>Number:         2605
>Category:       kern
>Synopsis:       udp_output may leave unconnected udp sockets in a connected state
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jul  5 12:20:03 1996
>Last-Modified:
>Originator:     tegge@idt.unit.no
>Organization:
		Norwegian University of Science and Technology
>Release:        1.2_BETA
>Environment:
	NetBSD-current, supped June 29th 1996
System: NetBSD ikke.idt.unit.no 1.2_BETA NetBSD 1.2_BETA (TEGGE) #4: Fri Jul 5 15:37:17 MET DST 1996 root@ikke.idt.unit.no:/usr/src/sys/arch/i386/compile/TEGGE i386


>Description:
	udp_output temporarily connects unconnected sockets when sending udp
	packets from unconnected sockets to specific addresses.  If M_PREPEND
	fails, udp_output returns without unblocking network input and without
	disconnecting the socket.
>How-To-Repeat:
	Keep free physical memory to a minimum (e.g. run several memory hungry
	programs with low locality).  Stress test a server program using
	recvfrom/sendto for handling multiple clients using the same
	unconnected udp socket.
>Fix:
*** /usr/src/sys/netinet/udp_usrreq.c.orig	Sun May 26 13:42:45 1996
--- usr/src/sys/netinet/udp_usrreq.c	Fri Jul  5 15:36:58 1996
***************
*** 458,463 ****
--- 458,468 ----
  	M_PREPEND(m, sizeof(struct udpiphdr), M_DONTWAIT);
  	if (m == 0) {
  		error = ENOBUFS;
+ 		if (addr) {
+ 		  in_pcbdisconnect(inp);
+ 		  inp->inp_laddr = laddr;
+ 		  splx(s);
+ 		}
  		goto release;
  	}
  

>Audit-Trail:
>Unformatted: