Discussion:
SSH ~& command crash with a coredump
Grégoire Jadi
2017-06-21 09:22:00 UTC
Permalink
Synopsis: The ~& SSH command crash with a coredump.
Category: system amd64
System : OpenBSD 6.1
Details : OpenBSD 6.1-current (GENERIC.MP) #20: Mon Jun 19 08:05:02
MDT 2017
***@amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP

Architecture: OpenBSD.amd64
Machine : amd64
The ~& command is used to put SSH in background at logout when waiting
for forwarded connection / X11 sessions to terminate.

The problem occurs in the 2017-06-19 snapshot and in stable (tested in
a kvm VM).
$ ssh somehost
somehost$ ~&
Abort trap (core dumped)
$ dmesg | tail
ssh(36167): syscall 2 "proc"<3>ssh(84227): syscall 2 "proc"
<3>ssh(82010): syscall 2 "proc"

$ gdb -c ssh.core
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and
you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "amd64-unknown-openbsd6.1".
Core was generated by `ssh'.
Program terminated with signal 6, Aborted.
#0 0x0000028597d43eca in ?? ()
(gdb) bt
#0 0x0000028597d43eca in ?? ()
#1 0x0000028597d8cd45 in ?? ()
#2 0x0000000000000000 in ?? ()
(gdb) info reg
rax 0x1 1
rbx 0x0 0
rcx 0x28597d43eca 2772801175242
rdx 0x0 0
rsi 0x7f7ffffed2e0 140187732464352
rdi 0x285baf3d700 2773390448384
rbp 0x26 0x26
rsp 0x7f7ffffecdf8 0x7f7ffffecdf8
r8 0x285baf3d710 2773390448400
r9 0x7f7ffffed2e2 140187732464354
r10 0x0 0
r11 0x246 582
r12 0x7f7ffffed770 140187732465520
r13 0x28535285c40 2771145743424
r14 0x285c013d800 2773476431872
r15 0x7f7ffffed770 140187732465520
rip 0x28597d43eca 0x28597d43eca
eflags 0x247 583
cs 0x2b 43
ss 0x23 35
ds 0x23 35
es 0x23 35
fs 0x23 35
gs 0x23 35


I'd be happy to provide additional information if needed.

