diff options
| author |   djm <djm@openbsd.org> | 2010-01-27 13:26:17 +0000 |
|---|---|---|
| committer | djm <djm@openbsd.org> | 2010-01-27 13:26:17 +0000 |
| commit | 445e8a436bdce002d31001b0bb48e3ba07c24c7c (patch) | |
| tree | 773feedbbf64efc83818ba31efc04709551e47ac | |
| parent | - regen (diff) | |
| download | wireguard-openbsd-445e8a436bdce002d31001b0bb48e3ba07c24c7c.tar.xz wireguard-openbsd-445e8a436bdce002d31001b0bb48e3ba07c24c7c.zip | |
fix bug introduced in mux rewrite:
In a mux master, when a socket to a mux slave closes before its server
session (as may occur when the slave has been signalled), gracefully
close the server session rather than deleting its channel immediately.
A server may have more messages on that channel to send (e.g. an exit
message) that will fatal() the client if they are sent to a channel that
has been prematurely deleted.
spotted by imorgan AT nas.nasa.gov
| -rw-r--r-- | usr.bin/ssh/mux.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/usr.bin/ssh/mux.c b/usr.bin/ssh/mux.c index 65da54ee6f3..0fa68b4d6b9 100644 --- a/usr.bin/ssh/mux.c +++ b/usr.bin/ssh/mux.c @@ -1,4 +1,4 @@ -/* $OpenBSD: mux.c,v 1.11 2010/01/26 02:15:20 djm Exp $ */ +/* $OpenBSD: mux.c,v 1.12 2010/01/27 13:26:17 djm Exp $ */ /* * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> * @@ -193,7 +193,13 @@ mux_master_control_cleanup_cb(int cid, void *unused) __func__, c->self, c->remote_id); c->remote_id = -1; sc->ctl_chan = -1; - chan_mark_dead(sc); + if (sc->type != SSH_CHANNEL_OPEN) { + debug2("%s: channel %d: not open", __func__, sc->self); + chan_mark_dead(c); + } else { + chan_read_failed(sc); + chan_write_failed(sc); + } } channel_cancel_cleanup(c->self); } |