Reduce the size of a number of race windows in the TCP socket options processing code: a RST may arrive during a socket option call, causing the PCB to be freed, leading to an invalid pointer dereference.  When the kernel blocks in a socket option copyin or memory allocation (such as during heavy paging), the race window is greatly widened.  This change re-validates the PCB pointer after returning from the copy/alloc operation.  This does not eliminate the problem, but does narrow the window significantly (to the point where it may not be observed at all).
Reduce the size of a number of race windows in the TCP socket options
processing code: a RST may arrive during a socket option call, causing
the PCB to be freed, leading to an invalid pointer dereference.  When
the kernel blocks in a socket option copyin or memory allocation (such
as during heavy paging), the race window is greatly widened.  This
change re-validates the PCB pointer after returning from the copy/alloc
operation.  This does not eliminate the problem, but does narrow the
window significantly (to the point where it may not be observed at all).

The proper fix is in 7.x, which significantly re-works the socket and
PCB code so that PCB's are not ripped out from under sockets on reset.
However, those changes are not appropriate for an MFC during a release
cycle.  As a result, this is not an MFC, but new code crafted for 6.x.

PR:			kern/102412
Reported by:		Daniel Austin <daniel at kewlio dot net>
Tested by:		Diane Bruce <db at db dot net>
Reviewed by:		Diane Bruce <db at db dot net>
Approved by:		re (kensmith)

jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase