Bug 3358 - after SIGCHLD is received, sshd may get blocked
Summary: after SIGCHLD is received, sshd may get blocked
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 8.4p1
Hardware: Other Linux
: P5 normal
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-10-29 06:59 AEDT by Charles Samuels
Modified: 2022-02-25 13:57 AEDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Charles Samuels 2021-10-29 06:59:43 AEDT
If sshd spawns a short-lived command, after the command exits, sshd may sometimes block indefinitely without exiting.

Concerning:

https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/serverloop.c?annotate=1.226

On line 274, in `wait_until_can_do_something`, `child_terminated` is checked, which reduces the `select` timeout to a small amount. `collect_children` clears the `child_terminated` flag after it does the `wait`.

On child exit in line 441, collect_children is called, but there's no guarantee that loop breaks before calling wait_until_can_do_something once again, which will cause sshd to never exit.

This causes the bug https://github.com/mobile-shell/mosh/issues/1152
Comment 1 Damien Miller 2021-10-29 09:21:14 AEDT
This was fixed two releases ago, in OpenSSH 8.7:

commit 4bdf7a04797a0ea1c431a9d54588417c29177d19
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jun 25 03:38:17 2021 +0000

    upstream: Replace SIGCHLD/notify_pipe kludge with pselect.
    
    Previously sshd's SIGCHLD handler would wake up select() by writing a
    byte to notify_pipe.  We can remove this by blocking SIGCHLD, checking
    for child terminations then passing the original signal mask through
    to pselect.  This ensures that the pselect will immediately wake up if
    a child terminates between wait()ing on them and the pselect.
    
    In -portable, for platforms that do not have pselect the kludge is still
    there but is hidden behind a pselect interface.
    
    Based on other changes for bz#2158, ok djm@
    
    OpenBSD-Commit-ID: 202c85de0b3bdf1744fe53529a05404c5480d813
Comment 2 Damien Miller 2022-02-25 13:57:17 AEDT
closing bugs resolved before openssh-8.9