Re: Crash noticed multiple times using libssh 0.3.4

[Aris Adamantiadis <aris@xxxxxxxxxxxx>]

Hello Uday,

I think I found the source of the problem. Somewhere in the
enter_function() or leave_function(), a counter is underflowed (the
current indentation level). Could you test the attached patch ? It
doesn't resolve the indentation problem but stop it from crashing the
process. Seeing your log, it seem the problem is in ssh_connect_host.

Thanks for your feedback, if the patch is helping, we'll commit it.

Regards,

Aris

Uday Tennety a écrit :
> Hello Aris,
> I made changes to our code and added mutex for the read and write blocks
> for a particular session. During my testing, I still see the libssh
> crashing at times. Also, I found that it always crashes at the following
> location:
> A call to the function ssh_log() is made from function ssh_connect in
> client.c  Could it be that the session is getting corrupted at some
> point? Can you give me some pointers looking at this Log.
> 
> Thanks for your help.
> Uday.
> 
> t@133 (l@133) terminated by signal ABRT (Abort)
> 0xff2c16e8: __lwp_kill+0x0008:  bcc,a,pt  %icc,__lwp_kill+0x18  !
> 0xff2c16f8
> Current function is ssh_log
>   67         memset(indent, ' ', min);
> --------------------------------------------------
> 
> current thread: t@133
>  [1] __lwp_kill(0x0, 0x6, 0x0, 0x6, 0xfc00, 0x0), at 0xff2c16e8
>  [2] raise(0x6, 0x0, 0xff2a4d28, 0xffffffff, 0xff2e8298, 0x6), at
> 0xff25ff38
>  [3] abort(0x2d740, 0x1, 0xfeb00ab0, 0xa8244, 0xff2eb298, 0x0), at
> 0xff240158
>  [4] os::abort(0x1, 0xfedca58c, 0x1, 0xfedb2000, 0x1858c, 0x18400), at
> 0xfeaf67b4
>  [5] VMError::report_and_die(0xfeded4a8, 0x0, 0x1, 0xfed6095b,
> 0xfed67006, 0xfedf2ce8), at 0xfec088d8
>  [6] JVM_handle_solaris_signal(0xb, 0xdec7d670, 0xdec7d3b8, 0xafc00,
> 0x0, 0x0), at 0xfe5b91e8
>  [7] __sighndlr(0xb, 0xdec7d670, 0xdec7d3b8, 0xfe5b8724, 0x0, 0x1), at
> 0xff2c0620
>  ---- called from signal handler with signal 11 (SIGSEGV) ------
>  [8] _memset(0xdec7d758, 0x20202020, 0xffffffd7, 0x17, 0xffffd740,
> 0xdec80000), at 0xff351040
> =>[9] ssh_log(session = 0x20202020, verbosity = 538976288, format =
> 0x20202020 "<bad address 0x20202020>", ...), line 67 in "log.c"
>  [10] ssh_connect(session = 0x20202020), line 510 in "client.c"
> 
> 
> 
> 
> 
> Uday Tennety wrote:
>> Hello Aris,
>> Thanks for your inputs. I'll make the changes to my code adding mutex
>> and let you know if I see any issues.
>>
>> Thanks,
>> Uday.
>>
>> Aris Adamantiadis wrote:
>>> ouch that reply-to catches me every time...
>>>  
>>> ------------------------------------------------------------------------
>>>
>>> Subject:
>>> Re: [Fwd: Re: Crash noticed multiple times using libssh 0.3.4]
>>> From:
>>> Aris Adamantiadis <aris@xxxxxxxxxxxx>
>>> Date:
>>> Tue, 19 Jan 2010 09:56:01 +0100
>>> To:
>>> uday.tennety@xxxxxxxxxxxxxx
>>>
>>> To:
>>> uday.tennety@xxxxxxxxxxxxxx
>>>
>>>
>>> Uday Tennety a écrit :
>>>  
>>>> Hello Aris,
>>>> I tried initialization using ssh_init() before calling any of the ssh
>>>> functions but I still notice the crash. I've attached the relevant log
>>>> statements. We're actually using one thread to read from the channel
>>>> and
>>>> another thread to write. Do you think this might be the reason for the
>>>> crash? If so, what kind of workarounds do you recommend?
>>>>
>>>>     
>>> Hi Uday,
>>>
>>> I still have to analyze the log you provided, but by what you describe,
>>> the problem is that you're using two libssh function at same time on
>>> functions that are not threadsafe on the same channel.
>>>
>>> I would recommend the use of a mutex in your own code, in order to
>>> access only one libssh function at a time (at least on a single session,
>>> there is normally no problem on different sessions).
>>>
>>> Do not hesitate to ask if you need any help.
>>>
>>> Regards,
>>>
>>> Aris
>>>
>>>   
>>
> 

diff -ur libssh-0.3.4/include/libssh/priv.h libssh-0.3.4-patch/include/libssh/priv.h
--- libssh-0.3.4/include/libssh/priv.h	2009-09-14 19:02:27.000000000 +0200
+++ libssh-0.3.4-patch/include/libssh/priv.h	2010-01-26 13:37:37.000000000 +0100
@@ -238,7 +238,7 @@
 
 struct error_struct {
 /* error handling */
-    int error_code;
+    unsigned int error_code;
     char error_buffer[ERROR_BUFFERLEN];
 };