From P.Klenze@gsi.de Mon Sep 21 11:19:03 2026 Received: (at 1637) by bugs.x2go.org; 21 Sep 2026 09:19:14 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.0 (2022-12-13) on ymir.das-netzwerkteam.de X-Spam-Level: X-Spam-Status: No, score=-1.9 required=3.0 tests=BAYES_00,DMARC_PASS, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_ZEN_BLOCKED_OPENDNS,SPF_HELO_PASS, URIBL_BLOCKED,URIBL_DBL_BLOCKED_OPENDNS autolearn=ham autolearn_force=no version=4.0.0 Received: from lxmtout2.gsi.de (lxmtout2.gsi.de [140.181.3.112]) by ymir.das-netzwerkteam.de (Postfix) with ESMTPS id 8F1215DB22 for <1637@bugs.x2go.org>; Mon, 21 Sep 2026 11:19:01 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by lxmtout2.gsi.de (Postfix) with ESMTP id 13B6C2030FB8 for <1637@bugs.x2go.org>; Mon, 21 Sep 2026 11:19:01 +0200 (CEST) X-Virus-Scanned: Debian amavis at lxmtout2.gsi.de Received: from lxmtout2.gsi.de ([127.0.0.1]) by localhost (lxmtout2.gsi.de [127.0.0.1]) (amavis, port 10024) with LMTP id uHc2GPsQq69u for <1637@bugs.x2go.org>; Mon, 21 Sep 2026 11:19:00 +0200 (CEST) Received: from srvEX6.campus.gsi.de (unknown [10.10.4.96]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by lxmtout2.gsi.de (Postfix) with ESMTPS id EC63B2030FB7 for <1637@bugs.x2go.org>; Mon, 21 Sep 2026 11:19:00 +0200 (CEST) Received: from [172.21.22.3] (140.181.3.12) by srvEX6.campus.gsi.de (10.10.4.96) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Mon, 21 Sep 2026 11:18:56 +0200 Content-Type: multipart/mixed; boundary="------------21vSD8a7qjq0X0DZ7wDL92vy" Message-ID: <604fa589-00f9-4744-9d54-df68458b54e6@gsi.de> Date: Mon, 21 Sep 2026 11:18:50 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: <1637@bugs.x2go.org> Content-Language: en-US From: Philipp Klenze Subject: Re: [llm-coauthored] Intermittent SIGSEGV in ssh_select()/ssh_event_add_session() from SshMasterConnection::channelLoop() -- follow-up with a patch and root cause X-Originating-IP: [140.181.3.12] X-ClientProxiedBy: srvex5.Campus.gsi.de (10.10.4.95) To srvEX6.campus.gsi.de (10.10.4.96) --------------21vSD8a7qjq0X0DZ7wDL92vy Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 7bit Spend a few more tokens to fix this. Note that I have not carefully verified the patch, but it seems to fix both of the segfaults I encountered (but still does not make resume work, that is a problem on the server side). I also encountered an infinite loop (100% CPU usage while trying in vain to start the proxy), but did not generate a patch for that yet, let me know if you want one. Cheers, Philipp -------------------------------------------------------------------- NOTE ON HOW THIS FOLLOW-UP WAS PRODUCED -------------------------------------------------------------------- Same as the original report: debugging and patch drafting done together with an LLM assistant (Claude) at my direction. I built, ran, and verified everything myself. Flagging this again per the original subject tag. -------------------------------------------------------------------- SUMMARY -------------------------------------------------------------------- Root cause found and fixed. The crash was NOT a libssh bug or a generic race -- it was a x2goclient-side logic bug in SshMasterConnection::createChannelConnection() / channelLoop(), specifically a dangling-pointer bug in the array x2goclient hands to ssh_select(). Two distinct issues in that area, both patched below. I've been running the patched build since and no longer see this crash, including in a case that previously crashed within seconds of "resuming normal session". -------------------------------------------------------------------- ROOT CAUSE #1: stale channel pointer not cleared on error -------------------------------------------------------------------- In createChannelConnection() (src/sshmasterconnection.cpp), when ssh_channel_open_session() or ssh_channel_request_exec() fails after a channel has already been stored via channelConnections[i].channel = channel; the error paths do: ssh_channel_free (channel); ... return (false); without resetting channelConnections[i].channel back to 0. The caller in channelLoop() just does "continue;" on failure, so the stale entry survives. On the *next* pass, createChannelConnection() checks: if ( channelConnections.at ( i ).channel==0l ) which is false (the pointer is non-null, just freed), so the "create a new channel" branch is skipped entirely, and the dangling pointer is handed straight to ssh_select() via read_chan[i]. Confirmed with valgrind: an ssh_channel allocated and freed with both call sites inside channelLoop() itself, then read again on the very next ssh_select() pass. Fix: explicitly reset channelConnections[i].channel = 0l on both error paths, right after ssh_channel_free(). -------------------------------------------------------------------- ROOT CAUSE #2: uninitialized array slot on same-iteration failure -------------------------------------------------------------------- Separately, in channelLoop(): ssh_channel* read_chan=new ssh_channel[channelConnections.size() +1]; ssh_channel* out_chan=new ssh_channel[channelConnections.size() +1]; read_chan[channelConnections.size() ]=NULL; new T[n] does not zero-initialize a plain pointer array. For any index whose createChannelConnection() call fails and returns early (before reaching the "read_chan[i] = ..." line at the end of that function), read_chan[i] is left as raw heap garbage, not NULL -- so ssh_select()'s NULL-terminated scan of the array walks straight into it. This one can crash within a single channelLoop() iteration, with no prior history needed, which is what I saw when a channel failed immediately on session resume. Fix: value-initialize both arrays ("new ssh_channel[n]()") so every untouched slot starts NULL rather than garbage. -------------------------------------------------------------------- PATCH -------------------------------------------------------------------- Both fixes, against the 4.1.2.3 source tree (attached in full as x2goclient-dangling-channel-v2.patch; apply with "patch -p0" from the top of the source tree): --- src/sshmasterconnection.cpp.orig +++ src/sshmasterconnection.cpp @@ -2205,6 +2205,11 @@ /* Free channel. */ ssh_channel_free (channel); + /* Local patch: without this, channelConnections[i].channel + * keeps pointing at freed memory, and the next loop + * iteration's "channel==0l" check wrongly treats it as + * still valid, handing a dangling pointer straight to + * ssh_select(). */ + channelConnections[i].channel = 0l; emit ioErr ( channelConnections[i].creator, errorMsg, err ); x2goDebug<