tcp: use locked callouts for the TCP timers

[glebius]

Summary

Initialize the TCP timers pointing at the inpcb rwlock as the callout
lock. This allows the tcp_timer_stop() to stop a timer immediately
and avoid use of callout_async_drain(). In its turn this makes
tcp_discardcb() the single entry point for tcpcb destructor, merging
the tcp_freecb() to the end of the function. This also removed lots
of lingering checks in the callout handlers themselves.

[glebius]

Note: this version will fire KASSERT at certain conditions, as it is incorrect. However, even with correct assert this version has potential use after free, that is hidden by the use of SMR memory for tcpcbs. Right now this revision is not targeted to cgit, it is posted just to share code.

[• hselasky]

sys/netinet/tcp_timer.c

1145

You cannot remove the callout_async_drain() it needs to stay, because the mutex may be used after free!

Try to keep this call and the issue with SMR will go away!

[glebius]

Yes, you are right. It is impossible to create raceless self-freeing callout with two callouts embedded into the same structure. This revision superseded by D37321.