user/3639: ftp dumps core after login

[Wouter Clarie <wouter.clarie@pandora.be>]

>Number:         3639
>Category:       user
>Synopsis:       ftp dumps core after login
>Confidential:   yes
>Severity:       serious
>Priority:       medium
>Responsible:    bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jan 19 12:00:02 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Wouter Clarie
>Release:        OpenBSD 3.4-stable
>Organization:
>Environment:
	System      : OpenBSD 3.4
	Architecture: OpenBSD.i386
	Machine     : i386
>Description:
	I just upgraded from source to OpenBSD 3.4-stable. Whenever I run
	'ftp', it coredumps after login.

>How-To-Repeat:

# ftp localhost
Trying 127.0.0.1...
Connected to localhost.
220 nucleus.pandora.be FTP server (Version 6.5/OpenBSD) ready.
Name (localhost:root): rimshot
331 Password required for rimshot.
Password:
230- OpenBSD 3.4-stable (GENERIC) #0: Mon Jan 19 09:36:49 CET 2004
230-
230- Welcome to OpenBSD: The proactively secure Unix-like operating system.
230-
230- Please use the sendbug(1) utility to report bugs in the system.
230- Before reporting a bug, please try to reproduce it with the latest
230- version of the code.  With bug reports, please try to ensure that
230- enough information to reproduce the problem is enclosed, and if a
230- known fix for it exists, include that as well.
230-
230 User rimshot logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
Memory fault (core dumped)

# gdb -c ftp.core
GNU gdb 4.16.1
Copyright 1996 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-unknown-openbsd3.4".
Core was generated by `ftp'.
Program terminated with signal 11, Segmentation fault.
#0  0xdeb7745 in ?? ()
(gdb) bt
#0  0xdeb7745 in ?? ()
#1  0x1c01077e in ?? ()
#2  0x1c00d6f5 in ?? ()
#3  0x1c001f41 in ?? ()
#4  0x1c001eb7 in ?? ()
#5  0xcfbf8948 in ?? ()
#6  0x83540000 in ?? ()
Cannot access memory at address 0x643c03.

dmesg:

