sshd segfaults on exit when no tty allocated

[Lowell Gilbert]

Christopher Cowart <ccowart at rescomp.berkeley.edu> writes:

> When I ssh into FreeBSD hosts without allocating a tty, sshd segfaults
> after the process terminates. This problem occurs on both 6_1_REL and
> 6_2_REL installations at all sorts of patch levels.
>
> Examples:
>
> Client: `ssh -t server ls`
> Server Logs: 
> | May  9 15:33:44 server sshd[1503]: Accepted publickey for ccowart from 
> |     client port 43604 ssh2
> | May  9 15:33:45 server sshd[1505]: pam_sm_close_session(): no utmp 
> |     record for ttyp5
>
> Client: `ssh server ls`
> Server Logs:
> | May  9 15:33:50 server sshd[1509]: Accepted publickey for ccowart from
> |   client port 42119 ssh2
> | May  9 15:33:51 server pid 1511 (sshd), uid 1225: exited on signal 11
>
> In either example, the client thinks the command has completed
> successfully, shows proper output, and propogates the return value from
> the remote command. The main problem is I don't like seeing a bunch of
> segfaults being logged in the daily run output.
>
> Our sshd_config stock, except we set `PermitRootLogin yes`.
>
> Does anyone know why this happens? Should I file a problem report?

I can't reproduce it on my own machines (-STABLE, a few weeks old), so
a PR probably would need a more precise reproduction scenario.