fix for race between invocation for timer and network input

1) add a reaper for TCP and SYN cache states (cf. netbsd pr 20390)
2) additional check for TCP_TIMER_ISARMED(TCPT_REXMT) in tcp_timer_persist()
with mickey@; ok deraadt@

1 files changed, 20 insertions, 2 deletions

diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index 57fc27065f6..83acaa05bed 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tcp_input.c,v 1.177 2004/10/28 19:22:52 mcbride Exp $	*/
+/*	$OpenBSD: tcp_input.c,v 1.178 2004/11/25 15:32:08 markus Exp $	*/
 /*	$NetBSD: tcp_input.c,v 1.23 1996/02/13 23:43:44 christos Exp $	*/
 
 /*
@@ -3205,6 +3205,7 @@ do {									\
 
 #define	SYN_CACHE_RM(sc)						\
 do {									\
+	(sc)->sc_flags |= SCF_DEAD;					\
 	TAILQ_REMOVE(&tcp_syn_cache[(sc)->sc_bucketidx].sch_bucket,	\
 	    (sc), sc_bucketq);						\
 	(sc)->sc_tp = NULL;						\
@@ -3220,7 +3221,8 @@ do {									\
 		(void) m_free((sc)->sc_ipopts);				\
 	if ((sc)->sc_route4.ro_rt != NULL)				\
 		RTFREE((sc)->sc_route4.ro_rt);				\
-	pool_put(&syn_cache_pool, (sc));				\
+	timeout_set(&(sc)->sc_timer, syn_cache_reaper, (sc));		\
+	timeout_add(&(sc)->sc_timer, 0);				\
 } while (/*CONSTCOND*/0)
 
 struct pool syn_cache_pool;
@@ -3366,6 +3368,10 @@ syn_cache_timer(void *arg)
 	int s;
 
 	s = splsoftnet();
+	if (sc->sc_flags & SCF_DEAD) {
+		splx(s);
+		return;
+	}
 
 	if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) {
 		/* Drop it -- too many retransmissions. */
@@ -3398,6 +3404,18 @@ syn_cache_timer(void *arg)
 	splx(s);
 }
 
+void
+syn_cache_reaper(void *arg)
+{
+	struct syn_cache *sc = arg;
+	int s;
+
+	s = splsoftnet();
+	pool_put(&syn_cache_pool, (sc));
+	splx(s);
+	return;
+}
+
 /*
  * Remove syn cache created by the specified tcb entry,
  * because this does not make sense to keep them