1 files changed, 51 insertions, 17 deletions

diff --git a/sys/netinet/tcp_timer.c b/sys/netinet/tcp_timer.c
index 087e243..5ee54cf 100644
--- a/sys/netinet/tcp_timer.c
+++ b/sys/netinet/tcp_timer.c
@@ -39,13 +39,15 @@
 #include "opt_tcpdebug.h"
 
 #include <sys/param.h>
-#include <sys/systm.h>
 #include <sys/kernel.h>
+#include <sys/lock.h>
 #include <sys/mbuf.h>
-#include <sys/sysctl.h>
+#include <sys/mutex.h>
+#include <sys/protosw.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
-#include <sys/protosw.h>
+#include <sys/sysctl.h>
+#include <sys/systm.h>
 
 #include <machine/cpu.h>	/* before tcp_seq.h, for tcp_random18() */
 
@@ -211,9 +213,15 @@ tcp_timer_2msl(xtp)
 		tp = tcp_close(tp);
 
 #ifdef TCPDEBUG
-	if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
-		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
-			  PRU_SLOWTIMO);
+	if (tp != 0) {
+		SOCK_LOCK(tp->t_inpcb->inp_socket);
+		if ((tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) {
+			SOCK_UNLOCK(tp->t_inpcb->inp_socket);
+			tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
+				  PRU_SLOWTIMO);
+		} else
+			SOCK_UNLOCK(tp->t_inpcb->inp_socket);
+	}
 #endif
 	splx(s);
 }
@@ -243,9 +251,11 @@ tcp_timer_keep(xtp)
 	tcpstat.tcps_keeptimeo++;
 	if (tp->t_state < TCPS_ESTABLISHED)
 		goto dropit;
+	SOCK_LOCK(tp->t_inpcb->inp_socket);
 	if ((always_keepalive ||
 	     tp->t_inpcb->inp_socket->so_options & SO_KEEPALIVE) &&
 	    tp->t_state <= TCPS_CLOSING) {
+		SOCK_UNLOCK(tp->t_inpcb->inp_socket);
 		if ((ticks - tp->t_rcvtime) >= tcp_keepidle + tcp_maxidle)
 			goto dropit;
 		/*
@@ -269,13 +279,19 @@ tcp_timer_keep(xtp)
 			(void) m_free(dtom(t_template));
 		}
 		callout_reset(tp->tt_keep, tcp_keepintvl, tcp_timer_keep, tp);
-	} else
+	} else {
+		SOCK_UNLOCK(tp->t_inpcb->inp_socket);
 		callout_reset(tp->tt_keep, tcp_keepidle, tcp_timer_keep, tp);
+	}
 
 #ifdef TCPDEBUG
-	if (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
+	SOCK_LOCK(tp->t_inpcb->inp_socket);
+	if (tp->t_inpcb->inp_socket->so_options & SO_DEBUG) {
+		SOCK_UNLOCK(tp->t_inpcb->inp_socket);
 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
 			  PRU_SLOWTIMO);
+	} else
+		SOCK_UNLOCK(tp->t_inpcb->inp_socket);
 #endif
 	splx(s);
 	return;
@@ -285,9 +301,15 @@ dropit:
 	tp = tcp_drop(tp, ETIMEDOUT);
 
 #ifdef TCPDEBUG
-	if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
-		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
-			  PRU_SLOWTIMO);
+	if (tp != 0) {
+		SOCK_LOCK(tp->t_inpcb->inp_socket);
+		if ((tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) {
+			SOCK_UNLOCK(tp->t_inpcb->inp_socket);
+			tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
+				  PRU_SLOWTIMO);
+		} else
+			SOCK_UNLOCK(tp->t_inpcb->inp_socket);
+	}
 #endif
 	splx(s);
 }
@@ -335,9 +357,15 @@ tcp_timer_persist(xtp)
 
 out:
 #ifdef TCPDEBUG
-	if (tp && tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
-		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
-			  PRU_SLOWTIMO);
+	if (tp != 0) {
+		SOCK_LOCK(tp->t_inpcb->inp_socket);
+		if (tp->t_inpcb->inp_socket->so_options & SO_DEBUG) {
+			SOCK_UNLOCK(tp->t_inpcb->inp_socket);
+			tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
+				  PRU_SLOWTIMO);
+		} else
+			SOCK_UNLOCK(tp->t_inpcb->inp_socket);
+	}
 #endif
 	splx(s);
 }
@@ -470,9 +498,15 @@ tcp_timer_rexmt(xtp)
 
 out:
 #ifdef TCPDEBUG
-	if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
-		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
-			  PRU_SLOWTIMO);
+	if (tp != 0) {
+		SOCK_LOCK(tp->t_inpcb->inp_socket);
+		if ((tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) {
+			SOCK_UNLOCK(tp->t_inpcb->inp_socket);
+			tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
+				  PRU_SLOWTIMO);
+		} else
+			SOCK_UNLOCK(tp->t_inpcb->inp_socket);
+	}
 #endif
 	splx(s);
 }