CVS commit: src/sys/netinet

[Manuel Bouyer <bouyer%netbsd.org@localhost>]

Module Name:    src
Committed By:   bouyer
Date:           Sun Nov  9 17:32:38 UTC 2008

Modified Files:
        src/sys/netinet: tcp_timer.c

Log Message:
Fix kern/39769: race condition in TCP timers
When a TCP timer is disarmed (with callout_stop()) in the general case
callout_invoking() isn't checked, so the timer handler could be called run
when the current interrupt handler exits, athough the timer is disarmed.
This case cause bad things like TCPT_REXMT and TCPT_PERSIST being both pending,
causing a panic (see the PR for details).
Close the issue by aborting the handler if the timer is not callout_expired().
(the EXPIRED flag being cleared by callout_stop()).


To generate a diff of this commit:
cvs rdiff -r1.82 -r1.83 src/sys/netinet/tcp_timer.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.