sshd crash

[Ian Lepore]

On Fri, 2013-11-01 at 21:36 +0800, Howard Su wrote:
> I running freebsd in BeagleBone Black.
> root at beaglebone:~ # uname -a
> FreeBSD beaglebone 11.0-CURRENT FreeBSD 11.0-CURRENT #0 r257039: Thu Oct 24
> 11:39:07 CET 2013
> root at testbed:/usr/home/howard/bbb/crochet-freebsd/work/obj/arm.armv6/usr/src/sys/BEAGLEBONE
> arm
> 
> debug1: HPN Disabled: 0, HPN Buffer Size: 65536
> debug1: Client protocol version 2.0; client software version
> PuTTY_Release_0.63
> debug1: no match: PuTTY_Release_0.63
> debug1: Enabling compatibility mode for protocol 2.0
> debug1: Local version string SSH-2.0-OpenSSH_6.3_hpn13v11 FreeBSD-20130918
> debug1: permanently_set_uid: 22/22 [preauth]
> debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256 [preauth]
> debug1: SSH2_MSG_KEXINIT sent [preauth]
> debug1: SSH2_MSG_KEXINIT received [preauth]
> debug1: kex: client->server aes256-ctr hmac-sha2-256 none [preauth]
> debug1: kex: server->client aes256-ctr hmac-sha2-256 none [preauth]
> debug1: SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received [preauth]
> <jemalloc>: jemalloc_arena.c:387: Failed assertion: "p[i] == 0"
> debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent [preauth]
> debug1: monitor_read_log: child log fd closed
> debug1: do_cleanup
> debug1: Killing privsep child 807
> 
> I find the workaround with the history, add UsePrivilegeSeparation no into
> /etc/ssh/sshd_config. I just wondering if anyone is working on this issue?
> I would like to dig into more details if no one is active looking at this.
> 

Several people investigated this (pretty extensively) and didn't come up
with a solution, or even a good suspect.  We haven't forgotten it by any
means, but I don't think anyone is knocking themselves out on it right
now either.

A fresh look may be exactly what's needed, so feel free to dig into it.

I'll summarize what I remember...  It happens on armv4 and armv6.  It
happens when kernel and world are built with clang or gcc.  It happens
with eabi and oabi.

What I can't remember is whether anyone has bisected things down to a
changeset or timeframe when the problem showed up.

-- Ian