diff options
| author | pb <pb@FreeBSD.org> | 2002-12-21 19:59:47 +0000 |
|---|---|---|
| committer | pb <pb@FreeBSD.org> | 2002-12-21 19:59:47 +0000 |
| commit | adc4b142acadf80c974cb6c97c90125b62d083a0 (patch) | |
| tree | 23c5934ccd4e10f779674cdceedb11d9b1b69ea0 /sys/netinet/tcp_syncache.c | |
| parent | a9741e060abda4858c722294e0cf9857a5614cd9 (diff) | |
| download | FreeBSD-src-adc4b142acadf80c974cb6c97c90125b62d083a0.zip FreeBSD-src-adc4b142acadf80c974cb6c97c90125b62d083a0.tar.gz | |
In syncache_timer(), don't attempt to lock the inpcb structure
associated with the syncache entry: in case tcp_close() has been
called on the corresponding listening socket, the lock has been
destroyed as a side effect of in_pcbdetach(), causing a panic when
we attempt to lock on it.
Reviewed by: hsu
Diffstat (limited to 'sys/netinet/tcp_syncache.c')
| -rw-r--r-- | sys/netinet/tcp_syncache.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c index 0c52edb..03851db 100644 --- a/sys/netinet/tcp_syncache.c +++ b/sys/netinet/tcp_syncache.c @@ -384,7 +384,6 @@ syncache_timer(xslot) break; sc = nsc; inp = sc->sc_tp->t_inpcb; - INP_LOCK(inp); if (slot == SYNCACHE_MAXREXMTS || slot >= tcp_syncache.rexmt_limit || inp->inp_gencnt != sc->sc_inp_gencnt) { @@ -400,7 +399,6 @@ syncache_timer(xslot) * entry on the timer chain until it has completed. */ (void) syncache_respond(sc, NULL); - INP_UNLOCK(inp); nsc = TAILQ_NEXT(sc, sc_timerq); tcpstat.tcps_sc_retransmitted++; TAILQ_REMOVE(&tcp_syncache.timerq[slot], sc, sc_timerq); |