dmesg:
OpenBSD 6.1-current (GENERIC.MP) #20: Mon Jun 19 08:05:02 MDT 2017
***@amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 4062691328 (3874MB)
avail mem = 3933769728 (3751MB)
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 2.6 @ 0xe0010 (78 entries)
bios0: vendor LENOVO version "6QET47WW (1.17 )" date 07/14/2010
bios0: LENOVO 3680BA5
acpi0 at bios0: rev 2
acpi0: sleep states S0 S3 S4 S5
acpi0: tables DSDT FACP SSDT ECDT APIC MCFG HPET ASF! SLIC BOOT SSDT
TCPA DMAR SSDT SSDT SSDT
acpi0: wakeup devices LID_(S3) SLPB(S3) IGBE(S4) EXP1(S4) EXP2(S4)
EXP3(S4) EXP4(S4) EXP5(S4) EHC1(S3) EHC2(S3) HDEF(S4)
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpiec0 at acpi0
acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Core(TM) i5 CPU M 520 @ 2.40GHz, 2394.48 MHz
cpu0:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,POPCNT,AES,NXE,RDTSCP,LONG,LAHF,PERF,ITSC,SENSOR,ARAT
cpu0: 256KB 64b/line 8-way L2 cache
cpu0: TSC frequency 2394476640 Hz
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 8 var ranges, 88 fixed ranges
cpu0: apic clock running at 133MHz
cpu0: mwait min=64, max=64, C-substates=0.2.1.1, IBE
cpu1 at mainbus0: apid 1 (application processor)
cpu1: Intel(R) Core(TM) i5 CPU M 520 @ 2.40GHz, 2394.01 MHz
cpu1:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,POPCNT,AES,NXE,RDTSCP,LONG,LAHF,PERF,ITSC,SENSOR,ARAT
cpu1: 256KB 64b/line 8-way L2 cache
cpu1: smt 1, core 0, package 0
cpu2 at mainbus0: apid 4 (application processor)
cpu2: Intel(R) Core(TM) i5 CPU M 520 @ 2.40GHz, 2394.01 MHz
cpu2:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,POPCNT,AES,NXE,RDTSCP,LONG,LAHF,PERF,ITSC,SENSOR,ARAT
cpu2: 256KB 64b/line 8-way L2 cache
cpu2: smt 0, core 2, package 0
cpu3 at mainbus0: apid 5 (application processor)
cpu3: Intel(R) Core(TM) i5 CPU M 520 @ 2.40GHz, 2394.01 MHz
cpu3:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,POPCNT,AES,NXE,RDTSCP,LONG,LAHF,PERF,ITSC,SENSOR,ARAT
cpu3: 256KB 64b/line 8-way L2 cache
cpu3: smt 1, core 2, package 0
ioapic0 at mainbus0: apid 1 pa 0xfec00000, version 20, 24 pins
acpimcfg0 at acpi0 addr 0xe0000000, bus 0-255
acpihpet0 at acpi0: 14318179 Hz
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus -1 (PEG_)
acpiprt2 at acpi0: bus 13 (EXP1)
acpiprt3 at acpi0: bus -1 (EXP2)
acpiprt4 at acpi0: bus -1 (EXP3)
acpiprt5 at acpi0: bus 5 (EXP4)
acpiprt6 at acpi0: bus 2 (EXP5)
acpicpu0 at acpi0: C3(***@245 ***@0x20), C2(***@205 ***@0x10),
C1(***@3 mwait.1), PSS
acpicpu1 at acpi0: C3(***@245 ***@0x20), C2(***@205 ***@0x10),
C1(***@3 mwait.1), PSS
acpicpu2 at acpi0: C3(***@245 ***@0x20), C2(***@205 ***@0x10),
C1(***@3 mwait.1), PSS
acpicpu3 at acpi0: C3(***@245 ***@0x20), C2(***@205 ***@0x10),
C1(***@3 mwait.1), PSS
acpipwrres0 at acpi0: PUBS, resource for EHC1, EHC2
acpitz0 at acpi0: critical temperature is 100 degC
acpibtn0 at acpi0: LID_
acpibtn1 at acpi0: SLPB
"PNP0303" at acpi0 not configured
"LEN0018" at acpi0 not configured
"SMO1200" at acpi0 not configured
acpibat0 at acpi0: BAT0 model "42T4837" serial 50934 type LION oem "LGC"
acpiac0 at acpi0: AC unit offline
acpithinkpad0 at acpi0
"PNP0C14" at acpi0 not configured
acpidock0 at acpi0: GDCK not docked (0)
acpivideo0 at acpi0: VID_
acpivout0 at acpivideo0: LCD0
acpivideo1 at acpi0: VID_
cpu0: Enhanced SpeedStep 2394 MHz: speeds: 2400, 2399, 2266, 2133, 1999,
1866, 1733, 1599, 1466, 1333, 1199 MHz
pci0 at mainbus0 bus 0
pchb0 at pci0 dev 0 function 0 "Intel Core Host" rev 0x02
inteldrm0 at pci0 dev 2 function 0 "Intel HD Graphics" rev 0x02
drm0 at inteldrm0
intagp0 at inteldrm0
agp0 at intagp0: aperture at 0xd0000000, size 0x10000000
