kernel - Fix possible race in syncache
authorMatthew Dillon <dillon@apollo.backplane.com>
Wed, 18 Aug 2010 19:22:49 +0000 (12:22 -0700)
committerMatthew Dillon <dillon@apollo.backplane.com>
Wed, 18 Aug 2010 19:22:49 +0000 (12:22 -0700)
commitc1d0893d667ee18127bd3d2e371b820d65c5c0c2
tree7d466955f5b10950b809ac8c9fb16fdd9adac4c0
parent3bf6fec386b09ee8846e7093b18975148d9da2cc
kernel - Fix possible race in syncache

* syncache_timer_handler() can block while dropping a syncache entry,
  potentially causing the next pointer it uses in its list iteration
  to become stale.

* Use a list marker to keep tabs on the list position instead of using
  a next pointer.

* Remove critical sections, callouts do not preempt and syncache
  routines can only be entered from protocol threads or callouts.

* Document the callout code as not preempting other threads.

Reported-by: Peter Avalos <pavalos@theshell.com>
sys/kern/kern_timeout.c
sys/netinet/tcp_syncache.c
sys/netinet/tcp_var.h