Bug 3358

Summary:	after SIGCHLD is received, sshd may get blocked
Product:	Portable OpenSSH	Reporter:	Charles Samuels <openssl>
Component:	sshd	Assignee:	Assigned to nobody <unassigned-bugs>
Status:	CLOSED FIXED
Severity:	normal	CC:	djm
Priority:	P5
Version:	8.4p1
Hardware:	Other
OS:	Linux

Description Charles Samuels 2021-10-29 06:59:43 AEDT

If sshd spawns a short-lived command, after the command exits, sshd may sometimes block indefinitely without exiting.

Concerning:

https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/serverloop.c?annotate=1.226

On line 274, in `wait_until_can_do_something`, `child_terminated` is checked, which reduces the `select` timeout to a small amount. `collect_children` clears the `child_terminated` flag after it does the `wait`.

On child exit in line 441, collect_children is called, but there's no guarantee that loop breaks before calling wait_until_can_do_something once again, which will cause sshd to never exit.

This causes the bug https://github.com/mobile-shell/mosh/issues/1152

Comment 1 Damien Miller 2021-10-29 09:21:14 AEDT

This was fixed two releases ago, in OpenSSH 8.7:

commit 4bdf7a04797a0ea1c431a9d54588417c29177d19
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jun 25 03:38:17 2021 +0000

    upstream: Replace SIGCHLD/notify_pipe kludge with pselect.
    
    Previously sshd's SIGCHLD handler would wake up select() by writing a
    byte to notify_pipe.  We can remove this by blocking SIGCHLD, checking
    for child terminations then passing the original signal mask through
    to pselect.  This ensures that the pselect will immediately wake up if
    a child terminates between wait()ing on them and the pselect.
    
    In -portable, for platforms that do not have pselect the kludge is still
    there but is hidden behind a pselect interface.
    
    Based on other changes for bz#2158, ok djm@
    
    OpenBSD-Commit-ID: 202c85de0b3bdf1744fe53529a05404c5480d813

Comment 2 Damien Miller 2022-02-25 13:57:17 AEDT

closing bugs resolved before openssh-8.9