Don't recurse into datalink_UpdateSet() after

doing a HangupDone().  The HangupDone() may fuel
bundle_CleanDatalinks(), and if so, the bogus
UpdateSet() ends up select()ing on a closed
descriptor.....

Change the main `do/while' loop to a `for' loop so
that any `continue's do the bundle_CleanDatalinks()
& bundle_IsDead() bit.

1 files changed, 4 insertions, 2 deletions

diff --git a/usr.sbin/ppp/datalink.c b/usr.sbin/ppp/datalink.c
index 40f22f1..31c74c0 100644
--- a/usr.sbin/ppp/datalink.c
+++ b/usr.sbin/ppp/datalink.c
@@ -332,9 +332,11 @@ datalink_UpdateSet(struct descriptor *d, fd_set *r, fd_set *w, fd_set *e,
           if (dl->script.run) { 
             datalink_NewState(dl, DATALINK_HANGUP);
             chat_Init(&dl->chat, dl->physical, dl->cfg.script.hangup, NULL);
-          } else
+            return datalink_UpdateSet(d, r, w, e, n);
+          } else {
             datalink_HangupDone(dl);
-          return datalink_UpdateSet(d, r, w, e, n);
+            return 0;	/* Maybe bundle_CleanDatalinks() has something to do */
+          }
       }
 
     case DATALINK_HANGUP: