Bug#1103418: openssh-server irregularly crashing since 10.0p1 upgrade

Michel Casabona <[email protected]> Wed, 30 Apr 2025 14:08:47 +0200

Newsgroups	gmane.linux.debian.devel.ssh
Message-ID	<f8fa0b16-04af-4189-a26e-e3272688fa38__48361.4964455896$1746015147$gmane$org@free.fr>

Le 30/04/2025 à 13:42, Colin Watson a écrit :

> Is that the complete output from valgrind, or did you edit it down? It's 
> tantalizingly close to being useful, but it really feels like there 
> should be more of it.  Could I have all of the lines matching 
> "==4019365=="?

Yes, I pasted a few line to post, sorry. The full log is attached below.

Thanks!

openssh-crash-before-banner.txt (text/plain, 8.4 KB)

avril 29 19:57:24 odysseus sshd[4019365]: ==4019365== Memcheck, a memory error detector
avril 29 19:57:24 odysseus sshd[4019365]: ==4019365== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
avril 29 19:57:24 odysseus sshd[4019365]: ==4019365== Using Valgrind-3.24.0 and LibVEX; rerun with -h for copyright info
avril 29 19:57:24 odysseus sshd[4019365]: ==4019365== Command: /usr/lib/openssh/sshd-session -D -R
avril 29 19:57:24 odysseus sshd[4019365]: ==4019365==
avril 29 19:57:25 odysseus sshd-session[4019365]: Connection from fe80::...%br0 port 33120 on fe80::...%br0 port 22 rdomain "br0"
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== Cannot map memory to grow the stack for thread #1 to 0x1ffeffc000
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== Process terminating with default action of signal 11 (SIGSEGV): dumping core
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==  Access not within mapped region at address 0x1FFEFFCD78
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== Cannot map memory to grow the stack for thread #1 to 0x1ffeffc000
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    at 0x1BCBC9: glob0 (glob.c:476)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==  If you believe this happened as a result of a stack
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==  overflow in your program's main thread (unlikely but
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==  possible), you can try to increase the size of the
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==  main thread stack using the --main-stacksize= flag.
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==  The main thread stack size used in this run was 8388608.
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== HEAP SUMMARY:
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==     in use at exit: 518,960 bytes in 5,557 blocks
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==   total heap usage: 8,551 allocs, 2,994 frees, 1,232,620 bytes allocated
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== 832 (64 direct, 768 indirect) bytes in 1 blocks are definitely lost in loss record 980 of 1,057
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    at 0x484BBA3: calloc (vg_replace_malloc.c:1675)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x158628: sshbuf_new (sshbuf.c:97)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x11998C: pack_hostkeys (sshd-session.c:313)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x13A3C8: mm_answer_state (monitor.c:626)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x13D66D: monitor_read (monitor.c:550)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x140B95: monitor_child_preauth (monitor.c:319)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x118620: privsep_preauth (sshd-session.c:367)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x118620: main (sshd-session.c:1320)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== 4,608 bytes in 2 blocks are possibly lost in loss record 1,040 of 1,057
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    at 0x4844818: malloc (vg_replace_malloc.c:446)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x4022605: malloc (rtld-malloc.h:56)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x4022605: _dlfo_mappings_segment_allocate (dl-find_object.c:217)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x4022605: _dl_find_object_update_1 (dl-find_object.c:680)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x4022605: _dl_find_object_update (dl-find_object.c:814)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x400C5E7: dl_open_worker_begin (dl-open.c:714)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x4002398: _dl_catch_exception (dl-catch.c:241)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x400B9A7: dl_open_worker (dl-open.c:761)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x4002398: _dl_catch_exception (dl-catch.c:241)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x400BDA7: _dl_open (dl-open.c:874)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x5169257: dlopen_doit (dlopen.c:56)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x4002398: _dl_catch_exception (dl-catch.c:241)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x40024BE: _dl_catch_error (dl-catch.c:260)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x5168D66: _dlerror_run (dlerror.c:138)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x5169308: dlopen_implementation (dlopen.c:71)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x5169308: dlopen@@GLIBC_2.34 (dlopen.c:81)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== 4,928 (64 direct, 4,864 indirect) bytes in 1 blocks are definitely lost in loss record 1,043 of 1,057
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    at 0x484BBA3: calloc (vg_replace_malloc.c:1675)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x158628: sshbuf_new (sshbuf.c:97)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x13A332: mm_answer_state (monitor.c:611)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x13D66D: monitor_read (monitor.c:550)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x140B95: monitor_child_preauth (monitor.c:319)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x118620: privsep_preauth (sshd-session.c:367)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    by 0x118620: main (sshd-session.c:1320)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== LEAK SUMMARY:
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    definitely lost: 128 bytes in 2 blocks
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    indirectly lost: 5,632 bytes in 2 blocks
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==      possibly lost: 4,608 bytes in 2 blocks
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==    still reachable: 508,484 bytes in 5,550 blocks
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==         suppressed: 108 bytes in 1 blocks
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== Reachable blocks (those to which a pointer was found) are not shown.
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== To see them, rerun with: --leak-check=full --show-leak-kinds=all
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365==
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== For lists of detected and suppressed errors, rerun with: -s
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== ERROR SUMMARY: 3 errors from 3 contexts (suppressed: 0 from 0)
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== could not unlink /tmp/vgdb-pipe-from-vgdb-to-4019365-by-root-on-???
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== could not unlink /tmp/vgdb-pipe-to-vgdb-from-4019365-by-root-on-???
avril 29 19:57:25 odysseus sshd[4019365]: ==4019365== could not unlink /tmp/vgdb-pipe-shared-mem-vgdb-4019365-by-root-on-???
avril 29 19:57:25 odysseus systemd-coredump[4019403]: Process 4019365 (memcheck-amd64-) of user 0 terminated abnormally with signal 11/SEGV, processing...
avril 29 19:57:25 odysseus systemd[1]: Started [email protected] - Process Core Dump (PID 4019403/UID 0).
avril 29 19:57:25 odysseus systemd-coredump[4019404]: Resource limits disable core dumping for process 4019365 (memcheck-amd64-).
avril 29 19:57:25 odysseus systemd-coredump[4019404]: [🡕] Process 4019365 (memcheck-amd64-) of user 0 terminated abnormally without generating a coredump.
avril 29 19:57:25 odysseus systemd[1]: [email protected]: Deactivated successfully.
avril 29 19:57:25 odysseus sshd[3617816]: error: session process 4019365 for connection from fe80::...%br0 to fe80::...%br0 killed by signal 11
avril 29 19:57:25 odysseus sshd[3617816]: srclimit_penalise: ipv6: new fe80::...%br0/128 active penalty of 90 seconds for penalty: caused crash
avril 29 19:57:48 odysseus sshd[3617816]: drop connection #0 from [fe80::...%br0]:43934 on [fe80::...%br0]:22 penalty: caused crash