fix channel mux_ctx leak

[Moritz Buhl]

Hi,

I noticed that the channel mux_ctx leak reported in May 2020 is back.
https://marc.info/?l=openssh-unix-dev&m=159001768606068

The reproducer from the previous thread should work. Otherwise
here are my scripts: https://github.com/moritzbuhl/ssh-leak

mbuhl

Index: channels.c
===================================================================
RCS file: /mount/openbsd/cvs/src/usr.bin/ssh/channels.c,v
retrieving revision 1.407
diff -u -p -r1.407 channels.c
--- channels.c	19 May 2021 01:24:05 -0000	1.407
+++ channels.c	1 Sep 2021 11:17:00 -0000
@@ -619,9 +619,11 @@ channel_free(struct ssh *ssh, Channel *c
 	debug("channel %d: free: %s, nchannels %u", c->self,
 	    c->remote_name ? c->remote_name : "???", n);
 
-	if (c->type == SSH_CHANNEL_MUX_CLIENT)
+	if (c->type == SSH_CHANNEL_MUX_CLIENT) {
 		mux_remove_remote_forwardings(ssh, c);
-	else if (c->type == SSH_CHANNEL_MUX_LISTENER) {
+		free(c->mux_ctx);
+		c->mux_ctx = NULL;
+	} else if (c->type == SSH_CHANNEL_MUX_LISTENER) {
 		free(c->mux_ctx);
 		c->mux_ctx = NULL;
 	}