From: itojun@iijlab.net
Subject: Re: CVS commit: syssrc/sys/netinet6 
Date: Sat, 11 May 2002 10:45:15 +0900
> >I think this patch fix the problem.
> 
> 	the patch #if 0's the whole policy expiration code, and does not
> 	seem to be right...

I'm not sure why policy expiration code should be
in timerhandler.
freeing sp when refcount drops to zero is enough, isn't it?
actually, timerhandler seems to call freesp multiply
for sp that is marked as DEAD. it's a cause of panics.

>  and why key_freesp() twice?

in order to decrement refcount twice.
yes, it's ugly. but I think it works.

replace "sp->state = IPSEC_SPSTATE;freesp(sp);"
with below may look better?

void
killsp(sp)
{
  if (sp->state != IPSEC_SPSTATE_DEAD) {
    sp->state = IPSEC_SPSTATE_DEAD;
    freesp(sp);
  }
}

---
YAMAMOTO Takashi<yamt@mwd.biglobe.ne.jp>