upstream: when the peer sends a channel-close message, make sure we

close the local extended read fd (stderr) along with the regular read fd
(stdout). Avoids weird stuck processed in multiplexing mode.

Report and analysis by Nelson Elhage and Geoffrey Thomas in bz#2863

ok dtucker@ markus@

OpenBSD-Commit-ID: a48a2467fe938de4de69d2e7193d5fa701f12ae9

1 files changed, 23 insertions, 1 deletions

diff --git a/nchan.c b/nchan.c
index da7a9d6d6..8294d7fca 100644
--- a/nchan.c
+++ b/nchan.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: nchan.c,v 1.68 2018/10/04 00:10:11 djm Exp $ */
+/* $OpenBSD: nchan.c,v 1.69 2018/10/04 07:47:35 djm Exp $ */
 /*
  * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
  *
@@ -80,6 +80,7 @@ static void	chan_send_eow2(struct ssh *, Channel *);
 /* helper */
 static void     chan_shutdown_write(struct ssh *, Channel *);
 static void     chan_shutdown_read(struct ssh *, Channel *);
+static void     chan_shutdown_extended_read(struct ssh *, Channel *);
 
 static const char *ostates[] = { "open", "drain", "wait_ieof", "closed" };
 static const char *istates[] = { "open", "drain", "wait_oclose", "closed" };
@@ -289,11 +290,13 @@ chan_rcvd_oclose(struct ssh *ssh, Channel *c)
         switch (c->istate) {
         case CHAN_INPUT_OPEN:
                 chan_shutdown_read(ssh, c);
+                chan_shutdown_extended_read(ssh, c);
                 chan_set_istate(c, CHAN_INPUT_CLOSED);
                 break;
         case CHAN_INPUT_WAIT_DRAIN:
                 if (!(c->flags & CHAN_LOCAL))
                         chan_send_eof2(ssh, c);
+                chan_shutdown_extended_read(ssh, c);
                 chan_set_istate(c, CHAN_INPUT_CLOSED);
                 break;
         }
@@ -422,3 +425,22 @@ chan_shutdown_read(struct ssh *ssh, Channel *c)
                 }
         }
 }
+
+static void
+chan_shutdown_extended_read(struct ssh *ssh, Channel *c)
+{
+        if (c->type == SSH_CHANNEL_LARVAL || c->efd == -1)
+                return;
+        if (c->extended_usage != CHAN_EXTENDED_READ &&
+            c->extended_usage != CHAN_EXTENDED_IGNORE)
+                return;
+        debug2("channel %d: %s (i%d o%d sock %d wfd %d efd %d [%s])",
+            c->self, __func__, c->istate, c->ostate, c->sock, c->rfd, c->efd,
+            channel_format_extended_usage(c));
+        if (channel_close_fd(ssh, &c->efd) < 0) {
+                logit("channel %d: %s: close() failed for "
+                    "extended fd %d [i%d o%d]: %.100s",
+                    c->self, __func__, c->efd, c->istate, c->ostate,
+                    strerror(errno));
+        }
+}