Subject: Re: Recent nbftp panic analysis
To: None <tech-net@netbsd.org>
From: Charles M. Hannum <abuse@spamalicious.com>
List: tech-net
Date: 02/14/2005 09:16:43 
On Monday 14 February 2005 09:01, Charles M. Hannum wrote:
>  #define        TCP_TIMER_ISARMED(tp, timer)\
> -       callout_pending(&(tp)->t_timer[(timer)])
> +       (callout_pending(&(tp)->t_timer[(timer)]) ||                    \
> +        callout_invoking(&(tp)->t_timer[(timer)]))

This has to use callout_expired() rather than callout_invoking(), because 
callout_ack() clears the INVOKING bit and therefore the race could still 
happen (but with a yet shorter window).