- djm@cvs.openbsd.org 2010/01/27 13:26:17

     [mux.c]
     fix bug introduced in mux rewrite:

     In a mux master, when a socket to a mux slave closes before its server
     session (as may occur when the slave has been signalled), gracefully
     close the server session rather than deleting its channel immediately.
     A server may have more messages on that channel to send (e.g. an exit
     message) that will fatal() the client if they are sent to a channel that
     has been prematurely deleted.

     spotted by imorgan AT nas.nasa.gov

diff --git a/ChangeLog b/ChangeLog
index aac1b71934ca187778bf90113d398068a1974368..05cbba64a465671f2044af176b8231e70e3d47f2 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,18 @@
      [mux.c]
      -Wuninitialized and remove a // comment; from portable
      (Id sync only)
+   - djm@cvs.openbsd.org 2010/01/27 13:26:17
+     [mux.c]
+     fix bug introduced in mux rewrite:
+     
+     In a mux master, when a socket to a mux slave closes before its server
+     session (as may occur when the slave has been signalled), gracefully
+     close the server session rather than deleting its channel immediately.
+     A server may have more messages on that channel to send (e.g. an exit
+     message) that will fatal() the client if they are sent to a channel that
+     has been prematurely deleted.
+     
+     spotted by imorgan AT nas.nasa.gov
 
 20100126
  - (djm) OpenBSD CVS Sync

diff --git a/mux.c b/mux.c
index ef99b5737ea7b816380586dc27b4725aa79e255b..64781d44ccdd887b37d201c2582098fcc4bdbd60 100644 (file)
--- a/mux.c
+++ b/mux.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mux.c,v 1.11 2010/01/26 02:15:20 djm Exp $ */
+/* $OpenBSD: mux.c,v 1.12 2010/01/27 13:26:17 djm Exp $ */
 /*
  * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
  *
@@ -210,7 +210,13 @@ mux_master_control_cleanup_cb(int cid, void *unused)
                            __func__, c->self, c->remote_id);
                c->remote_id = -1;
                sc->ctl_chan = -1;
-               chan_mark_dead(sc);
+               if (sc->type != SSH_CHANNEL_OPEN) {
+                       debug2("%s: channel %d: not open", __func__, sc->self);
+                       chan_mark_dead(c);
+               } else {
+                       chan_read_failed(sc);
+                       chan_write_failed(sc);
+               }
        }
        channel_cancel_cleanup(c->self);
 }