Subject: core dump when calling libssh2_session_disconnect when sftp server timeout

core dump when calling libssh2_session_disconnect when sftp server timeout

From: Ahmad Zaidee Abu <zaideeabu_at_gmail.com>
Date: Fri, 16 Dec 2011 22:04:27 +0800

Hi expert,

We have a daemon application on HP-UX 11iv3 which uses libssh2 to connect
to sftp server for file transfer.
The application works well with cc: HP C/aC++ B3910B A.06.20 but core dump
due to SIGPIPE error when compiled with another machine with cc: HP C/aC++
B3910B A.06.25.

From stack trace, the problem seems to be due to libssh2_session_disconnect
which eventually called libc read() function which is causing SIGPIPE and
core dump.

The scenario is as below:

1. Client create an sftp connection to sftp-server with idle timeout set.
2. During idle time, sftp server disconnect the connection.
3. When client has file to send, it check connection and reconnect if
connection already gone (by checking handle with opendir() ).
4. Prior to reconnect, it will need to clean up existing connection and
part of it is calling the libssh2_session_disconnect which then causing
SIGPIPE error.

This can be reproduce by using libssh2 example code with a bit of change to
wait for timeout (also attached here):
In this case, I set my sftpserver to timeout within 30sec idle time.

int main()
{

// initialization and so on...
. . .

// server timeout set to 30 sec.
fprintf(stderr, "Wait 60 sec for server timeout\n");
sleep(60);

    fprintf(stderr, "libssh2_sftp_open()!\n");
    /* Request a file via SFTP */
    sftp_handle =
        libssh2_sftp_open(sftp_session, sftppath, LIBSSH2_FXF_READ, 0);

    if (!sftp_handle) {
        fprintf(stderr, "Unable to open file with SFTP\n");
        goto check_status;
    }
    fprintf(stderr, "libssh2_sftp_open() is done, now receive data!\n");
    do {
        char mem[1024];

        /* loop until we fail */
        fprintf(stderr, "libssh2_sftp_read()!\n");
        rc = libssh2_sftp_read(sftp_handle, mem, sizeof(mem));
        if (rc > 0) {
            write(1, mem, rc);
        } else {
            break;
        }
    } while (1);

check_status:
fprintf(stderr, "Check SFTP conn status\n");
connection_status(sock);

fprintf(stderr, "Shutting down sftp_session...\n");

    libssh2_sftp_shutdown(sftp_session);

  shutdown:

fprintf(stderr, "Session disconect...\n");
    libssh2_session_disconnect(session, "Normal Shutdown, Thank you for
playing");

fprintf(stderr, "Session free...\n");
    libssh2_session_free(session);

. . .

==============================

The result is:
libssh2_sftp_read()!
Wait 60 sec for server timeout
libssh2_sftp_opendir()!
Unable to open dir "." with SFTP
Check SFTP conn status
Connection seems to be alive (fcntl: 0), continuing check..Connection is
lost (recv -1, 232, Connection reset by peer)Shutting down sftp_session...
Session disconect...
test_sftp> $

** There's no "Session free" test as it core dump.

gdb output:
---------------
Program received signal SIGPIPE, Broken pipe
  si_code: 0 - .
0xc000000000436810:0 in _send_sys+0x30 () from /usr/lib/hpux64/libc.so.1
(gdb) bt
#0 0xc000000000436810:0 in _send_sys+0x30 () from /usr/lib/hpux64/libc.so.1
#1 0xc00000000044ccc0:0 in send+0xe0 () from /usr/lib/hpux64/libc.so.1
#2 0xc0000000014bee90:0 in _libssh2_transport_write+0x8d0 ()
   from /home/xxxx/bin/libssh2.so.1
#3 0xc0000000014a2ef0:0 in session_disconnect+0x3c0 ()
   from /home/xxxx/bin/libssh2.so.1
#4 0xc0000000014a3030:0 in libssh2_session_disconnect_ex+0x50 ()
. . .

Now, the main question, should libssh2 actually handle this kind of
behaviour when libssh2_session_disconnect is called (a bug?) or should
client application skip calling libssh2_session_disconnect if the session
already timed out by the server? Will it be safe for client to skip calling
this function if it detected connection already unavailable in a sense that
will this cause any other issues such as memory leak etc?

This is tested for 1.2.7 & 1.2.8 with the same behavior... and this seems
to happen with SunOS cc: Sun C 5.9 SunOS_sparc Patch 124867-01 2007/07/12
as well.

Hope to get some advice soon...

Thanks & Regards,
zaideeabu

_______________________________________________
libssh2-devel http://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel

Received on 2011-12-16