[Bug 160] New: Race condition in clientloop.c?

[bugzilla-daemon at mindrot.org]

http://bugzilla.mindrot.org/show_bug.cgi?id=160

           Summary: Race condition in clientloop.c?
           Product: Portable OpenSSH
           Version: 3.0.2p1
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: major
          Priority: P2
         Component: ssh
        AssignedTo: openssh-unix-dev at mindrot.org
        ReportedBy: Nicolas.Williams at ubsw.com


We sometimes see SCP exit while leaving a hung SSH behind. SSH is left stuck in
a poll()/select() waiting for the SSH connection socket to be readable.

Nothing in the -v -v -v output is untoward. The server-side sshd -d -d -d output
is the same whether the client hangs or not. In either case the client and
server both close and free the last open channel (the session channel).

See the "scp completes but ssh subprocess in deadlock with sshd" thread on the
openssh-unix-dev post list.

I will attach a tar file containing ssh -vvv and ssh -ddd output, lsof output,
etc... for good scps and hanging sshs. Note that a select() wrapper was
LD_PRELOADed into ssh that prints the list of file descriptors being selected
for in every call to select(); source will be attached.

This bug appears to be a race condition in the client. Versions of OpenSSH
affected apparently include 2.9p2, 3.0.2p1 and 3.1p1.

See these openssh-unix-dev posts:

http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=101588612615615&w=2
http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=101596073221780&w=2



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.