608ea247b8
Prevent a race condition. As pf_send_tcp() - called for expired synproxy states - has to drop the lock when calling back to ip_output(), the state purge timeout might run and gc the state. This results in a rb-tree inconsistency. With this change we flag expiring states while holding the lock and back off if the flag is already set. Reported by: glebius Approved by: re (kensmith)