Fix a NULL pointer dereference panic that occurs when the TCP protocol
authorMatthew Dillon <dillon@dragonflybsd.org>
Wed, 27 Oct 2004 03:43:47 +0000 (03:43 +0000)
committerMatthew Dillon <dillon@dragonflybsd.org>
Wed, 27 Oct 2004 03:43:47 +0000 (03:43 +0000)
commit621989fd021db4f39df1a9a7517b00291fe07ed4
tree51925d5c38b930d21161bb9dac2d1f55503b93ed
parenta310707180b82ada94fbeeff5cfbd4f71cb7d308
Fix a NULL pointer dereference panic that occurs when the TCP protocol
stack races against userland while closing a tcp connection.  It is
possible for userland to queue a disconnect request but for the protocol
stack to then receive a packet that causes it to call tcp_drop()->tcp_close()
which also disconnects the inpcb from the tcpcb.  When the protocol stack
then processes the disconnect request it hits the panic because the inpcb
no longer has a tcpcb connected to it.

The bug generally only occured on SMP systems where the latency in intra-cpu
communication opens up the window of opportunity for the bug to occur.

Panic-Reported-by: Adam K Kirchhoff <adamk@voicenet.com>
sys/netinet/tcp_usrreq.c