Robert Watson 81158452be Push acquisition of the accept mutex out of sofree() into the caller ... (sorele()/sotryfree()): - This permits the caller to acquire the accept mutex before the socket mutex, avoiding sofree() having to drop the socket mutex and re-order, which could lead to races permitting more than one thread to enter sofree() after a socket is ready to be free'd. - This also covers clearing of the so_pcb weak socket reference from the protocol to the socket, preventing races in clearing and evaluation of the reference such that sofree() might be called more than once on the same socket. This appears to close a race I was able to easily trigger by repeatedly opening and resetting TCP connections to a host, in which the tcp_close() code called as a result of the RST raced with the close() of the accepted socket in the user process resulting in simultaneous attempts to de-allocate the same socket. The new locking increases the overhead for operations that may potentially free the socket, so we will want to revise the synchronization strategy here as we normalize the reference counting model for sockets. The use of the accept mutex in freeing of sockets that are not listen sockets is primarily motivated by the potential need to remove the socket from the incomplete connection queue on its parent (listen) socket, so cleaning up the reference model here may allow us to substantially weaken the synchronization requirements. RELENG_5_3 candidate. MFC after: 3 days Reviewed by: dwhite Discussed with: gnn, dwhite, green Reported by: Marc UBM Bocklet <ubm at u-boot-man dot de> Reported by: Vlad <marchenko at gmail dot com>		2004-10-18 22:19:43 +00:00
..
ipatm	Include <sys/malloc.h> for the declaration of malloc(), etc. instead	2003-11-14 21:02:10 +00:00
sigpvc	Make the ioctl() interface cleaner with regard to types: use size_t	2003-07-29 13:32:10 +00:00
spans	Avoid casts as lvalues.	2004-07-28 06:59:55 +00:00
uni	Fix a typo that could provoke a panic or access to random memory.	2004-07-19 12:54:00 +00:00
atm_aal5.c	The socket field so_state is used to hold a variety of socket related	2004-06-14 18:16:22 +00:00
atm_cm.c	Silence a gcc-warning. Do this by inlining the macro-call. This is	2003-07-26 14:20:37 +00:00
atm_cm.h
atm_device.c	Hand the packet to bpf not only in the LLC/SNAP case, but for all	2003-07-25 06:43:41 +00:00
atm_if.c	Replace the if_name and if_unit members of struct ifnet with new members	2003-10-31 18:32:15 +00:00
atm_if.h	Replace the if_name and if_unit members of struct ifnet with new members	2003-10-31 18:32:15 +00:00
atm_ioctl.h	Remove an #if section originally written for Sun compilers.	2004-06-08 13:46:31 +00:00
atm_pcb.h
atm_proto.c	Create a subtree 'harp' of the net sysctl tree. This uses a fixed	2003-07-24 10:33:01 +00:00
atm_sap.h
atm_sigmgr.h
atm_signal.c
atm_socket.c	Push acquisition of the accept mutex out of sofree() into the caller	2004-10-18 22:19:43 +00:00
atm_stack.h
atm_subr.c	Don't remove the first mbuf in the chain if it got empty.	2004-02-21 12:55:07 +00:00
atm_sys.h
atm_usrreq.c	Introduce a MAC label reference in 'struct inpcb', which caches	2003-11-18 00:39:07 +00:00
atm_var.h	Replace the if_name and if_unit members of struct ifnet with new members	2003-10-31 18:32:15 +00:00
atm_vc.h	Make the ioctl() interface cleaner with regard to types: use size_t	2003-07-29 13:32:10 +00:00
atm.h
port.h
queue.h