inteldrm0: msi
inteldrm0: 1280x800, 32bpp
wsdisplay0 at inteldrm0 mux 1: console (std, vt100 emulation)
wsdisplay0: screen 1-5 added (std, vt100 emulation)
"Intel 3400 MEI" rev 0x06 at pci0 dev 22 function 0 not configured
puc0 at pci0 dev 22 function 3 "Intel 3400 KT" rev 0x06: ports: 1 com
com4 at puc0 port 0 apic 1 int 17: ns16550a, 16 byte fifo
com4: probed fifo depth: 0 bytes
em0 at pci0 dev 25 function 0 "Intel 82577LM" rev 0x06: msi, address
f0:de:f1:11:3c:7e
ehci0 at pci0 dev 26 function 0 "Intel 3400 USB" rev 0x06: apic 1 int 23
usb0 at ehci0: USB revision 2.0
uhub0 at usb0 configuration 1 interface 0 "Intel EHCI root hub" rev
2.00/1.00 addr 1
azalia0 at pci0 dev 27 function 0 "Intel 3400 HD Audio" rev 0x06: msi
azalia0: codecs: Conexant/0x5069, Intel/0x2804, using Conexant/0x5069
audio0 at azalia0
ppb0 at pci0 dev 28 function 0 "Intel 3400 PCIE" rev 0x06: msi
pci1 at ppb0 bus 13
ppb1 at pci0 dev 28 function 3 "Intel 3400 PCIE" rev 0x06: msi
pci2 at ppb1 bus 5
ppb2 at pci0 dev 28 function 4 "Intel 3400 PCIE" rev 0x06: msi
pci3 at ppb2 bus 2
iwn0 at pci3 dev 0 function 0 "Intel Centrino Ultimate-N 6300" rev 0x35:
msi, MIMO 3T3R, MoW, address 00:24:d7:46:03:bc
ehci1 at pci0 dev 29 function 0 "Intel 3400 USB" rev 0x06: apic 1 int 19
usb1 at ehci1: USB revision 2.0
uhub1 at usb1 configuration 1 interface 0 "Intel EHCI root hub" rev
2.00/1.00 addr 1
ppb3 at pci0 dev 30 function 0 "Intel 82801BAM Hub-to-PCI" rev 0xa6
pci4 at ppb3 bus 14
pcib0 at pci0 dev 31 function 0 "Intel QM57 LPC" rev 0x06
ahci0 at pci0 dev 31 function 2 "Intel 3400 AHCI" rev 0x06: msi, AHCI 1.3
ahci0: port 0: 3.0Gb/s
scsibus1 at ahci0: 32 targets
sd0 at scsibus1 targ 0 lun 0: <ATA, WDC WD1600BEKT-0, 02.0> SCSI3
0/direct fixed naa.50014ee2059f90bd
sd0: 152627MB, 512 bytes/sector, 312581808 sectors
ichiic0 at pci0 dev 31 function 3 "Intel 3400 SMBus" rev 0x06: apic 1 int 23
iic0 at ichiic0
spdmem0 at iic0 addr 0x50: 2GB DDR3 SDRAM PC3-10600 SO-DIMM
spdmem1 at iic0 addr 0x51: 2GB DDR3 SDRAM PC3-10600 SO-DIMM
itherm0 at pci0 dev 31 function 6 "Intel 3400 Thermal" rev 0x06
isa0 at pcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5 irq 1 irq 12
pckbd0 at pckbc0 (kbd slot)
wskbd0 at pckbd0: console keyboard, using wsdisplay0
pms0 at pckbc0 (aux slot)
wsmouse0 at pms0 mux 0
wsmouse1 at pms0 mux 0
pms0: Synaptics touchpad, firmware 7.4
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
aps0 at isa0 port 0x1600/31
pci5 at mainbus0 bus 255
pchb1 at pci5 dev 0 function 0 "Intel QuickPath" rev 0x02
pchb2 at pci5 dev 0 function 1 "Intel QuickPath" rev 0x02
pchb3 at pci5 dev 2 function 0 "Intel QPI Link" rev 0x02
pchb4 at pci5 dev 2 function 1 "Intel QPI Physical" rev 0x02
pchb5 at pci5 dev 2 function 2 "Intel Reserved" rev 0x02
pchb6 at pci5 dev 2 function 3 "Intel Reserved" rev 0x02
vmm0 at mainbus0: VMX/EPT
uhub2 at uhub0 port 1 configuration 1 interface 0 "Intel Rate Matching
Hub" rev 2.00/0.00 addr 2
ugen0 at uhub2 port 3 "UPEK Biometric Coprocessor" rev 1.01/0.02 addr 3
uvideo0 at uhub2 port 6 configuration 1 interface 0 "Chicony Electronics
Co., Ltd. Integrated Camera" rev 2.00/23.45 addr 4
video0 at uvideo0
uhub3 at uhub1 port 1 configuration 1 interface 0 "Intel Rate Matching
Hub" rev 2.00/0.00 addr 2
vscsi0 at root
scsibus2 at vscsi0: 256 targets
softraid0 at root
scsibus3 at softraid0: 256 targets
sd1 at scsibus3 targ 1 lun 0: <OPENBSD, SR CRYPTO, 006> SCSI2 0/direct fixed
sd1: 152624MB, 512 bytes/sector, 312575168 sectors
root on sd1a (23e691dd1ff29ca6.a) swap on sd1b dump on sd1b
Ricardo Mestre
2017-06-21 10:16:55 UTC
Permalink
Hi,

I can confirm this issue, and the diff below seems to solve it for me.

Could you please test it and let us know if it works on your side?

Reason: In clientloop.c during client_loop() this function calls
client_simple_escape_filter() which then calls process_escapes() which in turn
fork()s the process. That being said, the pledge inside client_loop which
applies to this code path lacks the proc promise and therefore aborts ssh.

Index: clientloop.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/clientloop.c,v
retrieving revision 1.299
diff -u -p -u -r1.299 clientloop.c
--- clientloop.c 31 May 2017 09:15:42 -0000 1.299
+++ clientloop.c 21 Jun 2017 10:14:26 -0000
@@ -1246,7 +1246,7 @@ client_loop(int have_pty, int escape_cha

} else {
debug("pledge: network");
- if (pledge("stdio unix inet dns tty", NULL) == -1)
+ if (pledge("stdio unix inet dns proc tty", NULL) == -1)
fatal("%s pledge(): %s", __func__, strerror(errno));
}
Grégoire Jadi
2017-06-22 19:37:32 UTC
Permalink
Post by Ricardo Mestre
Hi,
I can confirm this issue, and the diff below seems to solve it for me.
Could you please test it and let us know if it works on your side?
It does fix the issue. Thanks you.
Post by Ricardo Mestre
Reason: In clientloop.c during client_loop() this function calls
client_simple_escape_filter() which then calls process_escapes() which in turn
fork()s the process. That being said, the pledge inside client_loop which
applies to this code path lacks the proc promise and therefore aborts ssh.
Index: clientloop.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/clientloop.c,v
retrieving revision 1.299
diff -u -p -u -r1.299 clientloop.c
--- clientloop.c 31 May 2017 09:15:42 -0000 1.299
+++ clientloop.c 21 Jun 2017 10:14:26 -0000
@@ -1246,7 +1246,7 @@ client_loop(int have_pty, int escape_cha
} else {
debug("pledge: network");
- if (pledge("stdio unix inet dns tty", NULL) == -1)
+ if (pledge("stdio unix inet dns proc tty", NULL) == -1)
fatal("%s pledge(): %s", __func__, strerror(errno));
}
Jeremie Courreges-Anglas
2017-06-22 23:34:33 UTC
Permalink
Post by Grégoire Jadi
Post by Ricardo Mestre
Hi,
I can confirm this issue, and the diff below seems to solve it for me.
Could you please test it and let us know if it works on your side?
It does fix the issue. Thanks you.
Post by Ricardo Mestre
Reason: In clientloop.c during client_loop() this function calls
client_simple_escape_filter() which then calls process_escapes() which in turn
fork()s the process. That being said, the pledge inside client_loop which
applies to this code path lacks the proc promise and therefore aborts ssh.
At first I couldn't reproduce the crash since I'm using "ControlMaster
auto". Since all the other pledge calls specify "proc", I don't think
Post by Grégoire Jadi
Post by Ricardo Mestre
Index: clientloop.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/clientloop.c,v
retrieving revision 1.299
diff -u -p -u -r1.299 clientloop.c
--- clientloop.c 31 May 2017 09:15:42 -0000 1.299
+++ clientloop.c 21 Jun 2017 10:14:26 -0000
@@ -1246,7 +1246,7 @@ client_loop(int have_pty, int escape_cha
} else {
debug("pledge: network");
- if (pledge("stdio unix inet dns tty", NULL) == -1)
+ if (pledge("stdio unix inet dns proc tty", NULL) == -1)
fatal("%s pledge(): %s", __func__, strerror(errno));
}
--
jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF DDCC 0DFA 74AE 1524 E7EE
Ricardo Mestre
2017-06-23 07:26:32 UTC
Permalink
committed, thanks for the report Gregoire!
Post by Jeremie Courreges-Anglas
Post by Grégoire Jadi
Post by Ricardo Mestre
Hi,
I can confirm this issue, and the diff below seems to solve it for me.
Could you please test it and let us know if it works on your side?
It does fix the issue. Thanks you.
Post by Ricardo Mestre
Reason: In clientloop.c during client_loop() this function calls
client_simple_escape_filter() which then calls process_escapes() which in turn
fork()s the process. That being said, the pledge inside client_loop which
applies to this code path lacks the proc promise and therefore aborts ssh.
At first I couldn't reproduce the crash since I'm using "ControlMaster
auto". Since all the other pledge calls specify "proc", I don't think
Loading...