OpenSSH
[Top] [All Lists]

Re: sshd gets stuck: select() in packet_read_seqnr waits indefinitely

To: Matt Day <opensshbugs@fjarlq.com>
Subject: Re: sshd gets stuck: select() in packet_read_seqnr waits indefinitely
From: Darren Tucker <dtucker@zip.com.au>
Date: Thu, 15 Mar 2007 13:43:47 +1100
Cc: openssh-unix-dev@mindrot.org
Delivered-to: sp-com-lists@consult.net
Delivered-to: openssh-unix-dev-list1@securepoint.com
Delivered-to: openssh-unix-dev-tmda@mindrot.org
Delivered-to: openssh-unix-dev@mindrot.org
In-reply-to: <20070315011208.GA48513@fjarlq.com>
List-archive: <http://lists.mindrot.org/pipermail/openssh-unix-dev>
List-help: <mailto:openssh-unix-dev-request@mindrot.org?subject=help>
List-id: Development of portable OpenSSH <openssh-unix-dev.mindrot.org>
List-post: <mailto:openssh-unix-dev@mindrot.org>
List-subscribe: <http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev>, <mailto:openssh-unix-dev-request@mindrot.org?subject=subscribe>
List-unsubscribe: <http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev>, <mailto:openssh-unix-dev-request@mindrot.org?subject=unsubscribe>
References: <20070314185309.GA40932@fjarlq.com> <20070315001416.GA28880@gate.dtucker.net> <20070315011208.GA48513@fjarlq.com>
Reply-to: dtucker@zip.com.au
Sender: openssh-unix-dev-bounces+openssh-unix-dev-list1=securepoint.com@mindrot.org
User-agent: Mutt/1.5.11
On Wed, Mar 14, 2007 at 07:12:09PM -0600, Matt Day wrote:
> On Thu, Mar 15, 2007 at 11:14:16AM +1100, Darren Tucker wrote:
> > You could try the attached patch.
> 
> Oh, cool...thanks for the fast response!
> 
> I have a question about the patch. With it applied, packet_read_seqnr
> now reads:
> 
>         /* Wait for some data to arrive. */
>         while (select(connection_in + 1, setp, NULL, NULL,
>             packet_wait_tvp) == -1 &&
>             (errno == EAGAIN || errno == EINTR))
>                 ;
> 
>         /* Read data from the socket. */
>         len = read(connection_in, buf, sizeof(buf));
>         ...

> On FreeBSD, select() will return 0 upon timeout, so packet_read_seqnr
> would end up calling read() even though the descriptor isn't ready,
> so I think it would block.

The descriptor is O_NONBLOCK (set by packet_set_nonblocking()), so the
read() should return -1 with errno == EWOULDBLOCK or EAGAIN.

> Similarly, I don't see how a select() timeout would cause packet_write_wait
> to abort. Instead it would call packet_write_poll (which calls write())
> even though the descriptor isn't ready for writing. Am I missing something?

The next couple of lines after the ones you quoted are:

        if (len == 0) {
                logit("Connection closed by %.200s", get_remote_ipaddr());
                cleanup_exit(255);
        }
        if (len < 0)
                fatal("Read from socket failed: %.100s", strerror(errno));

len should be -1 in the case of a timeout, so that should kill the
connection (I've not tested it).

You could test for EWOULDBLOCK or EAGAIN and provide a more informative
error message, though.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

<Prev in Thread] Current Thread [Next in Thread>