.4
and monitor_fdpass.c at 1.13.

The problem I've hit is that in the cleanup-code for a failed
mm_receive_fd() in the client_process_control() function, the client_fd
filehandle is left open and lost. The effect is that the slave ssh
process blocks and never returns even if filehandles are freed due to
other slave processes closing. I've attached a patch that I think fixes
this problem.

I've also created a simple regression, but I'm not exactly sure how
well it will work in other locations. But to manually test issue:

in one window/session:
  ( ulimit -Sn 11 ; exec ./ssh -vMS  /tmp/cntl otherhost ) 

in another window/session:
  ./ssh -vS  /tmp/cntl otherhost

The process in the 2nd window blocks until the master ssh process
exits. I would think it would be better to have the slave exit as soon
as possible since it will never be able to access otherhost.

I've also seen another interesting effect of this process, I've been
testing on Solaris 8 and SLES 10 machines currently, and it only seems
to effect the Solaris machine - if the filehandle limit is hit from the
accept() call in the same client_process_control() function, it blocks
the slave ssh session until the another slave ends, freeing some
filehandles. I seem to be able to manually reproduce this by changing
the previous ulimit value to 15 and running a third process in the same
way as the 2nd. The 3rd process will block, but once the 2nd process
exist, the 3rd would be let in. I couldn't seem to reproduce on a Linux
machine; and I think this is the "right" thing to do anyway.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1398





--- Comment #1 from gregory_shively at fanniemae.com  2007-12-08 11:21:12 ---
Created an attachment (id=1389)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1389)
A quick regression to test bug

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1398





--- Comment #2 from gregory_shively at fanniemae.com  2007-12-12 11:27:44 ---
(From update of attachment 1389)
Regression failed on a different machine.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1398


gregory_shively at fanniemae.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
Attachment #1388 is|0                           |1
           obsolete|                            |




--- Comment #3 from gregory_shively at fanniemae.com  2007-12-19 08:54:46 ---
Created an attachment (id=1398)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1398)
Allows a multiplex slave to exit and generate a true exit value

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1398


gregory_shively at fanniemae.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
Attachment #1398 is|0                           |1
           obsolete|                            |
Attachment #1389 is|0                           |1
           obsolete|                            |




--- Comment #4 from gregory_shively at fanniemae.com  2007-12-20 07:59:27 ---
Created an attachment (id=1399)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1399)
Cleanup duplicate diff hunks.

Found some more equivalent changes in CVS repos. Removed the duplicate
diff hunks.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1398


Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED
                 CC|                            |djm at mindrot.org
             Blocks|                            |1353




--- Comment #5 from Damien Miller <djm at mindrot.org>  2008-01-20
07:51:46 ---
Patch applied - thanks!

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1398


Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added                       
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED                      




--- Comment #6 from Damien Miller <djm at mindrot.org>  2008-03-31
15:22:51 ---
Fix shipped in 4.9/4.9p1 release.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.