Fix a race condition when asking a client to take over the terminal (switching

to a different poll loop):

If a MSG_READY was followed very quickly by a MSG_EXIT (for example if doing
"tmux new 'exit'"), both messages could be read as part of the same imsg_read
in the first client poll loop. The MSG_READY would then cause a switch to the
second client loop, which would immediately call poll(2) again, causing the
client to hang forever waiting for an exit message that it already had.

Change to call imsg_get to process any existing messages before polling.

1 files changed, 17 insertions, 8 deletions

diff --git a/usr.bin/tmux/client.c b/usr.bin/tmux/client.c
index 3f64e200067..c578c2c8791 100644
--- a/usr.bin/tmux/client.c
+++ b/usr.bin/tmux/client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: client.c,v 1.16 2009/09/02 20:15:49 nicm Exp $ */
+/* $OpenBSD: client.c,v 1.17 2009/09/02 23:49:25 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net>
@@ -152,12 +152,21 @@ int
 client_main(struct client_ctx *cctx)
 {
 	struct pollfd	 pfd;
-	int		 nfds;
+	int		 n, nfds;
 
 	siginit();
 
 	logfile("client");
 
+	/*
+	 * imsg_read in the first client poll loop (before the terminal has
+	 * been initialiased) may have read messages into the buffer after the
+	 * MSG_READY switched to here. Process anything outstanding now so poll
+	 * doesn't hang waiting for messages that have already arrived.
+	 */
+	if (client_msg_dispatch(cctx) != 0)
+		goto out;
+
 	for (;;) {
 		if (sigterm)
 			client_write_server(cctx, MSG_EXITING, NULL, 0);
@@ -190,6 +199,10 @@ client_main(struct client_ctx *cctx)
 			fatalx("socket error");
 
 		if (pfd.revents & POLLIN) {
+			if ((n = imsg_read(&cctx->ibuf)) == -1 || n == 0) {
+				cctx->exittype = CCTX_DIED;
+				break;
+			}
 			if (client_msg_dispatch(cctx) != 0)
 				break;
 		}
@@ -201,7 +214,8 @@ client_main(struct client_ctx *cctx)
 			}
 		}
 	}
-	
+
+out:
  	if (sigterm) {
  		printf("[terminated]\n");
  		return (1);
@@ -252,11 +266,6 @@ client_msg_dispatch(struct client_ctx *cctx)
 	struct msg_print_data	 printdata;
 	ssize_t			 n, datalen;
 
-	if ((n = imsg_read(&cctx->ibuf)) == -1 || n == 0) {
-		cctx->exittype = CCTX_DIED;
-		return (-1);
-	}
-
 	for (;;) {
 		if ((n = imsg_get(&cctx->ibuf, &imsg)) == -1)
 			fatalx("imsg_get failed");