CVS commit: [netbsd-5] src/sys/netinet

[Soren Jacobsen <snj%netbsd.org@localhost>]

Module Name:    src
Committed By:   snj
Date:           Fri Nov 14 03:02:25 UTC 2008

Modified Files:
        src/sys/netinet [netbsd-5]: tcp_timer.c

Log Message:
Pull up following revision(s) (requested by bouyer in ticket #56):
        sys/netinet/tcp_timer.c: revision 1.83
Fix kern/39769: race condition in TCP timers
When a TCP timer is disarmed (with callout_stop()) in the general case
callout_invoking() isn't checked, so the timer handler could be called run
when the current interrupt handler exits, athough the timer is disarmed.
This case cause bad things like TCPT_REXMT and TCPT_PERSIST being both pending,
causing a panic (see the PR for details).
Close the issue by aborting the handler if the timer is not callout_expired().
(the EXPIRED flag being cleared by callout_stop()).


To generate a diff of this commit:
cvs rdiff -r1.82 -r1.82.4.1 src/sys/netinet/tcp_timer.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.