Improve handling of SPX session timeout, specifically, make sure to

properly handle the case where a connection is disconnected.  The
queue(9)-enabled version of this code broke from the inner but not
outer loop, and so potentially frobbed an ipxpcb flag after the ipxpcb
was free'd, which might be picked up later by the malloc debugging
code.  Properly break from the loop context and avoid touching the
cb/ipxpcb after free.

1 files changed, 8 insertions, 5 deletions

diff --git a/sys/netipx/spx_usrreq.c b/sys/netipx/spx_usrreq.c
index 4d42ce3..ee01292 100644
--- a/sys/netipx/spx_usrreq.c
+++ b/sys/netipx/spx_usrreq.c
@@ -1780,13 +1780,16 @@ spx_slowtimo()
 				 * spx_timers() returns (NULL) if it free'd
 				 * the pcb.
 				 */
-				if (spx_timers(cb, i) == NULL)
-					continue;
+				cb = spx_timers(cb, i);
+				if (cb == NULL)
+					break;
 			}
 		}
-		cb->s_idle++;
-		if (cb->s_rtt)
-			cb->s_rtt++;
+		if (cb != NULL) {
+			cb->s_idle++;
+			if (cb->s_rtt)
+				cb->s_rtt++;
+		}
 	}
 	spx_iss += SPX_ISSINCR/PR_SLOWHZ;		/* increment iss */
 	splx(s);