[master] 2a8398c For OC_EF_REMOVE, clear OC_EF_REFD under the lock to prevent a race with exp_mail_it

[Nils Goroll]

commit 2a8398c11bdff02970cf79601cae931de02d6e9d
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Tue Feb 28 18:40:22 2017 +0100

    For OC_EF_REMOVE, clear OC_EF_REFD under the lock to prevent a race with exp_mail_it
    
    Previously, objcores to be removed remained flagged as referenced, so exp_mail_it
    could change the flags again.
    
    Fixes #2143

diff --git a/bin/varnishd/cache/cache_expire.c b/bin/varnishd/cache/cache_expire.c
index cfe2122..f0ca523 100644
--- a/bin/varnishd/cache/cache_expire.c
+++ b/bin/varnishd/cache/cache_expire.c
@@ -190,7 +190,6 @@ exp_inbox(struct exp_priv *ep, struct objcore *oc, unsigned flags)
 			binheap_delete(ep->heap, oc->timer_idx);
 		}
 		assert(oc->timer_idx == BINHEAP_NOIDX);
-		oc->exp_flags &= ~OC_EF_REFD;
 		assert(oc->refcnt > 0);
 		AZ(oc->exp_flags);
 		ObjSendEvent(ep->wrk, oc, OEV_EXPIRE);
@@ -326,7 +325,10 @@ exp_thread(struct worker *wrk, void *priv)
 			VSC_C_main->exp_received++;
 			tnext = 0;
 			flags = oc->exp_flags;
-			oc->exp_flags &= OC_EF_REFD;
+			if (flags & OC_EF_REMOVE)
+				oc->exp_flags = 0;
+			else
+				oc->exp_flags &= OC_EF_REFD;
 		} else if (tnext > t) {
 			VSL_Flush(&ep->vsl, 0);
 			Pool_Sumstat(wrk);