OpenBSD 3.4-stable (GENERIC) #0: Mon Jan 19 09:36:49 CET 2004
    root@nucleus.pandora.be:/usr/src/sys/arch/i386/compile/GENERIC
cpu0: Intel Pentium 4 ("GenuineIntel" 686-class) 2.61 GHz
cpu0: FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,ACPI,MMX,FXSR,SIMD,SIMD2,SS,HTT,TM,SBF,CNXT-ID
real mem  = 1072476160 (1047340K)
avail mem = 989368320 (966180K)
using 4278 buffers containing 53727232 bytes (52468K) of memory
mainbus0 (root)
bios0 at mainbus0: AT/286+(00) BIOS, date 11/06/03, BIOS32 rev. 0 @ 0xf0010
apm0 at bios0: Power Management spec V1.2
apm0: AC on, battery charge unknown
pcibios0 at bios0: rev. 2.1 @ 0xf0000/0x10000
pcibios0: PCI IRQ Routing Table rev. 1.0 @ 0xf51b0/256 (14 entries)
pcibios0: PCI Interrupt Router at 000:31:0 ("Intel 82801EB/ER LPC" rev 0x00)
pcibios0: PCI bus #2 is the last bus
bios0: ROM list: 0xc0000/0xf400
pci0 at mainbus0 bus 0: configuration mode 1 (no bios)
pchb0 at pci0 dev 0 function 0 "Intel 82865G/PE/P CPU to I/0 Bridge 1" rev 0x02
ppb0 at pci0 dev 1 function 0 "Intel 82865G/PE/P CPU to AGP Bridge" rev 0x02
pci1 at ppb0 bus 1
vga1 at pci1 dev 0 function 0 "Nvidia GeForce FX 5200" rev 0xa1
wsdisplay0 at vga1: console (80x25, vt100 emulation)
wsdisplay0: screen 1-5 added (80x25, vt100 emulation)
uhci0 at pci0 dev 29 function 0 "Intel 82801EB/ER USB" rev 0x02: irq 10
usb0 at uhci0: USB revision 1.0
uhub0 at usb0
uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhci1 at pci0 dev 29 function 1 "Intel 82801EB/ER USB" rev 0x02: irq 5
usb1 at uhci1: USB revision 1.0
uhub1 at usb1
uhub1: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhci2 at pci0 dev 29 function 2 "Intel 82801EB/ER USB" rev 0x02: irq 5
usb2 at uhci2: USB revision 1.0
uhub2 at usb2
uhub2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
uhci3 at pci0 dev 29 function 3 "Intel 82801EB/ER USB" rev 0x02: irq 10
usb3 at uhci3: USB revision 1.0
uhub3 at usb3
uhub3: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub3: 2 ports with 2 removable, self powered
"Intel 82801EB/ER USB" rev 0x02 at pci0 dev 29 function 7 not configured
ppb1 at pci0 dev 30 function 0 "Intel 82801BA AGP" rev 0xc2
pci2 at ppb1 bus 2
"VIA VT6306 FireWire" rev 0x80 at pci2 dev 3 function 0 not configured
skc0 at pci2 dev 5 function 0 "3Com 3c940" rev 0x12: irq 5
skc0: 3Com Gigabit LOM (3C940)
sk0 at skc0 port A: address 00:0c:6e:37:b7:e6
eephy0 at sk0 phy 0: Marvell 88E1000* Gigabit PHY
wi0 at pci2 dev 10 function 0 "Intersil PRISM2.5 Mini-PCI WLAN" rev 0x01: irq 5
wi0: PRISM2.5 ISL3874A(Mini-PCI), Firmware 1.0.7 (primary), 1.3.6 (station), address 00:09:5b:91:b7:60
pcib0 at pci0 dev 31 function 0 "Intel 82801EB/ER LPC" rev 0x02
pciide0 at pci0 dev 31 function 1 "Intel 82801EB/ER IDE" rev 0x02: DMA, channel 0 configured to compatibility, channel 1 configured to compatibility
wd0 at pciide0 channel 0 drive 0: <Maxtor 6Y080L0>
wd0: 16-sector PIO, LBA, 78167MB, 16383 cyl, 16 head, 63 sec, 160086528 sectors
wd1 at pciide0 channel 0 drive 1: <Maxtor 6Y120L0>
wd1: 16-sector PIO, LBA, 117246MB, 16383 cyl, 16 head, 63 sec, 240121728 sectors
wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 5
wd1(pciide0:0:1): using PIO mode 4, Ultra-DMA mode 5
wd2 at pciide0 channel 1 drive 0: <QUANTUM FIREBALL CR4.3A>
wd2: 16-sector PIO, LBA, 4110MB, 14848 cyl, 9 head, 63 sec, 8418816 sectors
atapiscsi0 at pciide0 channel 1 drive 1
scsibus0 at atapiscsi0: 2 targets
cd0 at scsibus0 targ 0 lun 0: <LITE-ON, COMBO LTC-48161H, KH0D> SCSI0 5/cdrom removable
wd2(pciide0:1:0): using PIO mode 4, Ultra-DMA mode 2
cd0(pciide0:1:1): using PIO mode 4, Ultra-DMA mode 2
"Intel 82801EB/ER SMB" rev 0x02 at pci0 dev 31 function 3 not configured
auich0 at pci0 dev 31 function 5 "Intel 82801EB/ER AC97 Audio" rev 0x02: irq 5, ICH5 AC97
ac97: codec id 0x41445375 (Analog Devices AD1985)
ac97: codec features headphone, 20 bit DAC, No 3D Stereo
audio0 at auich0
isa0 at pcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard, using wsdisplay0
pmsi0 at pckbc0 (aux slot)
pckbc0: using irq 12 for aux slot
wsmouse0 at pmsi0 mux 0
pcppi0 at isa0 port 0x61
midi0 at pcppi0: <PC speaker>
sysbeep0 at pcppi0
lpt0 at isa0 port 0x378/4 irq 7
lm0 at isa0 port 0x290/8: W83627THF
npx0 at isa0 port 0xf0/16: using exception 16
pccom0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
pccom1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo
fdc0 at isa0 port 0x3f0/6 irq 6 drq 2
fd0 at fdc0 drive 0: 1.44MB 80 cyl, 2 head, 18 sec
biomask c460 netmask c460 ttymask d4e2
pctr: user-level cycle counter enabled
wd0: no disk label
dkcsum: wd0 matched BIOS disk 80
dkcsum: wd1 matched BIOS disk 81
dkcsum: wd2 matched BIOS disk 82
root on wd1a
rootdev=0x10 rrootdev=0x310 rawdev=0x312
ugen0 at uhub0 port 2
ugen0: Canon CanoScan, rev 1.10/1.00, addr 2

>Fix:
	Unknown, except compile statically (as in -current).


>Release-Note:
>Audit-Trail:
>Unformatted: