openssh bugs - Oct 2023 - [Bug 3630] New: sshd crash on OpenSSH 9.5 / OpenBSD 7.4

https://bugzilla.mindrot.org/show_bug.cgi?id=3630

            Bug ID: 3630
           Summary: sshd crash on OpenSSH 9.5 / OpenBSD 7.4
           Product: Portable OpenSSH
           Version: 9.5p1
          Hardware: MIPS64
                OS: OpenBSD
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: fraggle+mindrot at gmail.com

I recently upgraded to OpenBSD 7.4 and my sshd crashed over the
weekend. The machine is a fairly unusual octeon/mips64 machine
(Edgerouter Lite); maybe that's related. I'm attaching the coredump.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3630

Simon Howard <fraggle+mindrot at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fraggle+mindrot at gmail.com

--- Comment #1 from Simon Howard <fraggle+mindrot at gmail.com> ---
Created attachment 3748
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3748&action=edit
Attempt at getting a backtrace

Attempt at getting a backtrace with gdb. I tried to get some additional
info about registers etc. instead.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3630

--- Comment #2 from Simon Howard <fraggle+mindrot at gmail.com> ---
Core file doesn't appear to have attached to the bug; it occurs to me
that that may be intentional. If you want a copy please let me know.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3630

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org

--- Comment #3 from Damien Miller <djm at mindrot.org> ---
Can you try gdb from ports ("egdb"). It often works better than the
one
in base

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3630

--- Comment #4 from Simon Howard <fraggle+mindrot at gmail.com> ---
Created attachment 3749
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3749&action=edit
Backtrace

Success!

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3630

--- Comment #5 from Damien Miller <djm at mindrot.org> ---
Looks like a crash inside malloc(). Could you try running with
MALLOC_OPTIONS=SGFCJ? You might also want to report this to
bugs at openbsd.org because I'm fairly sure the problem is not in sshd
(mac_alg_list() is a very simple function).

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3630

--- Comment #6 from Simon Howard <fraggle+mindrot at gmail.com> ---
Thanks for suggestion. I've opened my sshd back up to the Internet and
it's running with the requested malloc options.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.