Skip to content

netutils/dropbear: retain child exit status for NSH PTY session#3648

Open
FelipeMdeO wants to merge 1 commit into
apache:masterfrom
FelipeMdeO:fix/dropbear-retain-child-status
Open

netutils/dropbear: retain child exit status for NSH PTY session#3648
FelipeMdeO wants to merge 1 commit into
apache:masterfrom
FelipeMdeO:fix/dropbear-retain-child-status

Conversation

@FelipeMdeO

@FelipeMdeO FelipeMdeO commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

Summary

Dropbear reaps the per-session NSH task with waitpid() in
dropbear_nshsession.c. Without CONFIG_SCHED_CHILD_STATUS the kernel does
not retain the child exit status, so waitpid() returns ECHILD right after
authentication and the interactive session never starts
(NSH session wait failed: Unknown error 10).
The issue was reported here: apache/nuttx#19209

Depend on SCHED_HAVE_PARENT (required by SCHED_CHILD_STATUS) and select
SCHED_CHILD_STATUS so any Dropbear build gets a working interactive session.

Impact

Kconfig-only, 2 lines. Fixes interactive SSH sessions for NETUTILS_DROPBEAR.
No dependency on other in-flight work.

Testing

Built sim:dropbear (nuttx master + this change) and connected over SSH:

on device side:

➜  ~ sudo setcap cap_net_admin+ep /home/felipe-moura/nuttx-space/pr-pure-test/nuttx/nuttx

[sudo] password for felipe-moura: 
➜  ~ cd /home/felipe-moura/nuttx-space/pr-pure-test/nuttx
./nuttx

dropbear [6:100]

NuttShell (NSH) NuttX-13.0.0
nsh> [6] Jun 01 00:00:00 using NuttX passwd auth at /tmp/passwd
dropbear: listening on port 2222
useradd felipe test1234
nsh> [6] Jun 01 00:00:24 connection from 10.0.1.1:54398
[6] Jun 01 00:00:33 Password auth succeeded for 'felipe' from 10.0.1.1:54398
[6] Jun 01 00:00:33 NSH PTY session started
ls
/:
 bin/
 dev/
 etc/
 proc/
 tmp/
 var/
nsh> poweroff
nsh: poweroff: command not found
nsh> 

On host side:

➜  ~ sudo ip addr add 10.0.1.1/24 dev tap0
sudo ip link set tap0 up

[sudo] password for felipe-moura: 
➜  ~ ssh-keygen -R '[10.0.1.2]:2222'
ssh -p 2222 felipe@10.0.1.2

# Host [10.0.1.2]:2222 found: line 9
/home/felipe-moura/.ssh/known_hosts updated.
Original contents retained as /home/felipe-moura/.ssh/known_hosts.old
The authenticity of host '[10.0.1.2]:2222 ([10.0.1.2]:2222)' can't be established.
ECDSA key fingerprint is SHA256:wRi61vyuX697dPhP5kny+tVZ1gyIgS7qgQ3s23PrQOk.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[10.0.1.2]:2222' (ECDSA) to the list of known hosts.
felipe@10.0.1.2's password: 
nsh> ls
/:
 bin/
 dev/
 etc/
 proc/
 tmp/
 var/
nsh>

The per-session NSH task is reaped with waitpid() in
dropbear_nshsession.c.  Without CONFIG_SCHED_CHILD_STATUS the kernel does
not retain the child exit status, so waitpid() returns ECHILD right after
authentication and the interactive SSH session never starts
("NSH session wait failed: Unknown error 10").

Depend on SCHED_HAVE_PARENT (required by SCHED_CHILD_STATUS) and select
SCHED_CHILD_STATUS so any Dropbear build gets a working interactive
session, independent of the chacha20-poly1305 / PBKDF2 work.

Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
@FelipeMdeO

Copy link
Copy Markdown
Contributor Author

Hello @acassis , @xiaoxiang781216 , @linguini1 , can you take a look, please?

Comment thread netutils/dropbear/Kconfig
depends on LIBC_GAISTRERROR
select CRYPTO
select CRYPTO_RANDOM_POOL
select SCHED_CHILD_STATUS

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's change to depends on

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello @xiaoxiang781216, I'd prefer to keep this as select. With depends on, whoever writes a defconfig for a new board could forget to enable SCHED_CHILD_STATUS, and Dropbear would silently be dropped from the build, no error, it just wouldn't come up. Keeping it as select makes bringing up Dropbear on a new board simpler and avoids that pitfall.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We did decide a while ago that we would use depends on going forward since select has a tendency to cause mysterious issues (not selecting recursive dependencies). The advised approach here is for the user to determine via Kconfig what dependencies need to be enabled and do that themselves.

xiaoxiang781216 pushed a commit to apache/nuttx that referenced this pull request Jul 19, 2026
Dropbear's NSH PTY session reaps the child task with waitpid() and needs
CONFIG_SCHED_CHILD_STATUS, which depends on SCHED_HAVE_PARENT.  The
netutils/dropbear Kconfig now depends on SCHED_HAVE_PARENT and selects
SCHED_CHILD_STATUS (apache/nuttx-apps#3648); set SCHED_HAVE_PARENT here so
the dropbear defconfig stays consistent and the session no longer fails
with ECHILD after authentication.

Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants