Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Posting-Version: version B 2.10.1 (Tek) 9/26/83; site hammer.UUCP
Path: utzoo!linus!decvax!tektronix!orca!hammer!steveh
From: steveh@hammer.UUCP (Stephen Hemminger)
Newsgroups: net.unix-wizards,net.bugs.4bsd
Subject: Unix Domain Datagram Bug.
Message-ID: <1013@hammer.UUCP>
Date: Wed, 21-Nov-84 12:40:16 EST
Article-I.D.: hammer.1013
Posted: Wed Nov 21 12:40:16 1984
Date-Received: Fri, 23-Nov-84 02:31:35 EST
Reply-To: steveh@hammer.UUCP (Stephen Hemminger)
Organization: Tektronix, Wilsonville OR
Lines: 54
Keywords: Unix Domain, IPC, 4.2Bsd

Description:
	If a two programs communicate via Unix domain datagrams, and the
	receiver can't keep up with the sender, then mbuf's are not
	freed which will eventually bring system to its knees.

Repeat-By:
	Make a program which sends datagrams to another program.
	Have receiver sleep between recvs.

Fix:
	Their is a misunderstanding in uipc_usrreq.c: 
	sbappendaddr() returns
		0 if an error (no space, no mbufs etc).
		1 data sent.
	The source mbuf chain is freed by sbappendaddr when it returns 1,
	BUT they are not freed if it returns 0!
	Change to uipc_usrreq.c fixes the problem.	

	Editted diffs of uipc_usrreq.c (line #'s are different from
	distribution sorry).

***************
*** 168,183
  				if (error)
  					break;
  			}
! 			/*
! 			 * Put data address and rights on receiver's queue.
! 			 * There's no record of source socket's
! 			 * name, so send null name for the moment.
! 			 * 
! 			 * If no space (returns 0), then m will be
! 			 * freed later.
! 			 */
! 			if (sbappendaddr(&so2->so_rcv, &sun_noname,
! 				m, rights) != 0) {
  				sbwakeup(&so2->so_rcv);
  				m = 0;
  			}

--- 164,176 -----
  				if (error)
  					break;
  			}
! 			if (sbspace(&so2->so_rcv) > 0) {
! 				/*
! 				 * There's no record of source socket's
! 				 * name, so send null name for the moment.
! 				 */
! 				(void) sbappendaddr(&so2->so_rcv,
! 				    &sun_noname, m, rights);
  				sbwakeup(&so2->so_rcv);
  				m = 0;
  			}