Fix a tiny race in tdb_delete() between TDBF_DELETED, tdb_unlink()
authorbluhm <bluhm@openbsd.org>
Thu, 16 Dec 2021 15:38:03 +0000 (15:38 +0000)
committerbluhm <bluhm@openbsd.org>
Thu, 16 Dec 2021 15:38:03 +0000 (15:38 +0000)
commitf40da5574981c10871821bfe1271389abcca31ae
treeca4b80ab78c57a9ee2d3c99f772900c0ffb55984
parent2f8193d46ac7ffc3d371f81a496ae847c8ca08fe
Fix a tiny race in tdb_delete() between TDBF_DELETED, tdb_unlink()
and tdb_cleanspd().  gettdb...() can return a TDB before tdb_unlink().
Then ipsp_spd_lookup() could add it to tdb_policy_head after
tdb_cleanspd().  There it would stay until it hits the kassert in
tdb_free().
OK tobhe@
sys/netinet/ip_spd.c