Fixing follows and John's fruent explnation than my English....

The first problem I found was that descriptor 0 was being closed.
This happens because the modem variable is set to 0 to indicate
that it is not valid but there are not enough tests for the modem
variable being 0.  You can see where I have done this in the patch.
Code in OpenModem() dups the modem descriptor if it is < 3.  Once
this happened the modem was always open and an incomming call would
have getty and ppp reading the modem.

Descriptor 1 is closed when the quit command was executed from a
telnet connection.  The next modem open returns descriptor 1
and this gets duped leaving the modem always open again.

The modem was not being closed when the connection dropped or was
closed from the other end.  The UUCP lock was also not removed if
the modem could not be opened.

Reviewed by:	Atsushi Murai <amurai@spec.co.jp>
Submitted by:	John Capo <jc@irbs.com>

1 files changed, 30 insertions, 6 deletions

diff --git a/usr.sbin/ppp/modem.c b/usr.sbin/ppp/modem.c
index b056a83..5595bc9 100644
--- a/usr.sbin/ppp/modem.c
+++ b/usr.sbin/ppp/modem.c
@@ -17,7 +17,7 @@
  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * $Id: modem.c,v 1.3 1995/02/27 10:57:54 amurai Exp $
+ * $Id: modem.c,v 1.4 1995/03/11 15:18:48 amurai Exp $
  * 
  *  TODO:
  */
@@ -208,6 +208,7 @@ DownConnection()
 {
   LogPrintf(LOG_PHASE, "Disconnected!\n");
   LogPrintf(LOG_PHASE, "Connect time: %d secs\n", time(NULL) - uptime);
+  CloseModem();
   LcpDown();
   connect_time = 0;
 }
@@ -381,6 +382,7 @@ int mode;
       modem = open(VarDevice, O_RDWR|O_NONBLOCK);
       if (modem < 0) {
         LogPrintf(LOG_PHASE, "Open Failed %s\n", VarDevice);
+        (void) uu_unlock(uucplock);
         return(modem);
       }
     } else {
@@ -403,8 +405,20 @@ int mode;
     }
   }
 
+  /* This code gets around the problem of closing descriptor 0
+   * when it should not have been closed and closing descriptor 1
+   * when the telnet connection dies.  Since this program always
+   * opens a descriptor for the modem in auto and direct mode,
+   * having to dup the descriptor here is a fatal error.
+   *
+   * With the other changes I have made this should no longer happen.
+   * JC
+  */
   while (modem < 3)
+  {
+    logprintf("Duping modem fd %d\n", modem);
     modem = dup(modem);
+  }
 
   /*
    * If we are working on tty device, change it's mode into
@@ -562,9 +576,16 @@ int flag;
   if (modem && (flag || !(mode & MODE_DEDICATED))) {
     ModemTimeout();			/* XXX */
     StopTimer(&ModemTimer);		/* XXX */
-    tcflush(modem, TIOCFLUSH);
-    UnrawModem(modem);
-    close(modem);
+
+    /* ModemTimeout() may call DownConection() to close the modem
+     * resulting in modem == 0.
+    */
+    if (modem)
+    {
+	tcflush(modem, TIOCFLUSH);
+	UnrawModem(modem);
+	close(modem);
+    }
     (void) uu_unlock(uucplock);
     modem = 0;			/* Mark as modem has closed */
   } else if (modem) {
@@ -581,8 +602,11 @@ int flag;
 
 CloseModem()
 {
-  close(modem);
-  modem = 0;
+  if (modem >= 3)
+  {
+      close(modem);
+      modem = 0;
+  }
   (void) uu_unlock(uucplock);
 }