|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
From: IT Resource Center (support_feedback_at_us-support2-mail.external.hp.com)
Date: Sun Nov 17 2002 - 09:55:41 CST
HP Support Information Digests
===============================================================================
o IT Resource Center World Wide Web Service
---------------------------------------------------
If you subscribed through the IT Resource Center and would
like to be REMOVED from this mailing list, access the
IT Resource Center on the World Wide Web at:
Login using your IT Resource Center User ID and Password.
Then select Support Information Digests (located under
Maintenance and Support). You may then unsubscribe from the
appropriate digest.
To download a patch referenced below, access the
IT Resource Center on the World Wide Web at:
Login using your IT Resource Center User ID and Password.
Then select Individual Patches (under Maintenance and Support)
to access the patch. You may also download a patch via anonymous
ftp(1) from ftp.itrc.hp.com.
===============================================================================
Digest Name: weekly HP-UX series 800 11.X patch digest
Created: Sun Nov 17 6:05:04 EST 2002
Table of Contents:
Document ID Title
--------------- -----------
PHNE_27886 s700_800 11.00 cumulative ARPA Transport patch
PHKL_27686 s700_800 11.11 MO 4k sector size;FIFO;Event Port;perf;shmem
PHCO_27950 s700_800 11.11 tbl(1) cumulative patch
PHSS_27658 s700_800 11.22 A.05.41 C++ Compiler Product
PHNE_27777 s700_800 11.11 r-commands cumulative mega-patch
PHNE_27765 s700_800 11.11 ftpd(1M) patch
PHKL_27980 s700_800 11.00 VxFS 3.1 cumulative patch: CR_EIEM
PHKL_27757 s700_800 11.11 par fans,cabtype,sinc,hwpath,cell info,vPar
PHKL_27716 s700_800 11.11 PDC_SCIS_PARMS,iCOD,vPars,IPMI
PHKL_27715 s700_800 11.11 vPars,Interrupt Migration, IPMI
PHKL_27714 s700_800 11.11 HighTempAlerts,vPar,IntrMigr,PCI-X, IPMI
PHKL_27669 s700_800 11.11 IPMI driver port
PHCO_28146 s700_800 11.04 (VVOS) intermittent auditd fail on reboot
PHCO_27758 s700_800 11.11 gsp parser & DIMM labels
PHSS_27986 s700_800 11.X WTSharedX Periodic Patch
PHSS_27659 s700_800 11.22 A.05.41 C Compiler Product
PHSS_27588 s700_800 11.X OV OB4.10 patch - CC packet
PHSS_27586 s700_800 11.X OV OB4.00 patch - MA packet
PHKL_28105 s700_800 11.00 VxFS cumulative,I/O Throttling,dirty inval
PHCO_27578 s700_800 11.00 vmstat(1) cumulative patch
PHNE_27651 s700_800 11.00 Cumulative STREAMS Patch
PHKL_28130 s700_800 11.22 IDE driver (ATA/ATAPI/dump) cumulative patch
PHCO_27961 s700_800 11.11 quotaon(1M) quotaoff(1M) cumulative patch
PHCO_27960 s700_800 11.11 fsclean(1M) cumulative patch, Dev IDS enable
PHCO_27959 s700_800 11.11 umountall(1M) cumulative patch, Dev IDs enab
PHCO_27958 s700_800 11.11 mountall cumulative patch, Dev IDs enabler
PHCO_27957 s700_800 11.11 umount(1M) cumulative patch, Dev IDs Enab
PHCO_27956 s700_800 11.11 mount(1M) cumulative patch, Device IDs enab
The documents are listed below.
-------------------------------------------------------------------------------
Document ID: PHNE_27886
Date Loaded: 20021115
Title: s700_800 11.00 cumulative ARPA Transport patch
Patch Name: PHNE_27886
Patch Description: s700_800 11.00 cumulative ARPA Transport patch
Creation Date: 02/09/24
Post Date: 02/11/15
Hardware Platforms - OS Releases:
s700: 11.00
s800: 11.00
Products: N/A
Filesets:
OS-Core.CORE2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP
Networking.NET-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP
Networking.NET-PRG,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP
Networking.NET-RUN,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP
Networking.NET2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP
Networking.NMS2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP
OS-Core.CORE2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP
Networking.NET2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP
Networking.NMS2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP
Automatic Reboot?: Yes
Status: General Release
Critical:
Yes
PHNE_27886: PANIC
PHNE_27058: PANIC HANG MEMORY_LEAK
PHNE_26771: CORRUPTION
PHNE_26445: PANIC
PHNE_26412: CORRUPTION
PHNE_25423: PANIC HANG CORRUPTION
PHNE_25381: PANIC
PHNE_25135: PANIC
PHNE_24715: PANIC
PHNE_24289: PANIC
PHNE_24075: PANIC
PHNE_23456: PANIC
PHNE_22869: PANIC
PHNE_22527: PANIC
PHNE_22397: PANIC
PHNE_22318: PANIC
PHNE_22067: PANIC
PHNE_21890: PANIC
PHNE_21767: PANIC
PHNE_21606: PANIC
PHNE_21318: PANIC
PHNE_21038: PANIC
PHNE_20735: PANIC
PHNE_20633: PANIC
PHNE_20436: PANIC
PHNE_20041: PANIC
PHNE_19899: PANIC
PHNE_19375: PANIC
PHNE_19110: PANIC
PHNE_18708: PANIC
PHNE_18611: PANIC
PHNE_18554: PANIC
PHNE_18553: PANIC
PHNE_17662: PANIC
PHNE_17613: PANIC
PHNE_17446: PANIC
PHNE_17227: PANIC
PHNE_17117: PANIC
PHNE_17018: PANIC
PHNE_17017: PANIC
PHNE_16645: PANIC
PHNE_16497: PANIC
PHNE_16283: PANIC
PHNE_15995: PANIC
PHNE_15911: PANIC
PHNE_15692: PANIC
PHNE_15583: PANIC
PHNE_15047: PANIC
PHNE_14876: PANIC
PHNE_14730: PANIC
PHNE_14702: PANIC
PHNE_14575: PANIC
PHNE_14279: PANIC
PHNE_14274: PANIC
PHNE_14260: PANIC
PHNE_14017: PANIC
PHNE_13692: PANIC
PHNE_13405: PANIC
Category Tags:
defect_repair general_release critical panic halts_system
corruption memory_leak
Path Name: /hp-ux_patches/s700_800/11.X/PHNE_27886
Symptoms:
PHNE_27886:
This patch replaces PHNE_27058
( SR number: 8606244252 ; Defect: JAGae10742 )
Data transfer over TCP is very slow.
( SR number: 8606248840 ; Defect: JAGae15237 )
System panics with the following stack trace
panic+0xa0
assfail+0x3c
_assfail+0x2c
b_vsema+0x36c
sounlock+0x974
mp_socket_unlock+0x10
function name is not available
pstat_socket+0x400
pstat+0x380
syscall+0x834
syscallinit+0x554
( SR number: 8606272841 ; Defect: JAGae36947 )
It is not possible to know if the support for
RFC 1948 is enabled or disabled.
( SR number: 8606272891 ; Defect: JAGae36997 )
The HP-UX 11.0 client does not transmit multicast packets
when INADDR_ANY is used.
( SR number: 8606277294 ; Defect: JAGae41365 )
Applications using UDP via XTI or applications
using remote file locking via NFS may cause
datagram packets to be dropped.
PHNE_27058:
This patch replaces PHNE_26771
( SR number: 8606226976 ; Defect: JAGad96038 )
Repeatedly joining and leaving various multicast
groups and rejoining already joined groups causes
the system to hang.
( SR number: 8606233305 ; Defect: JAGae02529 )
Application hangs in the accept(2) system call.
( SR number: 8606238262 ; Defect: JAGae07289 )
Data corruption occurs in the socket structure
during a connect(2).
( SR number: 8606241187 ; Defect: JAGae08450 )
The system does not respond to any keystrokes or
commands and appears to hang. A Service Guard system
will perform TOC.
( SR number: 8606241192 ; Defect: JAGae08455 )
Memory leak of timer related mblks in 512-byte bucket.
( SR number: 8606242679 ; Defect: JAGae09914 )
A process appears to hang in accept(2) and cannot be
killed when there is another process doing a
getsockopt(2) on the same socket.
( SR number: 8606247193 ; Defect: JAGae13633 )
System panics with either of the following stack traces:
stack trace for event 0
crash event was a panic
panic+0x14
too_much_time+0x2d4
wait_for_lock+0x120
sl_retry+0x18
ip_trash+0x18
ip_rtimer+0x38
ip_rput+0x3c0
puthere+0x140
mi_timeout_exec+0x224
sw_service+0x8c
mp_ext_interrupt+0x108
ivti_patch_to_nop3+0x0
idle+0xd5c
swidle_exit+0x0
stack trace for event 0
crash event was a panic
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
ilm_lookup_exact+0x4
ip_delmulti+0x40
ilg_delete+0x90
ilg_delete_all+0x34
ip_close+0x58
close_wrapper+0x38
csq_protect+0x120
osr_pop_subr+0x214
osr_close_subr+0xcbc
hpstreams_close_int+0x31c
streams_close+0x14
soclose+0x308
soo_close+0x90
closef+0x64
close+0x90
syscall+0x200
$syscallrtn+0x0
( SR number: 8606248331 ; Defect: JAGae14731 )
System panics during boot after building the
kernel with tcphashsz value less than 256.
( SR number: 8606249571 ; Defect: JAGae15961 )
System panics with either of the
following stack traces:
stack trace for event 0
crash event was a panic
panic+0x14
report_trap_or_int_and_panic+0x84
interrupt+0x1d4
$ihndlr_rtn+0x0
ip_rput_unbind_do+0x1ec
ip_rput_dlpi+0x2f4
ip_rput+0x4c0
csq_turnover_with_lock+0x84
putnext+0x258
hp_dlpi_mblk_fast_in+0x354
hp_dlpi_mblk_intr_put+0x960
streams_put+0xe8
streams_put_release+0x168
hp_dlpi_mblk_intr+0x14c
apa_intr+0x184
lanc_ether_ics+0x114
_btlan3_receive_pkts+0x588
_btlan3_isr+0x198
dino_isr+0xcc
mp_ext_interrupt+0x318
ivti_patch_to_nop3+0x0
idle+0x1054
swidle_exit+0x0
stack trace for event 0
crash event was a panic
panic+0x14
report_trap_or_int_and_panic+0x84
interrupt+0x1d4
$ihndlr_rtn+0x0
ip_rput_dlpi_up+0x550
ip_rput_dlpi+0x98
ip_rput+0x4c0
csq_turnover_with_lock+0x84
putnext+0x258
ar_client_notify+0x78
ar_rput+0x7d0
putnext+0xcc
hp_dlpi_unitdata_in+0x1504
hp_dlpi_intr_put+0x8b0
streams_put+0xe8
hp_dlpi_intr+0x214
lan2_process_packet+0x87c
lan2_int_fr_rnr+0x1b0
lan2_isr+0x164
lasi_interrupt+0x64
mp_ext_interrupt+0x318
ivti_patch_to_nop3+0x0
sounlock+0x90
mp_socket_unlock+0x10
soreceive+0x4bc
recvit+0x144
recv+0x54
syscall+0x6f8
( SR number: 8606250217 ; Defect: JAGae16597 )
System panics with the following stack trace:
panic+0x14
report_trap_or_int_and_panic+0x84
trap+0xd9c
nokgdb+0x8
ill_delete+0x5c8
ip_close+0x1e4
close_wrapper+0x38
csq_protect+0x120
osr_pop_subr+0x214
osr_close_subr+0xf50
osr_unlink+0x1fc
str_plumb_ioctl+0x4a4
hpstreams_ioctl_int+0x398
hpstreams_ioctl+0x50
spec_ioctl+0xac
vno_ioctl+0x90
ioctl+0x78
syscall+0x6f8
$syscallrtn+0x0
( SR number: 8606257697 ; Defect: JAGae22000 )
System panics with the following stack trace:
stack trace for event 0
crash event was a panic
panic+0x14
too_much_time+0x2e0
wait_for_lock+0x14c
slu_retry+0x1c
mp_socket_lock+0x2c
TPI_ok_ack+0x1a4
soaccept+0x5f4
sodequeue+0x30c
accept+0x168
syscall+0x200
$syscallrtn+0x0
( SR number: 8606259311 ; Defect: JAGae23629 )
POSIX recvmsg() returns incorrect "cmsg_len".
PHNE_26771:
This patch replaces PHNE_26445
( SR number: 8606236775 ; Defect: JAGae05826 )
SIOCATMARK ioctl returns with the flag parameter
set even after reading out-of-band data when
the SO_OOBINLINE socket option is set.
( SR number: 8606237266 ; Defect: JAGae06311 )
Passing invalid arguments to connect() on an
already connected datagram socket does not
disconnect the socket, as documented in the
connect() manpage.
( SR number: 8606238197 ; Defect: JAGae07224 )
rlogin and other applications that call recv() with
the MSG_OOB flag lose data if the urgent byte has
not arrived when the call to recv() is made.
( SR number: 8606250322 ; Defect: JAGae16697 )
AF_UNIX domain datagram type socket applications
fail on recv() call.
PHNE_26445:
This patch replaces PHNE_25423
( SR number: 8606213513 ; Defect: JAGad82705 )
Systems relying on random increments for choosing less
predictable TCP ISN values, are still vulnerable to
statistical attacks.
( SR number: 8606218753 ; Defect: JAGad87901 )
System runs out of memory when it is under heavy
inbound TCP traffic.
( SR number: 8606223127 ; Defect: JAGad92230 )
Memory Leak in the 2k bucket when sanmgr hostagent is
running.
( SR number: 8606224045 ; Defect: JAGad93141 )
System runs out of memory and seems to hang.
( SR number: 8606224560 ; Defect: JAGad93648 )
FTP hangs when transfering files from PC DOS to HP-UX.
( SR number: 8606225324 ; Defect: JAGad94412 )
"Communication stops" occur due to incorrect host route
in the routing table.
( SR number: 8606228310 ; Defect: JAGad97367 )
read() done on a socket returned by accept() returns
the EWOULDBLOCK error.
( SR number: 8606229279 ; Defect: JAGad98332 )
System panics with the following stack trace:
tcp_icmp_error+0x38
tcp_rput_other+0x518
tcp_rput+0x58
csq_turnover_with_lock+0x84
str_spu_sw_isr+0x654
sw_service+0xb0
mp_ext_interrupt+0x150
ivti_patch_to_nop3+0x0
idle+0x104
( SR number: 8606229650 ; Defect: JAGad98702 )
System panics with the following stack trace:
igmp_timeout_handler+0x160
ip_rtimer+0x100
ip_rput+0x408
puthere+0x148
mi_timeout_exec+0x288
sw_service+0xb0
mp_ext_interrupt+0x150
ihandler+0x904
idle+0xe24
swidle+0x20
( SR number: 8606230164 ; Defect: JAGad99215 )
performance degradation after installing PHNE_23456.
( SR number: 8606231247 ; Defect: JAGae00485 )
System panics with the following stack trace:
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
tcp_get_ucred+0x1d4
tcp_wput_ioctl+0x160
tcp_wput+0x918
putnext+0xcc
wait_iocack+0x68
str_istr_ioctl+0x72c
hpstreams_ioctl_int+0x370
hpstreams_ioctl+0x50
spec_ioctl+0xac
vno_ioctl+0x90
ioctl+0x78
syscall+0x6f8
$syscallrtn+0x0
( SR number: 8606231526 ; Defect: JAGae00764 )
System panics with the following stacks:
tcp_wput+0x58
csq_turnover_with_lock+0x84
str_spu_sw_isr+0x654
or
tcp_wput+0x58
putnext+0xcc
sth_wsrv+0x204
sq_wrapper+0x94
str_sched_up_daemon+0x1c4
str_sched_daemon+0x1a4
main+0x854
( SR number: 8606231951 ; Defect: JAGae01187 )
System panics with the following stack trace:
tcp_rsrv_comm+0x18
tcp_rput+0x3620
csq_turnover_with_lock+0x7c
str_spu_sw_isr+0x5f8
sw_service+0x8c
( SR number: 8606232185 ; Defect: JAGae01421 )
System panics with the following stack trace:
tcp_rsrv_comm+0x18
tcp_rsrv+0x10
sq_wrapper+0x90
str_sched_mp_daemon+0x130
str_sched_daemon+0x2dc
main+0xa9c
$vstart+0x34
$locore+0x90
( SR number: 8606232612 ; Defect: JAGae01847 )
If the primary route for an interface is deleted, then
a host on the same subnet is not reachable through the
secondary route, though the secondary network route
exists.
( SR number: 8606233090 ; Defect: JAGae02314 )
In some cases urgent data gets retransmitted
unnecessarily impairing performance.
( SR number: 8606233164 ; Defect: JAGae02387 )
connect() call for the SOCK_STREAMS socket returns
the ETIMEDOUT error. This occurs when another
connection already bound to the same address
(with 4-tuple being the same) has received RST from
the remote side, and has not been closed by the
application.
PHNE_26412:
( SR number: 8606221602 ; Defect: JAGad90736 )
read() sometimes loses data and returns 0 on system
with PHNE_23456.
PHNE_25423:
This patch replaces PHNE_25135
( SR number: 8606146239 ; Defect: JAGad15575 )
Intermittent hangs exhibited in close()
when using so_linger.
( SR number: 8606160572 ; Defect: JAGad29893 )
When both ts option and socket cache are used,
tcp conection gets timed out.
( SR number: 8606189015 ; Defect: JAGad58231 )
UNIX domain socket programme uses a large amount of CPU.
This can be observed in some cases of fast producer
and a slow consumer type of client server programmes.
( SR number: 8606211448 ; Defect: JAGad80636 )
When IPSEC is active, nettl can turn on layer 4 tracing
( SR number: 8606217657 ; Defect: JAGad86809 )
ifconfig lan10000 fails, but ifconfig lan9999 succeeds.
( SR number: 8606219937 ; Defect: JAGad89079 )
On UP boxes when 2 (or more) aio_reads are pending
on the same socket and ioctl(SIOCAIOABORT) is used,
a close on that socket will result in an unkillable
hung process.
( SR number: 8606220568 ; Defect: JAGad89705 )
Sometimes telnet session initiated by W2K to
HP-UX 11.00 machine hangs.
( SR number: 8606220677 ; Defect: JAGad89814 )
Data retransmission sometimes takes a long time.
( SR number: 8606221602 ; Defect: JAGad90736 )
read() sometimes lose data and return 0 on system
with PHNE_23456.
( SR number: 8606221777 ; Defect: JAGad90911 )
When setting ip_pmtu_strategy to 0 any non-local
networks have a maximum MTU of 576.
( SR number: 8606222508 ; Defect: JAGad91621 )
When system memory use is very high
the accept system call returns ENOBUFS.
( SR number: 8606223947 ; Defect: JAGad93042 )
When loopback address, 127.n.n.n (where n can 0
to 255) is pinged and ping succeeds, netstat -rn
displays entries for each pinged address other
than 127.0.0.1
PHNE_25381:
System panics on sbflush panic 2:
trace event 0
stack trace for event 0
crash event was a panic
panic+0x14
sbflush+0x68
sbrelease+0x14
sorflush+0xa4
sofree+0x15c
soclose+0x23c
soo_close+0xc8
closef+0x64
close+0x90
syscall+0x6f8
$syscallrtn+0x0
PHNE_25135:
This patch replaces PHNE_24715
( SR number: 8606193755 ; Defect: JAGab72514 )
When using shutdown() and stack-caching the mss value
could be set to one (1) byte.
( SR number: 8606137536 ; Defect: JAGad06654 )
Tcpdump trace showed that sendfile sends trailer buffers
as a swparate "send".
( SR number: 8606203612 ; Defect: JAGad72784 )
Examination of code found a problem.
( SR number: 8606215148 ; Defect: JAGad84339 )
System panics on sbflush panic 2:
trace event 0
stack trace for event 0
crash event was a panic
panic+0x14
sbflush+0x68
sbrelease+0x14
sorflush+0xa4
sofree+0x15c
soclose+0x23c
soo_close+0xc8
closef+0x64
close+0x90
syscall+0x6f8
$syscallrtn+0x0
PHNE_24715:
This patch replaces PHNE_24289
( SR number: 8606193754 ; Defect: JAGad62965 )
Customer noted that performance of ftp over
hyper-fabric was very slow when putting a file
after installing PHNE_22397.
( SR number: 8606206542 ; Defect: JAGad75715 )
Some packets are dropped intermittently and not
retransmitted for a long time.
( SR number: 8606206806 ; Defect: JAGad75979 )
Since PHNE_21767, all outbound datagrams have
the "Don't Fragment" bit set for Path MTU Discovery.
( SR number: 8606139436 ; Defect: JAGad08735 )
system panic on X.25 socket.
The panic stack is as follows:
A possible deadlock situation
stack trace for event 0
crash event was a panic
panic+0x10
spin_deadlock_failure+0x38
deadlock_check+0x9c
sl_pre_check+0x54
spinlock+0x14
mp_socket_lock+0x34
mp_socket_lock2+0x38
XLS_F_handler+0x6c4
XSO_F_handler+0x958
XLS_F0_a_connect_ind+0x188
XLS_F_handler+0x6a4
XST_F_read_put+0x398
putnext+0x1f4
CI_touser+0x268
Rx_CALL+0x384
L2_datind+0x4ac
dlpi_rxll+0xb4
x25lrsrv+0x60
sq_wrapper+0xc8
str_sched_mp_daemon+0x33c
str_sched_daemon+0x29c
im_mpnetstr+0x28
DoCalllist+0x38
main+0x24
$vstart+0x34
$locore+0x90
( SR number: 8606140093 ; Defect: JAGad09415 )
TCP connections where both ends close at
the same time may experience an unnecessary
delay of 1.5 seconds or more. This problem
has an especially high probability of being
seen on loopback connections where one
end of the connection has the SO_LINGER
option turned on.
( SR number: 8606167654 ; Defect: JAGad36937 )
Sometimes nettl is unable to capture reply packets.
( SR number: 8606198667 ; Defect: JAGad67856 )
Closing a socket with socket caching turned on and
SO_LINGER set will cause a loop in the kernel. The
connection will be left in an IDLE state.
( SR number: 8606202518 ; Defect: JAGad71692 )
Synptom:
System panic on X.25 socket.
Panic stack is :
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
XIQ_F_handler+0xc0
XSO_F0_cleanup_pcb+0xa4
XSO_F_handler+0x12dc
XPR_F_pr_usrreq+0x298
soclose+0x250
soo_close+0x90
closef+0x64
close+0x90
syscall+0x200
$syscallrtn+0x0
( SR number: 8606202738 ; Defect: JAGad71912 )
PHNE_23456 shows duplicate uipc_socket.c what strings.
( SR number: 8606203039 ; Defect: JAGad72213 )
A UDP broadcast is sent once for each IP
address configured on the interface.
( SR number: 8606203900 ; Defect: JAGad73078 )
TCP connection hangs in an ESTABLISHED state.
( SR number: 8606204354 ; Defect: JAGad73536 )
UDP datagrams are silently dropped.
( SR number: 8606204948 ; Defect: JAGad74124 )
System hang while ftping and concurrent file truncation.
( SR number: 8606205538 ; Defect: JAGad74714 )
System panics while executing accept call. The
panic stack is as follows:
panic+0x6c
report_trap_or_int_and_panic+0x94
interrupt+0x208
ihandler+0x930
x_mi_timer+0xc
tcp_accept+0x510
tcp_wput_proto+0x18c
tcp_wput+0xa0
csq_turnover_with_lock+0x8c
puthere+0x260
tcp_icmp_error+0x270
tcp_rput_other+0x600
tcp_rput+0x60
putnext+0xcc
icmp_inbound_error+0xa74
icmp_inbound+0x38c
ip_rput_local+0xd58
ip_rput+0x188
putnext+0xcc
hp_dlpi_mblk_fast_in+0xa0
hp_dlpi_mblk_intr_put+0xb8
streams_put+0xdc
streams_put_release+0x4c
hp_dlpi_mblk_intr+0x5c
lanc_ether_ics+0x11c
btlan_receive_frame+0x5e4
btlan_isr+0xfc
sapic_interrupt+0x2c
mp_ext_interrupt+0x2ec
ihandler+0x90c
( SR number: 8606206366 ; Defect: JAGad75539 )
System panics with the following
stack trace:
panic
report_trap_or_int_and_panic
trap
nokgdb
ipif_up
ip_sioctl_copyin_done
ip_wput_nondata
ip_wput
csq_turnover_with_lock
putnext
udp_wput_other
udp_wput
putnext
wait_iocack
str_trans_ioctl
hpstreams_ioctl_int
streams_ioctl
ifioctl
soo_ioctl
ioctl
syscall
( SR number: 8606207797 ; Defect: JAGad76974 )
Performance degradation in IPSEC.
( SR number: 8606209138 ; Defect: JAGad78325 )
With ATM on system and IP traffic, system panics
with forllowing panic stack:
panic+0x6c
report_trap_or_int_and_panic+0x94
interrupt+0x208
ihandler+0x930
bcopy_pcxu_method+0x0
LDI_F_set_fastpath+0x100
LEC_F0_uwioctl+0x1d8
LEC_F0_uwput+0xac
csq_turnover_with_lock+0x84
putnext+0x258
CAM_F0_sp_dataind+0x70
streams_put+0xe4
CAM_F_data_ind+0x404
alx_receive_it+0x13fc
alx_isr+0x25c
wsio_interrupt+0x54
mp_ext_interrupt+0x34c
ivti_patch_to_nop3+0x0
sounlock+0x90
mp_socket_unlock+0x10
soo_select2+0x1c4
soo_select+0x14
select+0xac4
syscall+0x480
( SR number: 8606209264 ; Defect: JAGad78451 )
When 2 (or more) aio_read are pending on the same
socket and ioctl(SIOCAIOABORT) is used, a close
on that socket will cause to process to hang and
the process is not killable.
PHNE_24289:
This patch replaces PHNE_24075
( SR number: 8606131836 ; Defect: JAGad00986 )
RAW socket behaviour for HP-UX 11.0 is inconsistent
with HP-UX 10.20 and HP-UX 11.11. Non-root user is
allowed to open a RAW socket.
( SR number: 8606162623 ; Defect: JAGad31939 )
Service Guard system TOC with the following trace:
x_mi_mpprintf_putc+0x1c
x_mi_iprintf+0x280
x_mi_mpprintf+0x64
tcp_status_report+0x188
x_nd_getset+0x148
tcp_wput_ioctl+0x9c
tcp_wput+0x82c
putnext+0xcc
wait_iocack+0x68 s
tr_istr_ioctl+0x738
hpstreams_ioctl_int+0x6a8
hpstreams_ioctl+0x50
spec_ioctl+0xac
vno_ioctl+0x90
ioctl+0x7c
syscall+0x480
$syscallrtn+0x0
( SR number: 8606187409 ; Defect: JAGad56616 )
An AF_UNIX socket application hangs on MP system.
( SR number: 1653284372 ; Defect: JAGaa44209 )
STCP recv() with MSG_PEEK is different from BSD.
( SR number: 5003411751 ; Defect: JAGaa27047 )
A connection in FIN_WAIT_2 can stay forever.
Note: This defect was fixed in PHNE_19899, but it
was not documented in the patch.
( SR number: 8606198555 ; Defect: JAGad67744 )
Problems compiling recent versions
of transport source code within ClearCase.
These compilation failures are not visible
to customers
( SR number: 8606198614 ; Defect: JAGad67803 )
System hangs and free memory is zero.
System TOC with the following trace:
putnext+0x188
ip_wput_ire+0x398
ip_wput+0x470
putnext+0xcc
tcp_rput+0x1088
csq_turnover_with_lock+0x84
str_spu_sw_isr+0x200
sw_service+0xb0
mp_ext_interrupt+0x150
ivti_patch_to_nop3+0x0
ki_accum_push_TOS+0xa0
syscall+0x808
$syscallrtn+0x0
PHNE_24075:
This patch replaces PHNE_23456
( SR number: 8606197851 ; Defect: JAGad67042 )
T_ALLOPT option in XTI/TLI will fail with TBADOPT.
Also the tcp initial congestion window is too large
possibly causing performance problems at connect time.
( SR number: 8606154818 ; Defect: JAGad24135 )
The system with IPSEC installed can panic with
the following trace:
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
ip_flush_readers+0x1a8
ip_close+0x238
close_wrapper+0x38
csq_protect+0x120
osr_pop_subr+0x1fc
osr_close_subr+0x324
hpstreams_close_int+0xd40
streams_close+0x14
soclose+0x670
soaccept+0x2d8
sodequeue+0x224
accept+0x23c
syscall+0x480
$syscallrtn+0x0
( SR number: 8606160792 ; Defect: JAGad30111 )
A server program listening for incoming connection
requests with select() or accept() can receive
notification of a connection's existence before
it is fully established.
( SR number: 8606164046 ; Defect: JAGad33347 )
Some customers using the Raptor Firewall product found
the daemon processes (tcp_gspd) spinning and eating
CPU time (70-80% of a cpu on UP systems).
( SR number: 8606166814 ; Defect: JAGad36101 )
Remsh hangs.
( SR number: 8606176180 ; Defect: JAGad45420 )
UDP socket bound to local IP address cannot receive
broadcast packet.
( SR number: 8606178029 ; Defect: JAGad47256 )
gettcpstate() is not available in 11.0.
( SR number: 8606178097 ; Defect: JAGad47324 )
The system has a Data Page Fault panic with
either of the following two traces:
Trace 1:
panic+0x14
report_trap_or_int_and_panic+0x4c
interrupt+0x1e8
$ihndlr_rtn+0x0
puthere+0x44
mi_timeout_exec+0x224
sw_service+0x8c
mp_ext_interrupt+0x108
ivti_patch_to_nop3+0x0
idle+0x1e8
swidle_exit+0x0
Trace 2:
panic+0x14
report_trap_or_int_and_panic+0x4c
interrupt+0x1e8
$ihndlr_rtn+0x0
puthere+0x44
tcp_rput_context_check+0x4a4
tcp_rput+0x784
putnext+0x16c
ip_rput_local+0x524
ip_rput+0x648
putnext+0x16c
hp_dlpi_mbuf_fast_in+0x70
hp_dlpi_intr_put+0x154
streams_put+0x134
hp_dlpi_intr+0x84
lan2_process_packet+0xcc
lan2_int_fr_rnr+0x19c
lan2_isr+0x184
eisa_int+0x134
lasi_interrupt+0x5c
mp_ext_interrupt+0x300
ivti_patch_to_nop3+0x0
idle+0x1b8
swidle_exit+0x0
( SR number: 8606183744 ; Defect: JAGad52955 )
Individual host route on local interface does
not work if the subnet route for the subnet
containing that host is removed.
( SR number: 8606187509 ; Defect: JAGad56716 )
When a program uses the ICMP TIMESTAMP request
message to query an HP-UX system for the
current time, the reply generated provides
less precise information than was available
from a 10.20 system.
( SR number: 8606194889 ; Defect: JAGad64095 )
Partially-completed incoming connection
requests can occupy excessive system memory.
PHNE_23456:
This patch replaces PHNE_22869
( SR number: 8606147348 ; Defect: JAGad16691 )
Data is received with garbage bytes appended to it. The
length of the received data will have a size which is a
multiple of STRMSGSZ (where STRMSGSZ is the value of the
kernel parameter STRMSGSZ on the system sending the data).
For this to occur, the kernel parameter STRMSGSZ must have
been changed to a value smaller than the default on the
system which sends the data.
( SR number: 8606151945 ; Defect: JAGad21284 )
The system experiences extensive memory consumption
when processing large numbers of routes.
( SR number: 8606155790 ; Defect: JAGad25103 )
X-terminals are not able to boot from a server
operating in a Service Guard environment.
( SR number: 8606169570 ; Defect: JAGad38845 )
panic: Data memory protection fault
gelan_if_resolved_output+0x106c
hp_dlpi_mblk_CKO_fast_out+0x60
hp_dlpi_wput+0x64
putnext+0xcc
ip_wput_ire+0x454
ip_wput+0x470
csq_turnover_with_lock+0x84
putnext+0x258
hp_dlpi_mblk_fast_in+0x98
hp_dlpi_mblk_intr_put+0xc8
streams_put_release+0x1cc
hp_dlpi_mblk_intr+0x4c
lanc_ether_ics+0x240
( SR number: 8606170531 ; Defect: JAGad39795 )
Large numbers of connections on WWW servers fail to
close completely. They are left stranded forever in the
the CLOSE_WAIT state.
( SR number: 8606175299 ; Defect: JAGad44542 )
The system panics with a Data Page Fault.
A possible stack looks like this:
panic+0x14
report_trap_or_int_and_panic+0x84
trap+0xd9c
nokgdb+0x8
ipc_hash_insert+0x84
ip_bind+0xc28
ip_wput_nondata+0x38
.
.
.
( SR number: 8606175531 ; Defect: JAGad44771 )
An IGMP_HOST_MEMBERSHIP_QUERY can cause a
divide by zero panic.
igmp_input+0x7e4
ip_rput_local+0xc00
ip_rput+0x238
putnext+0xcc
hp_dlpi_unitdata_in+0x1108
hp_dlpi_mblk_intr_put+0x7bc
streams_put_release+0x1cc
hp_dlpi_mblk_intr+0x4c
lanc_ether_ics+0x240
_btlan3_receive_pkts+0x3a0
_btlan3_isr+0x178
sapic_interrupt+0x2c
mp_ext_interrupt+0x34c
ivti_patch_to_nop3+0x0
idle+0x814
swidle_exit+0x0
( SR number: 8606177050 ; Defect: JAGad46285 )
If inbound UDP packets are dropped because of socket
receive buffer overflow, it is difficult to discern
which UDP connection is getting overflowed and how
many times it has happened.
( SR number: 8606178227 ; Defect: JAGad47454 )
Keepalive probes exceed the desired length of time
set by the ndd tunable tcp_keepalive_interval.
( SR number: 8606181319 ; Defect: JAGad50536 )
An ENOTCONN is intermittently returned when
a read is done on a non-blocking socket.
( SR number: 8606184465 ; Defect: JAGad53672 )
Event_port not supported by sockets.
( SR number: 8606184470 ; Defect: JAGad53677 )
System panics whenever a "poll" is done via "event_port"
on an AF_UNIX socket that was created by socketpair().
Here is the panic;
soo_select2+0x8
soo_select+0x14
unp_poll_handler+0x40
so_poll_switch+0x74
evp_dp_poll+0x20c
evp_ioctl+0x104
spec_ioctl+0xac
vno_ioctl+0x90
ioctl+0x1f4
syscall+0x480
$syscallrtn+0x0
( SR number: 8606185191 ; Defect: JAGad54393 )
System panic's with the following stack;
unp_eventreg+0x4
so_eventreg+0x6c
evp_dereg_objhdr+0xa0
evp_close+0x15c
call_open_close+0x1f8
closed+0xb0
spec_close+0x54
vn_close+0x48
vno_close+0x20
closef+0x64
exit+0x324
rexit+0x28
syscall+0x200
$syscallrtn+0x0
PHNE_22869:
( SR number: 4701419036 ; Defect: JAGaa93907 )
If one urgent byte is on a socket, and a
recv() is done without MSG_OOB on that
socket, the urgent byte will disappear.
Subsequent recvmsg() calls with the
MSG_OOB flag on will return EINVAL,
instead of returning the urgent byte.
( SR number: 8606160311 ; Defect: JAGad29635 )
Bringing up an interface with ifconfig
may fail occasionally. This is also
visible in errors from the ServiceGuard
daemon "cmcld" if a network cable is
rapidly and repeatedly unplugged and
plugged back in.
( SR number: 8606162823 ; Defect: JAGad32139 )
The sytem panics with a stack overflow.
panic+0x14
report_trap_or_int_and_panic+0x94
trap+0x9f4
nokgdb+0x8
lanc_media_control+0x10e0
hp_dlpi_ioctl+0x658
hp_dlpi_control+0x184
hp_dlpi_wput+0xb24
putnext+0xcc
ip_wput_ctl+0x13c
ip_wput_nondata+0x41c
ip_wput+0xa0
puthere+0x148
ar_entry_squery+0x140
ar_cmd_dispatch+0xb0
ar_rput+0x58
puthere+0x148
ip_newroute_ipif+0x348
ip_wput_multicast+0x218
igmp_sendpkt_defrd+0x44
ip_newroute_ipif+0x378
ip_wput_multicast+0x218
igmp_sendpkt_defrd+0x44
ip_newroute_ipif+0x378
ip_wput_multicast+0x218
igmp_sendpkt_defrd+0x44
.
.
.
ip_newroute_ipif+0x378
ip_wput_multicast+0x218
igmp_sendpkt_defrd+0x44
ip_close+0x5a0
close_wrapper+0x38
csq_protect+0x120
osr_pop_subr+0x22c
osr_close_subr+0x2f8
hpstreams_close_int+0x2f8
streams_close+0x14
soclose+0x214
soo_close+0x90
closef+0x178
exit+0x944
rexit+0x24
syscall+0x610
$syscallrtn+0x0
( SR number: 8606165984 ; Defect: JAGad35271 )
Panic during FIN processing on a system
experiencing memory pressure.
0x000e4450 (set_protid_registers+0x1bfc)
0x004e6ff4 (tcp_hash_insert_port+0x2c)
0x004ee800 (tcp_reinit+0x4d0)
0x004e31c8 (tcp_clean_death+0x280)
0x004f00e0 (tcp_rput+0x1838)
0x0057ea68 (csq_turnover_with_lock+0xb0)
0x0056ede0 (putnext+0x2b0)
0x0059f75c (streams_write_uio+0x204)
0x003832b0 (sosend+0x1230)
0x003783a4 (sendit+0x41c)
0x00377eac (send+0x74)
0x0031b304 (syscall+0x754)
( SR number: 8606170482 ; Defect: JAGad39746 )
Data transfer accross TCP connections which involve
PMTU is extremely slow.
( SR number: 8606167240 ; Defect: JAGad36526 )
Symptom:
System panic's with;
4) putnext+0x18
5) ip_wput_local+0x528
6) ip_wput_ire+0x43c
7) ip_wput+0x458
8) csq_turnover_with_lock+0x88
9) osr_pop_subr+0x98c
10) osr_close_subr+0xb00
11) hpstreams_close_int+0xd40
12) hpstreams_close+0x2c
13) call_open_close+0x1f8
14) closed+0xb0
15) spec_close+0x54
16) vn_close+0x48
17) vno_close+0x20
18) closef+0x68
19) close+0x48
20) syscall+0x200
When using XTI programs over loopback.
PHNE_22527:
( SR number: 8606152595 ; Defect: JAGad21925 )
The following type of message fills up too much space
in the syslog file.
vmunix: tunioctl(0): Unknown ioctl <hex number>
( SR number: 8606157385 ; Defect: JAGad26717 )
Data Page Fault Panic when memory allocation has had
to be delayed.
trap+0x10f0
nokgdb+0x8
qenable+0x10
mi_ibc_qenable+0x6c
csq_protect+0x1c0
bufcall_rsrv+0xf4
str_mem_daemon+0x214
im_strmem+0x1c
DoCalllist+0xc0
( SR number: 8606158668 ; Defect: JAGad27998 )
A shutdown() called on a LISTEN socket returns
EINVAL.
( SR number: 8606159910 ; Defect: JAGad29236 )
Connections getting ETIMEDOUT errors after a
connection is established.
( SR number: 8606161281 ; Defect: JAGad30597 )
The following message repeatedly appears in the
system logfile.
"T_ERROR_ACK, ERROR_prim==1"
( SR number: 8606164864 ; Defect: JAGad34161 )
A MSG_OOB recv() on a socket which has been set
to non-blocking and for which there is no OOB data
blocks rather than returning an error.
( SR number: 8606165518 ; Defect: JAGad34812 )
Need to pre-enable the select performance code.
( SR number: 8606165729 ; Defect: JAGad35020 )
Customer is seeing RESET's during connects if the
requested MSS is smaller than the tcp_mss_min
set on the system.
( SR number: 8606159784 ; Defect: JAGad29110 )
getsockname() hangs for a SOCK_RAW socket.
PHNE_22397:
( SR number: 8606158528 ; Defect: JAGad27858 )
Customer's cannot load latest patch (PHNE_22067)
unresolved external streams_select3()
( SR number: 8606140338 ; Defect: JAGad09705 )
Applications that quickly reconnect to the same remote
port (e.g. remsh) can experience 2-second delays in
connection establishment.
( SR number: 8606160948 ; Defect: JAGad30266 )
TCP connections exhibit poor performance over
cellular-style wireless links.
PHNE_22318:
( SR number: 8606158410 ; Defect: JAGad27740 )
System or processor appears to be hung. Symptoms are
not observed in patches PHNE_21767 or earlier.
( SR number: 8606147084 ; Defect: JAGad16427 )
A client will continue to use a stale route for
a virtual IP address when that address has been
reassigned to a different server.
( SR number: 8606147559 ; Defect: JAGad16901 )
The ACKs from the receiver machine are off by many windows.
Unfortunately, the sender machine doesn't seem to notice,
and it continues to increase the number of segments in
the window with each send -- Until the ACKs *finally* fall
outside the window gap. Then the sender drops back to
begin slow-start all over again.
( SR number: 8606154650 ; Defect: JAGad23967 )
Some clients can cause TCP connections to be
set up which will cause excessive memory
consumption by data buffers.
( SR number: 8606156407 ; Defect: JAGad25744 )
An application listening on a server TCP socket
can hang if many clients are initiating connections
and then aborting them (resetting them) before
the server can complete the connection accept operation.
( SR number: 8606157574 ; Defect: JAGad26905 )
Anomalous error returns may happen
while executing the accept system call.
PHNE_22067:
( SR number: 8606134419 ; Defect: JAGad03554 )
System panics with a data page fault. Two
different stack traces are possible.
Trace 1:
crfree+0x3c
closef+0x80
close+0x48
syscall+0x480
Trace 2:
soo_select+0x10
pollscan+0xb0
poll+0x104
syscall+0x480
( SR number: 8606134761 ; Defect: JAGad03896 )
When the SO_RCVBUF socket option is
set with setsockopt() to a large value
which exceeds the maximum allowed,
no error is returned and
the actual value set (which can be
obtained with a subsequent getsockopt() call)
is 65535 instead of the maximum allowed.
( SR number: 8606137889 ; Defect: JAGad07049 )
HP-UX does not respond to unicast arp replies.
( SR number: 8606141085 ; Defect: JAGad10446 )
When an application sets up to do asyncronous I/O
(signals) on a socket and calls connect(2), if it
catches a signal during the connect(2) call,
connect(2) returns EINTR. This is a correct return.
However, if the program calls connect(2) again,
connect(2) returns EINVAL. In this case, this is
an incorrect return.
( SR number: 8606144006 ; Defect: JAGad13339 )
Non-privileged users cannot open a UDP socket
with an ephemeral port.
( SR number: 8606145162 ; Defect: JAGad14500 )
Application server hangs in recv.
( SR number: 8606146766 ; Defect: JAGad16109 )
The public domain ipfilter product cannot be installed
on 11.x due to undefined symbols (if_lookup_on_name
and ir_lookup).
PHNE_21890:
( SR number: 8606126852 ; Defect: JAGac59693 )
Select based applications slow down when moving from
10.20 to 11.00.
( SR number: 8606134574 ; Defect: JAGad03709 )
Inbound packet traffic is seen mostly on one processor.
Need enhancement to make inbound packet schedualing better.
better.
PHNE_21767:
( SR number: 1653286641 ; Defect: JAGaa44778 )
recvmsg() returns EMSGSIZE, when the message size is
correct.
PHNE_21606:
( SR number: 8606132568 ; Defect: JAGad01717 )
The connection will hang when an out of order FIN
arrives and is never retransmitted.
( SR number: 8606134441 ; Defect: JAGad03576 )
Under special network load conditions
in which a machine is frequently making
ARP requests which do not succeed,
a memory leak occurs which can eventually
use up all system memory and cause a
system to panic. Symptoms are not observed
in patches prior to PHNE_20436, and
certain details depend upon which patch is
in place. In patches starting with PHNE_20436
but prior to PHNE_21038, the memory leak
is in the 32-byte bucket. Starting with
PHNE_21038, the leak is in the 64-byte bucket.
PHNE_21318:
( SR number: 8606127632 ; Defect: JAGac78434 )
select() can hang when called following
a connect() call that returned EINPROGRESS.
( SR number: 8606129427 ; Defect: JAGac86974 )
Double system panics occurred duing an X.25 test.
stack trace for event 0
crash event was a panic
panic+0x14
too_much_time+0x2d8
wait_for_lock+0x120
slu_retry+0x18
mp_socket_lock+0x2c
XLS_F0_a_connect_ind+0x4c
XLS_F_handler+0x6a4
XST_F_read_put+0x398
putnext+0x16c
N2Z_F0_rserv+0x2b0
sq_wrapper+0x90
str_sched_mp_daemon+0x104
str_sched_daemon+0x2b8
main+0x538
$vstart+0x34
$locore+0x90
trace event 1
stack trace for event 1
crash event was a panic
panic+0x14
wait_for_lock+0x2b4
slu_retry+0x18
mp_socket_lock+0x2c
soaccept+0x28
sodequeue+0x19c
accept+0x154
syscall+0x1c8
$syscallrtn+0x0
Defect Decription:
A spinlock was not released correctly,
it cause a spinlock deadlock.
( SR number: 8606130980 ; Defect: JAGad00139 )
"Lock not held" Panic stack:
panic+0x14
sodequeue+0x530
accept+0x1b8
syscall+0x1c8
$syscallrtn+0x0
( SR number: 8606131229 ; Defect: JAGad00380 )
The HP-UX system does not respond to keepalive
requests.
( SR number: 8606125525 ; Defect: JAGac40915 )
A system can hang when applications
take away system resources by successfully
allocating extremely large buffers.
PHNE_21038:
( SR number: 5003453233 ; Defect: JAGaa95389 )
System panics when the opening of
/dev/nuls races with the closing of /dev/nuls.
This device is used by netstat.
mi_close_comm1+0x44
x_mi_close_comm+0x14
nuls_close+0x14
close_wrapper+0x38
csq_protect+0xd0
osr_pop_subr+0x1b8
osr_close_subr+0x2b8
hpstreams_close_int+0x2a0
hpstreams_close+0x24
call_open_close+0x1bc
closed+0xa0
( SR not found ; Defect: JAGab67537 )
System panic when ifconfig is running on a X.25 interface.
( SR number: 8606112028 ; Defect: JAGab84237 )
Panic during system startup ONLY on DEBUG KERNELS.
Panic message and top of stack backtrace (output
by kernel during panic) look like this:
panic: assertion failed (alloc_spinlock: spinlocks held)
at line 1844 in /ux/core/kern/sys/spinlock.c
PC-Offset Stack Trace (read down, top of stack is 1st):
0x001cb4fc (panic+0x54)
0x001cbf5c (assfail+0x3c)
0x001cc118 (_assfail+0x30)
0x001d4f74 (alloc_spinlock+0x11c)
0x00539364 (ire_create+0xec)
0x00547400 (ipif_up_arp_and_ires+0x430)
0x00546d28 (ipif_up+0x308)
0x00545d08 (ipif_loopback_init+0x110)
0x00519394 (ip_open+0x364)
( SR number: 8606114887 ; Defect: JAGac29660 )
IP addresses assigned to loopback interfaces (lo0:<N>)
can not be reached from the network.
( SR number: 8606124808 ; Defect: JAGac40200 )
T_ORDREL_REQ out of state error messages appear in
nettl.LOG file.
( SR number: 8606125177 ; Defect: JAGac40568 )
The command 'netstat -a' sometimes causes
a panic with the following stack trace.
udp_snmp_get+0x218
snmpcom_req+0x130
udp_wput_other+0x218
udp_wput+0x1c0
putnext+0x198
putmsg_subr+0x174
putmsg+0x190
syscall+0x200
$syscallrtn+0x0
( SR number: 8606125342 ; Defect: JAGac40733 )
System panics with the following stack trace.
ip_rput_local+0x21c
ip_rput+0x894
putnext+0x1a4
hp_dlpi_unitdata_in+0x5a0
hp_dlpi_mblk_intr_put+0x2d8
streams_put_release+0x2c8
hp_dlpi_mblk_intr+0x80
---
---
( SR number: 8606126203 ; Defect: JAGac56768 )
A RST is sent when a SYN is received.
Defect Discription:
If TCP initial sequence numbers are messed up,
a RST packet is sent in response to a SYN received
during TCP TIME_WAIT state.
PHNE_20735:
( SR number: 8606110756 ; Defect: JAGab83504 )
Accept() threads don't exist when their process
is killed.
( SR number: 8606123969 ; Defect: JAGac39329 )
System panics when closing AF_UNIX sockets with the
following stack;
b_owns_sema+0x8
unp_discard+0x60
unp_scan+0x88
unp_dispose+0x1c
sorflush+0x90
sofree+0x8c
soclose+0x7d0
soo_close+0x7c
closef+0x64
exit+0x2f0
psig+0x220
syscall+0x914
$syscallrtn+0x0
PHNE_20633:
( SR number: 8606107486 ; Defect: JAGab77719 )
A temporary file /tmp/stcp.conf is left around
unnecessarily.
( SR number: 4701413963 ; Defect: INDaa30107 )
Ifconfig may initialize network interfaces incorrectly
during system startup.
( SR number: 4701430850 ; Defect: JAGab50646 )
When using a sendfile related application,
the system can panic.
Stack trace with vmtrace on
crash event was a panic
panic+0x14
vmtrace_kfree+0x230
kfree_common+0x2d0
getnewbuf+0x828
ogetblk+0x110
getblk1+0x290
realloccg+0x2f8
bmap+0x710
rwip+0xecc
ufs_rdwr+0x388
vno_rw+0x84
write+0x108
syscall+0x200
$syscallrtn+0x0
( SR number: 8606110207 ; Defect: JAGab82910 )
SNMP returns wrong tcpCurrEstab mib value
( SR number: 8606110239 ; Defect: JAGab82942 )
If a server receives a RESET on a socket and does not
close it, all new connections for the SAME remote
port will be dropped.
( SR number: 8606110349 ; Defect: JAGab83053 )
System panic - Data page fault
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
TPI_conn_conf+0x14
so_check_inb_conn_conf+0xc8
soo_select+0x328
select+0x12c4
syscall+0x480
$syscallrtn+0x0
( SR number: 8606112290 ; Defect: JAGab84607 )
SYNs sent to an XTI listen socket are sometimes
dropped.
PHNE_20436:
( SR not found ; Defect: JAGaa95395 )
SO_LINGER does not work.
( SR number: 1653309039 ; Defect: JAGab25258 )
Programs or subsystems (such as NFS) using large
packet sizes could see data corruption when used
on multiprocessor systems with multiple clients
sending data to the same server.
( SR not found ; Defect: JAGab32011 )
Data page fault:
stack trace for event 0
crash event was a panic
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xe08
nokgdb+0x8
ip_rput_dlpi+0x1c4
ip_rput+0x6ec
putnext+0x80
LDI_F0_send_error_ack+0x78
LDI_F_error_ack+0x8c
LDI_F0_error_action+0x50
LDI_F_handler+0x2c8
LEC_F0_uwproto+0x158
LEC_F0_uwput+0x94
puthere+0x84
ip_wput_nondata+0x26c
ip_wput+0x16c
...
( SR number: 8606104338 ; Defect: JAGab71774 )
T_ORDREL_REQ out of state error messages
appear in nettl.LOG file.
( SR number: 8606106267 ; Defect: JAGab75241 )
For a connection between 10.20 and 11.00,
when the 10.20 advertises 0 window for
some period of time, 11.00 can get
hung.
( SR number: 8606106481 ; Defect: JAGab75639 )
Panic in kmalloc() called via sockname().
panic+0x14
trap+0xdb8
nokgdb+0x8
kmalloc+0x350
allocb_wait+0x290
sockname+0x54
( SR number: 8606113535 ; Defect: JAGab75825 )
When the receive side of a socketpair (AF_UNIX) is
"full" the system leaks memory and loses data.
( SR number: 8606113563 ; Defect: JAGab76769 )
When the receive side of a socketpair (AF_UNIX) contains
file descriptors and the socket is closed without reading
the data the system loses those descriptors.
( SR number: 8606113564 ; Defect: JAGab76776 )
Blocking sendmsg() returns EMSGSIZE when receive side is
close to being full. This can happen on blocking or
non-blocking.
( SR number: 8606107144 ; Defect: JAGab76839 )
A debug kernel panics when sleeping while
holding a lock.
( SR number: 8606107729 ; Defect: JAGab78013 )
Cose version of recvmsg does not get the file.
( SR number: 8606107946 ; Defect: JAGab78256 )
q4> trace event 0
stack trace for event 0
crash event was a panic
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
tcp_detach+0x5b0
tcp_close+0xec
close_wrapper+0x38
csq_protect+0x120
osr_pop_subr+0x1f4
osr_close_subr+0xb00
hpstreams_close_int+0xc3c
streams_close+0x14
soclose+0xe8
soo_close+0x90
closef+0x68
close+0x48
syscall+0x8f0
$syscallrtn+0x0
( SR number: 8606108899 ; Defect: JAGab81600 )
By using a special scanner, TCP
Initial sequence number exposes
a small possibility of predictability.
( SR number: 8606109254 ; Defect: JAGab81953 )
memory corruption.
( SR number: 8606109950 ; Defect: JAGab82651 )
OOB data was not removed from data queue
PHNE_20041:
( SR number: 8606105057 ; Defect: JAGab72884 )
Ping still sends packets when a lan cable is disconnected.
( SR number: 8606105583 ; Defect: JAGab73749 )
When the receive side of a socketpair (AF_UNIX) is
"full" the system leaks file descriptors and loses data.
( SR number: 8606106074 ; Defect: JAGab74913 )
A non-blocking accept() call blocks in the kernel.
PHNE_19899:
( SR number: 8606104784 ; Defect: JAGab65709 )
System panic in streams write queue.
sth_putq_owned+0x124
sth_rput_slow+0x620
sth_rput+0x870
putnext+0x50
tcp_rput_other+0x4ac
tcp_rput+0x1734
putnext+0x15c
ip_rput_local+0x328
ip_rput+0x648
putnext+0x50
hp_dlpi_mblk_fast_in+0x50
hp_dlpi_mblk_intr_put+0x6d0
streams_put_release+0x154
hp_dlpi_mblk_intr+0x3clanc_ether_ics+0xf8
btlan4_process_packet+0xac
btlan4_receive_pkts+0x944
btlan4_isr+0x110
dino_isr+0x128
mp_ext_interrupt+0x33c
ivti_patch_to_nop3+0x0
lanc_ether_ics+0xf8
btlan4_process_packet+0xac
( SR number: 5003448498 ; Defect: JAGaa46666 )
getsockname() doesn't return address family
if socket is not bound.
( SR number: 8606102973 ; Defect: JAGab69105 )
The system hangs due to a timing issue.
( SR not found ; Defect: JAGab69620 )
System panics when dereferencing a null pointer.
( SR not found ; Defect: JAGab71212 )
When a heavily-loaded multiprocessor system is
running a program with multiple threads or processes
accessing the same non-blocking socket, and doing
both 'connect' and 'select' operations simultaneously,
the kernel can panic. (Seen with Netscape proxy server
as application.)
( SR number: 8606104549 ; Defect: JAGab72160 )
System TOCs due to three simultaneous MIB extractions.
PHNE_19375:
( SR not found ; Defect: JAGaa57204 )
Transfer of data over loopback connections
is slow. First data packet takes about
one second to transfer.
( SR not found ; Defect: JAGab12875 )
System panics in network interface drivers.
( SR number: 1653309237 ; Defect: JAGab25385 )
Sometimes Service Guard switch does not work.
( SR number: 4701431221 ; Defect: JAGab53651 )
ifconfig <interface> unplumb
can leave behind stale routes. If IP attempts to
use these stale routes, the system will panic.
( SR not found ; Defect: JAGab65705 )
IP multicast local switch does not work properly.
PHNE_19110:
See Defect Description
PHNE_18708:
See Defect Description
PHNE_18611:
See Defect Description
PHNE_18554:
See Defect Description
PHNE_18553:
See Defect Description
PHNE_17662:
See Defect Description
PHNE_17613:
See Defect Description
PHNE_17446:
See Defect Description
PHNE_17227:
See Defect Description
PHNE_17117:
See Defect Description
PHNE_17018:
See Defect Description
PHNE_17017:
See Defect Description
PHNE_16645:
See Defect Description
PHNE_16497:
See Defect Description
PHNE_16283:
See Defect Description
PHNE_15995:
See Defect Description
PHNE_15911:
See Defect Description
PHNE_15692:
See Defect Description
PHNE_15583:
See Defect Description
PHNE_15047:
See Defect Description
PHNE_14876:
See Defect Description
PHNE_14730:
See Defect Description
PHNE_14702:
See Defect Description
PHNE_14575:
See Defect Description
PHNE_14279:
See Defect Description
PHNE_14274:
See Defect Description
PHNE_14260:
See Defect Description
PHNE_14017:
See Defect Description
PHNE_13692:
See Defect Description
PHNE_13405:
See Defect Description
Defect Description:
PHNE_27886:
( SR number: 8606244252 ; Defect: JAGae10742 )
Symptom:
Data transfer over TCP is very slow.
Defect Description:
If the receiving buffer size is reduced by the
application after the 3-way handshake, TCP window
scales down.
Resolution:
TCP window scale calculation has been corrected to
have an accurate setting.
( SR number: 8606248840 ; Defect: JAGae15237 )
Symptom:
System panics with the following stack trace
panic+0xa0
assfail+0x3c
_assfail+0x2c
b_vsema+0x36c
sounlock+0x974
mp_socket_unlock+0x10
function name is not available
pstat_socket+0x400
pstat+0x380
syscall+0x834
syscallinit+0x554
Defect Description:
A race condition exists when two threads try
to lock a pair of sockets.
Resolution:
Changes have been made in the socket locking
code to avoid the race.
( SR number: 8606272841 ; Defect: JAGae36947 )
Symptom:
It is not possible to know if the support for
RFC 1948 is enabled or disabled.
Defect Description:
The support for RFC 1948 can be enabled by setting the
ndd tunable tcp_isn_passphrase.
However, "ndd -get /dev/tcp tcp_isn_passphrase"
fails with the error:
"operation failed, Permission denied"
Resolution:
"ndd -get /dev/tcp tcp_isn_passphrase"
will now output:
0 - if the support for RFC 1948 is disabled
1 - if the support for RFC 1948 is enabled
( SR number: 8606272891 ; Defect: JAGae36997 )
Symptom:
The HP-UX 11.0 client does not transmit multicast packets
when INADDR_ANY is used.
Defect Description:
When the kernel has to choose an outgoing interface,
it does not search for the route added to a
destination multicast group. Hence, the packet is not
sent out.
Resolution:
The outgoing interface search is now done correctly
based on the destination multicast group when INADDR_ANY
is specified.
( SR number: 8606277294 ; Defect: JAGae41365 )
Symptom:
Applications using UDP via XTI or applications
using remote file locking via NFS may cause
datagram packets to be dropped.
Defect Description:
The default receive buffer size for UDP stream is reduced
to 512. So the number of inbound UDP packets that are
dropped increases if the receiving application does not
read the data fast enough.
Resolution:
The default receive buffer size for UDP has been
restored to 65536.
PHNE_27058:
( SR number: 8606226976 ; Defect: JAGad96038 )
Symptom:
Repeatedly joining and leaving various multicast
groups and rejoining already joined groups causes
the system to hang.
Defect Description:
The kernel allocates memory to copy user data into
kernel and this memory is not freed upon encountering
certain error.
Resolution:
The memory allocated by kernel to copy user data
when joining or leaving a multicast group is freed
upon encountering an error.
( SR number: 8606233305 ; Defect: JAGae02529 )
Symptom:
Application hangs in the accept(2) system call.
Defect Description:
A message is being sent to the wrong thread or process
during accept(2) processing.
Resolution:
A new ioctl for streams has been introduced to make the
connection request to TCP atomic.
( SR number: 8606238262 ; Defect: JAGae07289 )
Symptom:
Data corruption occurs in the socket structure during
a connect(2).
Defect Description:
While doing a connect(2), fields are changed in the socket
structure without holding a lock. This can result in
data corruption.
Resolution:
The socket structure is locked before its fields are
modified. This prevents race conditions and the
associated data corruption.
( SR number: 8606241187 ; Defect: JAGae08450 )
Symptom:
The system does not respond to any keystrokes or
commands and appears to hang. A Service Guard system
will perform TOC.
Defect Description:
A broadcast SYN packet is being delivered to
TCP. There is a huge buildup in the
established connection array. This causes
lookups into the array to take a long time
making the system appear to hang.
Resolution:
Inbound broadcast packets are prevented from
reaching TCP. These packets are filtered out
at the IP level.
( SR number: 8606241192 ; Defect: JAGae08455 )
Symptom:
Memory leak of timer related mblks in 512-byte bucket.
Defect Description:
Timer mblks are allocated at the time of opening
a TCP stream in 512-byte bucket. In a rare case,
these mblks are not freed on closing the TCP stream.
Resolution:
Code has been modified to ensure that the timer
related mblks are freed at the time of closing
the TCP stream.
( SR number: 8606242679 ; Defect: JAGae09914 )
Symptom:
A process appears to hang in accept(2) and cannot be
killed when there is another process doing a
getsockopt(2) on the same socket.
Defect Description:
If the remote client sends a RST before the connection
request is accepted, the T_DISCON_IND message can be
appropriated by getsockopt(2). This causes accept(2)
to wait forever.
Resolution:
TCP no longer removes the T_DISCON_IND message from
the stream head when processing the SO_ERROR socket
option from a listen socket.
( SR number: 8606247193 ; Defect: JAGae13633 )
Symptom:
System panics with either of the following stack traces:
stack trace for event 0
crash event was a panic
panic+0x14
too_much_time+0x2d4
wait_for_lock+0x120
sl_retry+0x18
ip_trash+0x18
ip_rtimer+0x38
ip_rput+0x3c0
puthere+0x140
mi_timeout_exec+0x224
sw_service+0x8c
mp_ext_interrupt+0x108
ivti_patch_to_nop3+0x0
idle+0xd5c
swidle_exit+0x0
stack trace for event 0
crash event was a panic
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
ilm_lookup_exact+0x4
ip_delmulti+0x40
ilg_delete+0x90
ilg_delete_all+0x34
ip_close+0x58
close_wrapper+0x38
csq_protect+0x120
osr_pop_subr+0x214
osr_close_subr+0xcbc
hpstreams_close_int+0x31c
streams_close+0x14
soclose+0x308
soo_close+0x90
closef+0x64
close+0x90
syscall+0x200
$syscallrtn+0x0
Defect Description:
A multicast application which has not done a bind
calls SIOCSWITCHIFADDR to switch interface and when
it closes the socket, the system panics since multicast
interface information was not updated with the new
interface.
Resolution:
Code has been changed to search through both bound
and unbonud IP streams to update the new interface
for the multicast information.
( SR number: 8606248331 ; Defect: JAGae14731 )
Symptom:
System panics during boot after building the
kernel with tcphashsz value less than 256.
Defect Description:
A hash table derived its size from the value
of tcphashsz and any value less than 256
caused the size of this hash table to be zero
resulting in panic on boot.
Resolution:
If the value specified for tcphashsz is less
than 256, default it to 256.
( SR number: 8606249571 ; Defect: JAGae15961 )
Symptom:
System panics with either of the following stack traces:
stack trace for event 0
crash event was a panic
panic+0x14
report_trap_or_int_and_panic+0x84
interrupt+0x1d4
$ihndlr_rtn+0x0
ip_rput_unbind_do+0x1ec
ip_rput_dlpi+0x2f4
ip_rput+0x4c0
csq_turnover_with_lock+0x84
putnext+0x258
hp_dlpi_mblk_fast_in+0x354
hp_dlpi_mblk_intr_put+0x960
streams_put+0xe8
streams_put_release+0x168
hp_dlpi_mblk_intr+0x14c
apa_intr+0x184
lanc_ether_ics+0x114
_btlan3_receive_pkts+0x588
_btlan3_isr+0x198
dino_isr+0xcc
mp_ext_interrupt+0x318
ivti_patch_to_nop3+0x0
idle+0x1054
swidle_exit+0x0
stack trace for event 0
crash event was a panic
panic+0x14
report_trap_or_int_and_panic+0x84
interrupt+0x1d4
$ihndlr_rtn+0x0
ip_rput_dlpi_up+0x550
ip_rput_dlpi+0x98
ip_rput+0x4c0
csq_turnover_with_lock+0x84
putnext+0x258
ar_client_notify+0x78
ar_rput+0x7d0
putnext+0xcc
hp_dlpi_unitdata_in+0x1504
hp_dlpi_intr_put+0x8b0
streams_put+0xe8
hp_dlpi_intr+0x214
lan2_process_packet+0x87c
lan2_int_fr_rnr+0x1b0
lan2_isr+0x164
lasi_interrupt+0x64
mp_ext_interrupt+0x318
ivti_patch_to_nop3+0x0
sounlock+0x90
mp_socket_unlock+0x10
soreceive+0x4bc
recvit+0x144
recv+0x54
syscall+0x6f8
Defect Description:
A pointer to a streams queue is retreived
from a message and dereferenced. The validity
of this pointer depends on the type of the
message. A panic occurs when a pointer is
dereferenced from a message of incompatible
type.
Resolution:
The queue pointer will be retreived only if
the message currently handled is of the correct
type.
( SR number: 8606250217 ; Defect: JAGae16597 )
Symptom:
System panics with the following stack trace:
panic+0x14
report_trap_or_int_and_panic+0x84
trap+0xd9c
nokgdb+0x8
ill_delete+0x5c8
ip_close+0x1e4
close_wrapper+0x38
csq_protect+0x120
osr_pop_subr+0x214
osr_close_subr+0xf50
osr_unlink+0x1fc
str_plumb_ioctl+0x4a4
hpstreams_ioctl_int+0x398
hpstreams_ioctl+0x50
spec_ioctl+0xac
vno_ioctl+0x90
ioctl+0x78
syscall+0x6f8
$syscallrtn+0x0
Defect Description:
In one of the lists, messages coming from
the driver will not have a pointer to the queue
set in the mblk. The ill_delete() code assumed
that a pointer to the queue was available and
deferenced it, causing a panic.
Resolution:
While walking through the list of mblks at
the time of deletion, simply free the mblk
if it is from a driver.
( SR number: 8606257697 ; Defect: JAGae22000 )
Symptom:
System panics with the following
stack trace:
stack trace for event 0
crash event was a panic
panic+0x14
too_much_time+0x2e0
wait_for_lock+0x14c
slu_retry+0x1c
mp_socket_lock+0x2c
TPI_ok_ack+0x1a4
soaccept+0x5f4
sodequeue+0x30c
accept+0x168
syscall+0x200
$syscallrtn+0x0
Defect Description:
A spinlock is held before calling a function
that could go to sleep. In the meanwhile, if
another thread tries to acquire that spinlock,
the system panics.
Resolution:
Release the socket lock before calling the function
that could go to sleep and then reacquire it after
returning from the function.
( SR number: 8606259311 ; Defect: JAGae23629 )
Symptom:
POSIX recvmsg() returns incorrect "cmsg_len".
Defect Description:
When a 32 bit POSIX application is run on a 64 bit
kernel, necessary adjustments for certain fields
in a message header is done twice.
Resolution:
Code has been modified to ensure that the
necessary adjustments for the fields in the
message header is done only once.
PHNE_26771:
( SR number: 8606236775 ; Defect: JAGae05826 )
Defect Description:
The variable that provides the value for the flag
parameter in the SIOCATMARK ioctl is not cleared
even after an application reads past the out-of-band
data.
Resolution:
The variable that provides the value for the
flag parameter in the SIOCATMARK ioctl is set
and cleared correctly.
( SR number: 8606237266 ; Defect: JAGae06311 )
Defect Description:
connect() does not disconnect a socket when an already
connected datagram socket is passed to it.
Resolution:
Code has been modified to disconnect the socket when
invalid arguments are passed to connect() on a already
connected datagram socket.
( SR number: 8606238197 ; Defect: JAGae07224 )
Defect Description:
An application calling recv() with the MSG_OOB flag
loses part of the normal data, when only normal data
is available to be read in the stream head.
Resolution:
Appropriate code change was made to prevent the
data loss.
( SR number: 8606250322 ; Defect: JAGae16697 )
Defect Description:
There is an unnecessary compression of header
and data mblks for protocols which split their
header and data into separate mblks. This causes
recv() to fail.
Resolution:
Code has been changed to limit the fix
of JAGad58231 to AF_UNIX domain and
stream oriented sockets, thus avoiding
unnecessary compression of datagram type
sockets data.
PHNE_26445:
( SR number: 8606213513 ; Defect: JAGad82705 )
Symptom:
Systems relying on random increments for
choosing less predictable TCP ISN values,
are still vulnerable to statistical attacks.
Defect Description:
The RFC 1948 ("Defending against sequence
number attacks") is not supported.
Resolution:
The RFC 1948 is now implemented for computing TCP
ISN values.
By default, the support for RFC 1948 is turned off.
It can be turned on by using
the ndd variable, tcp_isn_passphrase <secret passphrase>.
The secret passphrase can be of any length, but only
the first 32 characters will be retained.
The passphrase, once set, should not be changed,
except possibly at reboot.
For example:
ndd -set /dev/tcp tcp_isn_passphrase "rfc 1948"
will turn on the support for RFC 1948.
( SR number: 8606218753 ; Defect: JAGad87901 )
Symptom:
System runs out of memory when it is under heavy
inbound TCP traffic.
Defect Description:
The inbound buffer for a socket is allowed
to grow without bounds if the stream head is in
use while data is being appended to the buffer.
Resolution:
Code has been modified to check if the synchronization
queue is getting too long (~1000) on the stream head. If so,
the tcp window is closed just as if the data queue on the
stream head were getting too full. This fix is dependent
on the streams tunable, streams_sqmax being set in the
next streams patch.
( SR number: 8606223127 ; Defect: JAGad92230 )
System seems to hang due to a memory leak in the 2k
bucket when sanmgr hostagent is running.
Defect Description:
When a socket joins a multicast group, the kernel
allocates memory to hold the group information. This
memory is not freed when the socket is closed.
Resolution:
Memory assigned to hold the group information when
a socket joins a multicast group, is now freed when
the socket is closed.
( SR number: 8606224045 ; Defect: JAGad93141 )
Symptom:
System runs out of memory and seems to hang.
Defect Description:
A RST signal is sent by TCP on receiving a segment,
which does not appear correct for the referenced
connection. The problem is exacerbated if there
is no valid route entry for the sender which causes
the system to invoke arp to resolve the sender's
address. If the segments continue to arrive,
and the inbound traffic is extremely high,
the arp requests and/or the RSTs will never
be transmitted.
Resolution:
The number of outstanding arp requests is
now limited.
( SR number: 8606224560 ; Defect: JAGad93648 )
Symptom:
FTP hangs when transfering files from PC DOS to HP-UX.
Defect Description:
TCP ignores a FIN that arrives with the old data (during
retransmission). This causes the TCP connection to hang
when FTP is copying files from PC DOS (NetManage PCTCP
stack) to HP-UX.
Resolution:
TCP no longer ignores a FIN which arrives with
retransmitted data.
( SR number: 8606225324 ; Defect: JAGad94412 )
Symptom:
"Communication stops" occur due to incorrect
host route in the routing table.
Defect Description:
An alternate indirect route entry was created for the
default route during interface switching. This was due
to an unintended side-effect of route lookups.
Resolution:
As indirect routes were never intended to be
supported, they are not created anymore.
( SR number: 8606228310 ; Defect: JAGad97367 )
Symptom:
read() done on a socket returned by
accept() returns the EWOULDBLOCK error.
Defect Description:
A race condition exists in accept() that is
exposed when multiple accepts are performed on the
same socket.
Resolution:
The code responsible for the race condition in
accept() has now been removed.
( SR number: 8606229279 ; Defect: JAGad98332 )
Symptom:
System panics with the following stack trace:
tcp_icmp_error+0x38
tcp_rput_other+0x518
tcp_rput+0x58
csq_turnover_with_lock+0x84
str_spu_sw_isr+0x654
sw_service+0xb0
mp_ext_interrupt+0x150
ivti_patch_to_nop3+0x0
idle+0x104
Defect Description:
A pointer associated with a packet which has been
enqueued
for delayed processing may become invalid before the
delayed
processing can commence.
Resolution:
TCP now checks if the tcp instance associated with the
packet is NULL before processing it in tcp_icmp_error().
( SR number: 8606229650 ; Defect: JAGad98702 )
Symptom:
System panics with the following stack trace:
igmp_timeout_handler+0x160
ip_rtimer+0x100
ip_rput+0x408
puthere+0x148
mi_timeout_exec+0x288
sw_service+0xb0
mp_ext_interrupt+0x150
ihandler+0x904
idle+0xe24
swidle+0x20
Defect Description:
A race condition exists when a data structure used
in the processing of multicast packets is freed
prematurely. This occurs when one thread is trying
to free the structure and another thread is trying to
handle
igmp timeout on the same structure. A DPF (Data Page
Fault)
panic occurs while trying to handle timeout for
the structure which is on the igmp timeout list.
Resolution:
Code has been modified to replace the deferred free
callback routine with a new routine which makes
sure that the bogus(freed) structure is not there
on the igmp timeout list.
( SR number: 8606230164 ; Defect: JAGad99215 )
Symptom:
Performance degradation after installing PHNE_23456.
Defect Description:
A change in the zero window probing mechanism causes
performance degradation.
Resolution:
Modified zero window probing mechanism now avoids
performance degradation.
( SR number: 8606231247 ; Defect: JAGae00485 )
Symptom:
System panics with the following stack trace:
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
tcp_get_ucred+0x1d4
tcp_wput_ioctl+0x160
tcp_wput+0x918
putnext+0xcc
wait_iocack+0x68
str_istr_ioctl+0x72c
hpstreams_ioctl_int+0x370
hpstreams_ioctl+0x50
spec_ioctl+0xac
vno_ioctl+0x90
ioctl+0x78
syscall+0x6f8
$syscallrtn+0x0
Defect Description:
Sendmail (or identd) probably caused this panic within
a small window of race condition.
Resolution:
The window of race condition in tcp_get_ucred()
that caused the system panic has now been removed.
( SR number: 8606231526 ; Defect: JAGae00764 )
Symptom:
System panics with the following stacks:
tcp_wput+0x58
csq_turnover_with_lock+0x84
str_spu_sw_isr+0x654
or
tcp_wput+0x58
putnext+0xcc
sth_wsrv+0x204
sq_wrapper+0x94
str_sched_up_daemon+0x1c4
str_sched_daemon+0x1a4
main+0x854
Defect Description:
There is a race between the closing of a stream
and data being put onto the stream's
synchronization queue.
Resolution:
A test for a null pointer is performed
on entering the function tcp_wput().
( SR number: 8606231951 ; Defect: JAGae01187 )
Symptom:
System panics with the following stack trace:
tcp_rsrv_comm+0x18
tcp_rput+0x3620
csq_turnover_with_lock+0x7c
str_spu_sw_isr+0x5f8
sw_service+0x8c
Defect Description:
An incorrect goto statement is executed
in an error path.
Resolution:
Changed error path code to exit the routine
using the correct goto statement.
( SR number: 8606232185 ; Defect: JAGae01421 )
Symptom:
System panics with the following stack trace:
tcp_rsrv_comm+0x18
tcp_rsrv+0x10
sq_wrapper+0x90
str_sched_mp_daemon+0x130
str_sched_daemon+0x2dc
main+0xa9c
$vstart+0x34
$locore+0x90
Defect Description:
Service routine is allowed to run on an closing queue.
Resolution:
A test for a null pointer is performed as the
service routine is entered.
( SR number: 8606232612 ; Defect: JAGae01847 )
Symptom:
If the primary route for an interface is deleted, then
a host on the same subnet is not reachable through the
secondary route, though the secondary network route
exists.
Defect Description:
For the local interface, a check is performed to
ascertain if the primary network route exists.
If not, a check is performed again to see if a host
specific route to the destination exists. Although
a secondary network route exists, the same is not
returned if there is no host route.
Resolution:
Code has been modified such that a route entry
associated with the secondary route is returned,
even if the primary route is deleted and if the host
specific route does not exist.
( SR number: 8606233090 ; Defect: JAGae02314 )
Symptom:
In some cases urgent data gets retransmitted
unnecessarily impairing performance.
Defect Description:
Packet validation inside tcp incorrectly drops
a valid packet containing urgent data.
Resolution:
Packet validation logic has been modified to
recognize valid urgent data packets.
PHNE_26412:
( SR number: 8606221602 ; Defect: JAGad90736 )
Symptom:
read() sometimes loses data and returns 0 on system
with PHNE_23456.
Defect Description:
Under certain circumstances T_ORDREL_IND message is
being passed upstream by TCP before sending any pending
eager data.
Resolution:
The fix takes care of eager data to be sent upstream.
PHNE_25423:
( SR number: 8606146239 ; Defect: JAGad15575 )
Symptom:
Intermittent hangs exhibited in close()
when using so_linger.
Defect Description:
There exists a corner case to the solution
resolved by JAGad09415 where the symptom
can still persist.
Resolution:
The window for the delay to manifest itself
has been fully closed.
( SR number: 8606160572 ; Defect: JAGad29893 )
Symptom:
When both ts option and socket cache are used,
tcp conection gets timed out.
Defect Description:
ACK WAR when using tcp_conn_strategy and TCP
RFC 1323 timestamp option
Resolution:
have tcp_t reinitialzed at the end of the connection.
( SR number: 8606189015 ; Defect: JAGad58231 )
Symptom:
UNIX domain socket programme uses a large amount of CPU.
This can be observed in some cases of fast producer
and a slow consumer type of client server programmes.
Defect Description:
When a slow consumer creates a small receive window, a
fast producer peer will create a mblk of size equal to
the window size, and append that to message list. Since
there is no low-water mark concept implementation, we
will be dividing the user requeset writes into smaller
sizes, depending upon window created by the consumer.
This may lead to a long linked list of small mblk's at
the socket buffer. As this list grows, appending routine
takes lots of CPU time while traversing the list for
finding the end of the list.
Resolution:
Code has been changed to pre-allocate buffer depending
upon the user requested size to write. Now instead of
creating the mblk of size equal to the receive window
and appending it to the message list we will
pre-allocate the buffer equal to the size of user
request. And in subsequent writes we will try to
compress the data if we have free buffer in the
previous mblk. This reduces the number of nodes in
the socket buffer list.
( SR number: 8606211448 ; Defect: JAGad80636 )
Symptom:
When IPSEC is active, nettl can turn on layer 4 tracing
Defect Description:
/dev/stcpmap does not return an error to nettl's ioctl()
requesting layer 4 traces when IPSEC is running.
Resolution:
/dev/stcpmap returns an error to SS_START_TRACE ioctl()
if a trace is requested for layer 4 and IPSEC is active.
( SR number: 8606217657 ; Defect: JAGad86809 )
Symptom:
ifconfig lan10000 fails, but ifconfig lan9999 succeeds.
Defect Description:
The transport code limits the ppa number to less than
10000.
Resolution:
Remove the limit checking of the ppa number in
transport code.
( SR number: 8606219937 ; Defect: JAGad89079 )
Symptom:
On UP boxes when 2 (or more) aio_reads are pending
on the same socket and ioctl(SIOCAIOABORT) is used,
a close on that socket will result in an unkillable
hung process.
Defect Description:
On UP boxes when 2 aio_reads are pending on the same
socket, the ioctl(SIOCAIOABORT) only completes one of the
pending aio_reads. So, a close on that socket results
in a hang.
Resolution:
The ioctl(SIOCAIOABORT) has been modified so that the other
aio_read cannot be left sleeping.
( SR number: 8606220568 ; Defect: JAGad89705 )
Symptom:
Sometimes telnet session initiated by W2K to
HP-UX 11.00 machine hangs.
Defect Description:
Fragmented IPSec packets may not work with
W2K's SP1. Problem is on W2K side with SP1
and SP2 installed.
Resolution:
TCP eliminates the first hop fragmentation due
to IPSec but this does not help if there is
subsequent fragmentation.
( SR number: 8606220677 ; Defect: JAGad89814 )
Symptom:
Data retransmission sometimes takes a long time.
Defect Description:
When packets get lost in a network, it takes a
long time (60 seconds or longer) to retransmit.
Resolution:
Correct the Round Trip Time initialization
so that the estimated RTO won't become too
large.
( SR number: 8606221602 ; Defect: JAGad90736 )
Symptom:
read() sometimes lose data and return 0 on system
with PHNE_23456.
Defect Description:
Under certain circumstances T_ORDREL_IND message is
being passed upstream by TCP before sending any pending
eager data.
Resolution:
The fix takes care of eager data to be sent upstream.
( SR number: 8606221777 ; Defect: JAGad90911 )
Symptom:
When setting ip_pmtu_strategy to 0 any non-local
networks have a maximum MTU of 576.
Defect Description:
The code assumes that a non-local route cannot
handle large MTU's.
Resolution:
A new value has been added to allow for no PMTU
and yet use the MAX MTU for a link. To implement
this change do the following;
ndd -set /dev/ip ip_pmtu_strategy 3
If a smaller MTU is needed for a given route
then use the above strategy and use the route
command with the pmtu option "-p".
( SR number: 8606222508 ; Defect: JAGad91621 )
Symptom:
When system memory use is very high
the accept system call returns ENOBUFS.
Defect Description:
Incorrect handling of listen backlog when
a SYN-RST pair arrives.
Resolution:
The listen backlog is now correctly updated
when a SYN-RST pair arrives. The backlog is not
decremented until the accept executes.
( SR number: 8606223947 ; Defect: JAGad93042 )
Symptom:
When loopback address, 127.n.n.n (where n can 0
to 255) is pinged and ping succeeds, netstat -rn
displays entries for each pinged address other
than 127.0.0.1
Defect Description:
Temporary loopback routes were sent from kernel
as part of netstat -rn output.
Resolution:
PHNE_25381:
( SR number: 8606215148 ; Defect: JAGad84339 )
Symptom:
System panics on sbflush panic 2:
trace event 0
stack trace for event 0
crash event was a panic
panic+0x14
sbflush+0x68
sbrelease+0x14
sorflush+0xa4
sofree+0x15c
soclose+0x23c
soo_close+0xc8
closef+0x64
close+0x90
syscall+0x6f8
$syscallrtn+0x0
Defect Description:
AF_UNIX receive socket buffer count does not match to the
real buffer size.
Resolution:
Save socket receive buffer counter before
unlock the socket and restore them back after
the socket relock.
PHNE_25135:
( SR number: 8606193755 ; Defect: JAGab72514 )
Symptom:
When using shutdown() and stack-caching the mss value
could be set to one (1) byte.
Defect Description:
New socket gets previously set variables from an
"old" socket.
Resolution:
Socket code now resets the initial socket values
correctly.
( SR number: 8606137536 ; Defect: JAGad06654 )
Symptom:
Tcpdump trace showed that sendfile sends trailer buffers
as a swparate "send".
Defect Description:
Socket sendfile() alway separates trailer buffer from
header and file "send".
Resolution:
If the total size of file data buffer and
trailer buffer is smaller than
MSS, send them together as one
send.
( SR number: 8606203612 ; Defect: JAGad72784 )
Symptom:
Examination of code found a problem.
Defect Description:
Incorrect parameter being used when calling soo_select().
Resolution:
Corrected the thrid parameter going to the
select call. Changed it from an int to
a pointer.
( SR number: 8606215148 ; Defect: JAGad84339 )
Symptom:
System panics on sbflush panic 2:
trace event 0
stack trace for event 0
crash event was a panic
panic+0x14
sbflush+0x68
sbrelease+0x14
sorflush+0xa4
sofree+0x15c
soclose+0x23c
soo_close+0xc8
closef+0x64
close+0x90
syscall+0x6f8
$syscallrtn+0x0
Defect Description:
AF_UNIX receive socket buffer count does not match to the
real buffer size.
Resolution:
Save socket receive buffer counter before
unlock the socket and restore them back after
the relock the socket.
PHNE_24715:
( SR number: 8606193754 ; Defect: JAGad62965 )
Symptom:
Customer noted that performance of ftp over
hyper-fabric was very slow when putting a file
after installing PHNE_22397.
Defect Description:
tcp has a variable, tcp_rack_abs_max, to set the
high-water-mark of the recevied ACK. If the amount
of the received ACK (tcp_rack_cnt) is greater than
this high-water-mark, an immediately ACK will be
generated. Otherwise, the ACK will be deferred.
With PHNE_22397, tcp_rack_abs_max was set to
4*tcp_mss, which is very high with the large
MTU interface like hyper-fabric. (4*32K)
Then it is more likely for receiver to defer
ACK since tcp_rack_cnt is less likely to exceed
the high-water-mark.
Resolution:
tcp_rack_abs_max should not be greater than half of receive
window. (rwnd/2) tcp_rack_abs_max should be kept as
MIN(tcp_deferred_ack_max *tcp_mss, rwnd/2) With the fix,
small transfer (sub-MSS) with large MTU link (32K like
hyper-fabric) can get immediate ACK without delay.
( SR number: 8606206542 ; Defect: JAGad75715 )
Symptom:
Some packets are dropped intermittently and not
retransmitted for a long time.
Defect Description:
Retransmit timer is restarted based on deferred
ack timer in certain conditions. These conditions
were not properly handled which lead to long
delays in the retransmission of lost packets.
Resolution:
On certain conditions the retransmit timer is not
restarted based on deferred ack timer when
there is outbound data to be retransmitted.
( SR number: 8606206806 ; Defect: JAGad75979 )
Symptom:
Since PHNE_21767, all outbound datagrams have
the "Don't Fragment" bit set for Path MTU Discovery.
Defect Description:
The default value of ip_pmtu_strategy has been
changed to 1. This always sets the DF bit.
Resolution:
Option 2 of ip_pmtu_strategy is obsolete.
An EINVAL is returned when attempting to set
ip_pmtu_strategy to 2 with ndd.
( SR number: 8606139436 ; Defect: JAGad08735 )
Symptom:
system panic on X.25 socket.
The panic stack is as follows:
A possible deadlock situation
stack trace for event 0
crash event was a panic
panic+0x10
spin_deadlock_failure+0x38
deadlock_check+0x9c
sl_pre_check+0x54
spinlock+0x14
mp_socket_lock+0x34
mp_socket_lock2+0x38
XLS_F_handler+0x6c4
XSO_F_handler+0x958
XLS_F0_a_connect_ind+0x188
XLS_F_handler+0x6a4
XST_F_read_put+0x398
putnext+0x1f4
CI_touser+0x268
Rx_CALL+0x384
L2_datind+0x4ac
dlpi_rxll+0xb4
x25lrsrv+0x60
sq_wrapper+0xc8
str_sched_mp_daemon+0x33c
str_sched_daemon+0x29c
im_mpnetstr+0x28
DoCalllist+0x38
main+0x24
$vstart+0x34
$locore+0x90
Defect Description:
X.25 socket inserts a cloned socket on to
the listen socket's queue for inbound connection
causes deadlock situation
Resolution:
Remove deadlock assertion for X.25 socket, when
X.25 process insters it cloned socket on to the
listion socket's queue.
( SR number: 8606140093 ; Defect: JAGad09415 )
Symptom:
TCP connections where both ends close at
the same time may experience an unnecessary
delay of 1.5 seconds or more. This problem
has an especially high probability of being
seen on loopback connections where one
end of the connection has the SO_LINGER
option turned on.
Defect Description:
During connection shutdown, if a FIN packet
is received while TCP is performing its
"close" operation, the FIN packet can be
discarded, causing the remote end to time out
(awaiting acknowledgement of the FIN) and
retransmit the FIN packet. This timeout
accounts for the 1.5 second (or longer) delay.
Resolution:
Processing of TCP packets arriving for
closing connections has been modified
so that they are no longer discarded.
( SR number: 8606167654 ; Defect: JAGad36937 )
Symptom:
Sometimes nettl is unable to capture reply packets.
Defect Description:
Nettl is unable to trace outbound IP packets. This happens
when drivers do not support FAST PATH.
Resolution:
The tracing subsystem always assumed drivers to be
FASTPATH and used to skip tracing messages for
NON-FASTPATH drivers. Now the tracing subsytem
recognizes messages for both FASTPATH and
NON-FASTPATH drives which eventually leads nettl
to trace outbound packets.
( SR number: 8606198667 ; Defect: JAGad67856 )
Symptom:
Closing a socket with socket caching turned on and
SO_LINGER set will cause a loop in the kernel. The
connection will be left in an IDLE state.
Defect Description:
While closing a socket for which a linger option has
been set we need to check for TS_UNBND tpi
state( corresponding TCP state is T_IDLE), failing
which may lead to the tcp module getting polled for
infinite time.
Resolution:
Now we check for TS_UNBND state also while processing
linger option in soclose().
( SR number: 8606202518 ; Defect: JAGad71692 )
Synptom:
System panic on X.25 socket.
Panic stack is :
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
XIQ_F_handler+0xc0
XSO_F0_cleanup_pcb+0xa4
XSO_F_handler+0x12dc
XPR_F_pr_usrreq+0x298
soclose+0x250
soo_close+0x90
closef+0x64
close+0x90
syscall+0x200
$syscallrtn+0x0
Defect Description:
X.25 socket close goes thought an AF_UNIX
close path.
Resolution:
Use AF_UNIX condition for AF_UNIX close path.
( SR number: 8606202738 ; Defect: JAGad71912 )
Symptom:
PHNE_23456 shows duplicate uipc_socket.c what strings.
Defect Description:
Both uipc_socket.c and sys_socket.c have same
what strings.
Resolution:
Change sys_socket.c what string from
uipc_socket.c to sys_socket.c
( SR number: 8606203039 ; Defect: JAGad72213 )
Symptom:
A UDP broadcast is sent once for each IP
address configured on the interface.
Defect Description:
This feature is currently used to get
broadcasts sent to multiple interfaces,
when the broadcast address being used
applies to multiple interfaces. A whole
net broadcast is replicated on every
connected subnet of the target net.
Resolution:
Add ip_duplicate_broadcasts tunable for
eliminating duplicate physical broadcasts.
The default setting of zero suppresses the
duplicates.
( SR number: 8606203900 ; Defect: JAGad73078 )
Symptom:
TCP connection hangs in an ESTABLISHED state.
Defect Decription:
Out of Order FIN with no data is not remembered.
Resolution:
Out-of-order inbound FIN handling was improved
to work in the case where the FIN arrives
without any data.
( SR number: 8606204354 ; Defect: JAGad73536 )
Symptom:
UDP datagrams are silently dropped.
Defect Description:
A UDP packet size greater than the allowable
IP limit is dropped with no errno.
Resolution:
Added logic in sosend() function to return
EMSGSIZE errno when data size exceeding IP
limit.
( SR number: 8606204948 ; Defect: JAGad74124 )
Symptom:
System hang while ftping and concurrent file truncation.
Defect Description:
System hang because buffer caches were used up by
sosendfile. Sosendfile used up almost all buffer caches
because it's looping in a while loop inside which the
buffer caches were allocated for sosendfile.
Sosendfile could not exit the while loop because the
condition to exit the loop became forever-false due to
file truncation.
The assumption that sosendfile holds that file size does
not change during the while (transmission) loop is not
valid, it should be adjusted. Sosendfile needs to take
care of the case that file sent could be changed
(truncated) during transmission.
Resolution:
Sosendfile will check if file size is changed during
the while (transmission) loop. If it is, exit the
loop appropriately.
( SR number: 8606205538 ; Defect: JAGad74714 )
Symptom:
System panics while executing accept call. The
panic stack is as follows:
panic+0x6c
report_trap_or_int_and_panic+0x94
interrupt+0x208
ihandler+0x930
x_mi_timer+0xc
tcp_accept+0x510
tcp_wput_proto+0x18c
tcp_wput+0xa0
csq_turnover_with_lock+0x8c
puthere+0x260
tcp_icmp_error+0x270
tcp_rput_other+0x600
tcp_rput+0x60
putnext+0xcc
icmp_inbound_error+0xa74
icmp_inbound+0x38c
ip_rput_local+0xd58
ip_rput+0x188
putnext+0xcc
hp_dlpi_mblk_fast_in+0xa0
hp_dlpi_mblk_intr_put+0xb8
streams_put+0xdc
streams_put_release+0x4c
hp_dlpi_mblk_intr+0x5c
lanc_ether_ics+0x11c
btlan_receive_frame+0x5e4
btlan_isr+0xfc
sapic_interrupt+0x2c
mp_ext_interrupt+0x2ec
ihandler+0x90c
Defect Description:
An ICMP error message is received for a stream
that is in the middle of the accept state. The
function that processes the message cleans up
the data structure related to the accept stream.
When accept stream tries to access this data
structure it panics.
Resolution:
If TCP receives an ICMP error message for a
stream that is in the middle of accept state,
it ignores that message.
( SR number: 8606206366 ; Defect: JAGad75539 )
Symptom:
System panics with the following
stack trace:
panic
report_trap_or_int_and_panic
trap
nokgdb
ipif_up
ip_sioctl_copyin_done
ip_wput_nondata
ip_wput
csq_turnover_with_lock
putnext
udp_wput_other
udp_wput
putnext
wait_iocack
str_trans_ioctl
hpstreams_ioctl_int
streams_ioctl
ifioctl
soo_ioctl
ioctl
syscall
Defect Description:
While bringing up a virtual interface
we could not identify that this is a
virtual interface. So we are accidentally
trying to bind and attach which results
in panic because this is a virtual address
and there is no physical interface that
exists to which we can bind and attach.
Resolution:
The fix is added to correctly identify
the virtual address and avoid trying to
bind and attach to a physical interface
and thus avoid a panic while bringing
up a virtual interface.
( SR number: 8606207797 ; Defect: JAGad76974 )
Symptom:
Performance degradation in IPSEC.
Defect Description:
Improve IPSec perf for cleartext traffic.
Resolution:
When TRUST is set we will not make a
policy check on any incoming clear
text packet but will still
decrypt/authenticate any incoming IPsec
packet that arrives via that interface.
For outbound or forwarded traffic the
IPsec policy code will not be consulted
if TRUST is set on the outbound/forwarded
-to interface.
( SR number: 8606209138 ; Defect: JAGad78325 )
Symptom:
With ATM on system and IP traffic, system panics
with forllowing panic stack:
panic+0x6c
report_trap_or_int_and_panic+0x94
interrupt+0x208
ihandler+0x930
bcopy_pcxu_method+0x0
LDI_F_set_fastpath+0x100
LEC_F0_uwioctl+0x1d8
LEC_F0_uwput+0xac
csq_turnover_with_lock+0x84
putnext+0x258
CAM_F0_sp_dataind+0x70
streams_put+0xe4
CAM_F_data_ind+0x404
alx_receive_it+0x13fc
alx_isr+0x25c
wsio_interrupt+0x54
mp_ext_interrupt+0x34c
ivti_patch_to_nop3+0x0
sounlock+0x90
mp_socket_unlock+0x10
soo_select2+0x1c4
soo_select+0x14
select+0xac4
syscall+0x480
Defect Description:
A badly formatted request message is sent to ATM by
IP while doing a fastpath probe. This happens on a
multiprocessor system. One processor is formatting
the message while the other sends this incomplete
message to the driver as a fastpath probe. This lead
ATM driver to panic.
Resolution:
A fastpath probe message is only sent to the driver
if it is properly formatted.
( SR number: 8606209264 ; Defect: JAGad78451 )
Symptom:
When 2 (or more) aio_read are pending on the same
socket and ioctl(SIOCAIOABORT) is used, a close
on that socket will cause to process to hang and
the process is not killable.
Defect Description:
When 2 aio_read are pending on the same socket,
ioctl(SIOCAIOABORT) only wake up one. So a close
on that socket will hang.
Resolution:
Correct the ioctl(SIOCAIOABORT) in the socket so that
other aio_read won't sleep forever.
PHNE_24289:
( SR number: 8606131836 ; Defect: JAGad00986 )
Symptom:
RAW socket behaviour for HP-UX 11.0 is inconsistent
with HP-UX 10.20 and HP-UX 11.11. Non-root user is
allowed to open a RAW socket.
Defect Description:
The Networking kernel code did not make the appropriate
check when opening a RAW socket.
Resolution:
RAW socket behaviour for HP-UX 11.0 was modified to be
consistent with HP-UX 10.20 and HP-UX 11.11.
( SR number: 8606162623 ; Defect: JAGad31939 )
Symptom:
Service Guard system TOC with the following trace:
x_mi_mpprintf_putc+0x1c
x_mi_iprintf+0x280
x_mi_mpprintf+0x64
tcp_status_report+0x188
x_nd_getset+0x148
tcp_wput_ioctl+0x9c
tcp_wput+0x82c
putnext+0xcc
wait_iocack+0x68 s
tr_istr_ioctl+0x738
hpstreams_ioctl_int+0x6a8
hpstreams_ioctl+0x50
spec_ioctl+0xac
vno_ioctl+0x90
ioctl+0x7c
syscall+0x480
$syscallrtn+0x0
Defect Description:
TCP takes a long time to complete the request
from identd. That causes SG to lose heartbeat,
thus TOC.
Resolution:
Correct TCP to use a faster method to complete
the request from identd.
( SR number: 8606187409 ; Defect: JAGad56616 )
Symptom:
An AF_UNIX socket application hangs on MP system.
Defect Discription:
On MP system, if an application uses AF_UNIX socket,
select() could hang the application, because of the
socket buffer flag is not correct for multi-thread
collision case.
Resolution:
Check kernel thread for multi-thread collision
situation and sign the socket buffer flag to be
SB_COLL.
( SR number: 1653284372 ; Defect: JAGaa44209 )
Symptom:
STCP recv() with MSG_PEEK is different from BSD.
Defect Description:
STCP did not walk through all messages for MSG_PEEK.
Resolution:
Walk through entire queue list to get user requests
length of data.
( SR number: 5003411751 ; Defect: JAGaa27047 )
Symptom:
A connection in FIN_WAIT_2 can stay forever.
Defect Description:
No timer exists to limit the amount of time
a connection can remain in FIN_WAIT_2. If
the other side of the connection fails to
send a FIN, the connection will remain forever.
Resolution:
A new ndd variable, tcp_fin_wait_2_timeout,
controls this feature. It specifies an interval,
in milliseconds, after which the TCP will be
unconditionally killed. An appropriate reset
segment will be sent when the connection is killed.
The default for tcp_fin_wait_2_timeout is 0, which
allows the connection to live forever, as long as the
far side continues to answer keepalives.
Setting with "ndd -set" and determining the current
value with "ndd -get" works just fine. But the tunable
is not visible with "ndd -h supported" command.
( SR number: 8606198555 ; Defect: JAGad67744 )
Symptom:
Problems compiling recent versions
of transport source code within ClearCase.
These compilation failures are not visible
to customers
Defect Description:
After "event port" enabling support
was added to the kernel source,
there are conflicting function declarations
between socket and non-socket source
which prevents successful compilation
of socket source code.
Resolution:
Corrections have been made to function declarations
so that socket code no longer conflicts with
event port definitions.
( SR number: 8606198614 ; Defect: JAGad67803 )
Symptom:
System hangs and free memory is zero.
System TOC with the following trace:
putnext+0x188
ip_wput_ire+0x398
ip_wput+0x470
putnext+0xcc
tcp_rput+0x1088
csq_turnover_with_lock+0x84
str_spu_sw_isr+0x200
sw_service+0xb0
mp_ext_interrupt+0x150
ivti_patch_to_nop3+0x0
ki_accum_push_TOS+0xa0
syscall+0x808
$syscallrtn+0x0
Defect Description:
TCP floods ACKs to the driver.
Resolution:
Fix TCP urgent data processing.
PHNE_24075:
( SR number: 8606197851 ; Defect: JAGad67042 )
Symptom:
T_ALLOPT option in XTI/TLI will fail with TBADOPT.
Also the tcp initial congestion window is too large
possibly causing performance problems at connect time.
Defect:
TCP_CWND_INITIAL was defined in tcp.h as 0x16.
It should have been TCP_CWND_INIT.
Resolution:
Changed the name of TCP_CWND_INITIAL to
TCP_CWND_INIT in tcp.h.
( SR number: 8606154818 ; Defect: JAGad24135 )
Symptom:
The system with IPSEC installed can panic with
the following trace:
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
ip_flush_readers+0x1a8
ip_close+0x238
close_wrapper+0x38
csq_protect+0x120
osr_pop_subr+0x1fc
osr_close_subr+0x324
hpstreams_close_int+0xd40
streams_close+0x14
soclose+0x670
soaccept+0x2d8
sodequeue+0x224
accept+0x23c
syscall+0x480
$syscallrtn+0x0
Defect Description:
The IPSEC module can corrupt entries in the
list that ip_flush_readers() parses.
Resolution:
Close out any pending policies before flushing
the list.
( SR number: 8606160792 ; Defect: JAGad30111 )
Symptom:
A server program listening for incoming connection
requests with select() or accept() can receive
notification of a connection's existence before
it is fully established.
Defect Description:
As an optimization, incoming connection requests
are checked to see if they originate from an
address kept in a cache of machines with
previously established connections. If the
remote system's address is found in the cache
then the TCP code does not wait for the full
connection handshake protocol to complete
before notifying the application. In some
cases an application can be falsely notified
of the existence of connections which never
complete.
Resolution:
A new tunable variable "tcp_early_conn_ind" has
been added, whose state can be modified with
the "ndd" command. The default value of
this parameter is 1, which leaves connection
establishment behavior alone; that is, it
remains the same as without this change.
With the variable set to 0, applications
will not be given early notification of
incoming connection requests, prior
the full connection establishment.
( SR number: 8606164046 ; Defect: JAGad33347 )
Symptom:
Some customers using the Raptor Firewall product found
the daemon processes (tcp_gspd) spinning and eating
CPU time (70-80% of a cpu on UP systems).
Defect Description:
The symptom is because the daemon process was looping
in a select/recv loop on a send-side-shutdown socket
where select returned one socket FD as readable, but
recv always returned EWOULDBLOCK.
What happened was, prior to the daemon process's shutdown
call, the remote client had already reset the connection
which generated a T_DISCON_IND that went up to the
stream head and set TCP state to TCPS_IDLE.
If the daemon process then called shutdown, the M_ERROR
message block sent up by tcp_wput_proto (it does this
because it finds the TCP is in the TCPS_IDLE state)
caused the T_DISCON_IND to get flushed by stream. Then
recv looped because there was nothing to read on the
queue. The whole thing is due to the race at stream head
between processing of T_DISCON_IND coming toward stream
head from TCP and generation of T_ORDREL_REQ going down-
stream towards TCP from socket's shutdown code.
Resolution:
In socket's shutdown code, check if the connection still
exists before sending T_ORDREL_REQ downstream towards TCP,
if the connection is lost, set errno to EINVAL and exit.
( SR number: 8606166814 ; Defect: JAGad36101 )
Symptom:
Remsh hangs.
Defect Description:
Remsh hangs due to incorrect behavior in shutdown during
write flow control situation.
Resolution:
Transport calls a version of streams_putmsg() which
unconditionally does the putnext().
( SR number: 8606176180 ; Defect: JAGad45420 )
Symptom:
UDP socket bound to local IP address cannot receive
broadcast packet.
Defect Description:
A UDP socket bound to local IP address does not
receive broadcast packet while this was possible on
HPUX 10.20.
Resolution:
A new ndd tunable "ip_enable_udp_bcastrecv" is provided
to fix the problem. This tunable when set to 1 will
enable UDP sockets bound to local IP address to receive
broadcast packets while when set to 0 disables UDP
sockets bound to local IP address to receive broadcast
packets. The tunable is associated with /dev/ip network
device.
( SR number: 8606178029 ; Defect: JAGad47256 )
Symptom:
gettcpstate() is not available in 11.0.
Defect Description:
Need to support gettcpstate() in 11.0.
Resolution:
The function gettcpstate () is back ported to 11.0 from
11.i.
( SR number: 8606178097 ; Defect: JAGad47324 )
Symptom:
The system has a Data Page Fault panic with
either of the following two traces:
Trace 1:
panic+0x14
report_trap_or_int_and_panic+0x4c
interrupt+0x1e8
$ihndlr_rtn+0x0
puthere+0x44
mi_timeout_exec+0x224
sw_service+0x8c
mp_ext_interrupt+0x108
ivti_patch_to_nop3+0x0
idle+0x1e8
swidle_exit+0x0
Trace 2:
panic+0x14
report_trap_or_int_and_panic+0x4c
interrupt+0x1e8
$ihndlr_rtn+0x0
puthere+0x44
tcp_rput_context_check+0x4a4
tcp_rput+0x784
putnext+0x16c
ip_rput_local+0x524
ip_rput+0x648
putnext+0x16c
hp_dlpi_mbuf_fast_in+0x70
hp_dlpi_intr_put+0x154
streams_put+0x134
hp_dlpi_intr+0x84
lan2_process_packet+0xcc
lan2_int_fr_rnr+0x19c
lan2_isr+0x184
eisa_int+0x134
lasi_interrupt+0x5c
mp_ext_interrupt+0x300
ivti_patch_to_nop3+0x0
idle+0x1b8
swidle_exit+0x0
Defect Description:
The LISTEN socket is closed while the SYN_RCVD
socket is still open.
Resolution:
An unbind request will trigger the cleaning up of
all oustanding connections.
( SR number: 8606183744 ; Defect: JAGad52955 )
Symptom:
Individual host route on local interface does
not work if the subnet route for the subnet
containing that host is removed.
Defect Description:
Deleting the "network route" for a locally-attached
subnet stops any packets from being transmitted
on that interface.
Resolution:
The routing table update algorithm was modified
so that when a "network route" for a local
interface is deleted, the corresponding
"resolver" entry is preserved, so that the
host routes referring to that interface
will still work.
( SR number: 8606187509 ; Defect: JAGad56716 )
Symptom:
When a program uses the ICMP TIMESTAMP request
message to query an HP-UX system for the
current time, the reply generated provides
less precise information than was available
from a 10.20 system.
Defect Description:
The code which constructs the reply to the ICMP
timestamp request calculates its time value
based on the kernel's timer interrupt counter
variable ("lbolt") which updates once every
10ms and is not precise enough to give a
time value with a higher resolution.
Resolution:
The code which constructs the ICMP timestamp
reply packet was modified to obtain its time
information from the same high-resolution
timer used to provide the microsecond-granularity
tv_usec value in the "struct timeval"
returned from the "gettimeofday" system call.
( SR number: 8606194889 ; Defect: JAGad64095 )
Symptom:
Partially-completed incoming connection
requests can occupy excessive system memory.
Defect Description:
The tcp_syn_rcvd_max" tunable parameter does
not work correctly to limit storage
of state for partially-initiated incoming
TCP connections.
Resolution:
The code which limits the storage
space occupied by partially-completed
connections was corrected by re-ordering
some boundary condition tests which
caused the observed symptoms.
PHNE_23456:
( SR number: 8606147348 ; Defect: JAGad16691 )
Symptom:
Data is received with garbage bytes appended to it. The
length of the received data will have a size which is a
multiple of STRMSGSZ (where STRMSGSZ is the value of the
kernel parameter STRMSGSZ on the system sending the data).
For this to occur, the kernel parameter STRMSGSZ must have
been changed to a value smaller than the default on the
system which sends the data.
Defect Description:
Sockets fails to update a variable used to compute the size
of an outgoing message. If STRMSGSZ has been set to a value
smaller than the default, and the size of the data being
sent is larger than STRMSGSZ, sockets will compute a length
which is too long. This results in the sending of bytes
that happen to follow the real data in the outgoing buffer.
Resolution:
The value of the variable resid is kept up to
date allowing sockets to compute the correct
send length.
( SR number: 8606151945 ; Defect: JAGad21284 )
Symptom:
The system experiences extensive memory consumption
when processing large numbers of routes.
Defect Description:
An internet routing entry (IRE) is allocated for
each route, whether or not the route is valid.
Resolution:
Introduce two new ndd tunables, ip_ire_route_limit
and ip_ire_route_limit_interval. The implementation
will start flushing idle IRE_ROUTEs when the count
has reached half of the limit. The count is checked
based on the interval, measured in milliseconds.
( SR number: 8606155790 ; Defect: JAGad25103 )
Symptom:
X-terminals are not able to boot from a server
operating in a Service Guard environment.
Defect Description:
Client machines such as X-terminals are not able to
get a boot file from the server in a Service Guard
environment because the server is unable receive the
remote IP address.
Resolution:
The socket options IP_RECVDSTADDR and IP_RECVIFADDR have
been modified to be XOPEN conformant. Both the local and
remote IP addresses are returned by RECVMSG when these
options have been specified. This fix requires a TFTP fix
(see JAGad25107/PHNE_23457) to completely solve the BOOTP
problem.
( SR number: 8606169570 ; Defect: JAGad38845 )
Symptom:
panic: Data memory protection fault
gelan_if_resolved_output+0x106c
hp_dlpi_mblk_CKO_fast_out+0x60
hp_dlpi_wput+0x64
putnext+0xcc
ip_wput_ire+0x454
ip_wput+0x470
csq_turnover_with_lock+0x84
putnext+0x258
hp_dlpi_mblk_fast_in+0x98
hp_dlpi_mblk_intr_put+0xc8
streams_put_release+0x1cc
hp_dlpi_mblk_intr+0x4c
lanc_ether_ics+0x240
Defect Description:
When processing a "port unreachable" error IP sends an ICMP
message which has the checksum offload flag turned on. The
flag was set originally to defer the checksum computation
of the inbound message until later. IP appends the inbound
message to the ICMP message and fails to reset the checksum
offload flag if the inbound message arrived on an interface
that doesn't support checksum offload.
Resolution:
The IP module has been corrected to clear the checksum
offload flag in the ICMP message before it is shipped
to an interface which supports checksum offload.
( SR number: 8606170531 ; Defect: JAGad39795 )
Symptom:
Large numbers of connections on WWW servers fail to
close completely. They are left stranded forever in the
the CLOSE_WAIT state.
Defect Description:
A client has terminated while its receive window is closed
and the server is attempting to send data. The server
continues to send zero window probes forever waiting for
the client to open its receive window so that the remaining
data can be sent.
Resolution:
TCP has been corrected to treat unacked zero window probes
like timed out retransmissions. This forces the connection
to timeout and terminate.
( SR number: 8606175299 ; Defect: JAGad44542 )
Symptom:
The system panics with a Data Page Fault.
A possible stack looks like this:
panic+0x14
report_trap_or_int_and_panic+0x84
trap+0xd9c
nokgdb+0x8
ipc_hash_insert+0x84
ip_bind+0xc28
ip_wput_nondata+0x38
.
.
.
Defect Description:
The ip fanout table was corrupted when accessed
in an unlocked state.
Resolution:
Always ensure that locks are acquired before accessing
the ip fanout table.
( SR number: 8606175531 ; Defect: JAGad44771 )
Symptom:
An IGMP_HOST_MEMBERSHIP_QUERY can cause a
divide by zero panic.
igmp_input+0x7e4
ip_rput_local+0xc00
ip_rput+0x238
putnext+0xcc
hp_dlpi_unitdata_in+0x1108
hp_dlpi_mblk_intr_put+0x7bc
streams_put_release+0x1cc
hp_dlpi_mblk_intr+0x4c
lanc_ether_ics+0x240
_btlan3_receive_pkts+0x3a0
_btlan3_isr+0x178
sapic_interrupt+0x2c
mp_ext_interrupt+0x34c
ivti_patch_to_nop3+0x0
idle+0x814
swidle_exit+0x0
Defect Description:
IGMP does inadequate validation of
IGMP_HOST_MEMBERSHIP_QUERY messages.
Resolution:
IGMP has been modified to prevent division
by zero.
( SR number: 8606177050 ; Defect: JAGad46285 )
Symptom:
If inbound UDP packets are dropped because of socket
receive buffer overflow, it is difficult to discern
which UDP connection is getting overflowed and how
many times it has happened.
Defect Description:
The only way to find out how many udp socket overflows
a system has is "netstat -p udp." However, this reports
the number of overflows for all connections, not on a
per connection basis.
Resolution:
Overflow counters are added in the input path.
They can be viewed through the ndd tunable
"ip_udp_status."
( SR number: 8606178227 ; Defect: JAGad47454 )
Symptom:
Keepalive probes exceed the desired length of time
set by the ndd tunable tcp_keepalive_interval.
Defect Description:
Time calculation incurs a small error on an active
connection. On connections that have been active
for a long time, this error can become quite
significant. When the connection becomes idle,
the error enters into the calculation for scheduling
a keepalive probe.
Resolution:
Eliminate the cumulative skew from the TCP
keepalive timer by subtracting the error margin.
( SR number: 8606181319 ; Defect: JAGad50536 )
Symptom:
An ENOTCONN is intermittently returned when
a read is done on a non-blocking socket.
Defect Description:
There exists a window where select() can
return without properly setting the correct
socket flag.
Resolution:
Set the socket into the connected state at
the appropriate time.
( SR number: 8606184465 ; Defect: JAGad53672 )
Symptom:
Event_port not supported by sockets.
Defect Description:
event_port is not supported by networking sockets.
Resolution:
Stub functions have been added to allow
for future enablement of event_port.
( SR number: 8606184470 ; Defect: JAGad53677 )
Symptom:
System panics whenever a "poll" is done via "event_port"
on an AF_UNIX socket that was created by socketpair().
Here is the panic;
soo_select2+0x8
soo_select+0x14
unp_poll_handler+0x40
so_poll_switch+0x74
evp_dp_poll+0x20c
evp_ioctl+0x104
spec_ioctl+0xac
vno_ioctl+0x90
ioctl+0x1f4
syscall+0x480
$syscallrtn+0x0
Defect Description:
In the socketpair() call the value of so->so_fp is not
set to the value of the file pointer.
Resolution:
Added the code needed to initialize
so->so_fp to the correct file
pointer when in the function
socketpair()
( SR number: 8606185191 ; Defect: JAGad54393 )
Symptom:
System panic's with the following stack;
unp_eventreg+0x4
so_eventreg+0x6c
evp_dereg_objhdr+0xa0
evp_close+0x15c
call_open_close+0x1f8
closed+0xb0
spec_close+0x54
vn_close+0x48
vno_close+0x20
closef+0x64
exit+0x324
rexit+0x28
syscall+0x200
$syscallrtn+0x0
Defect Description:
When the close routine was called on the AF_UNIX socket it
would clear the function pointer to the callback
function before the pointer is used.
Resolution:
Clearing of the function pointer is delayed until
after the callback has been made.
PHNE_22869:
( SR number: 4701419036 ; Defect: JAGaa93907 )
Symptom:
If one urgent byte is on a socket, and a
recv() is done without MSG_OOB on that
socket, the urgent byte will disappear.
Subsequent recvmsg() calls with the
MSG_OOB flag on will return EINVAL,
instead of returning the urgent byte.
Defect Description:
Socket state relating to urgent data
is not maintained correctly allowing
urgent data to be lost.
Resolution:
Sockets code has been modified to ensure that the
OOB state is maintained correctly.
( SR number: 8606160311 ; Defect: JAGad29635 )
Symptom:
Bringing up an interface with ifconfig
may fail occasionally. This is also
visible in errors from the ServiceGuard
daemon "cmcld" if a network cable is
rapidly and repeatedly unplugged and
plugged back in.
Defect description:
An internal race condition in IP can cause
control messages between IP and the lan driver
to be delivered out-of-order, causing an
error to be reported. The specific messages
are not data packets but rather DLPI messages
DL_ATTACH_REQ and DL_BIND_REQ.
Resolution:
IP code processing the queue of deferred work
has been modified to eliminate the window
where multiple threads could process elements
from the queue and get them out of order.
( SR number: 8606162823 ; Defect: JAGad32139 )
Symptom::
The sytem panics with a stack overflow.
panic+0x14
report_trap_or_int_and_panic+0x94
trap+0x9f4
nokgdb+0x8
lanc_media_control+0x10e0
hp_dlpi_ioctl+0x658
hp_dlpi_control+0x184
hp_dlpi_wput+0xb24
putnext+0xcc
ip_wput_ctl+0x13c
ip_wput_nondata+0x41c
ip_wput+0xa0
puthere+0x148
ar_entry_squery+0x140
ar_cmd_dispatch+0xb0
ar_rput+0x58
puthere+0x148
ip_newroute_ipif+0x348
ip_wput_multicast+0x218
igmp_sendpkt_defrd+0x44
ip_newroute_ipif+0x378
ip_wput_multicast+0x218
igmp_sendpkt_defrd+0x44
ip_newroute_ipif+0x378
ip_wput_multicast+0x218
igmp_sendpkt_defrd+0x44
.
.
.
ip_newroute_ipif+0x378
ip_wput_multicast+0x218
igmp_sendpkt_defrd+0x44
ip_close+0x5a0
close_wrapper+0x38
csq_protect+0x120
osr_pop_subr+0x22c
osr_close_subr+0x2f8
hpstreams_close_int+0x2f8
streams_close+0x14
soclose+0x214
soo_close+0x90
closef+0x178
exit+0x944
rexit+0x24
syscall+0x610
$syscallrtn+0x0
Defect Description:
The system needs to wait for a routing table
entry (IRE) to be created if it does not exist
when attempting to send a packet to that route.
This packet is deferred until later. In this
case, when the packet is processed, the IRE
has not yet been created, so it is deferred
again and again.
Resolution:
The fix is to avoid recursive processing of
deferred packets.
( SR number: 8606165984 ; Defect: JAGad35271 )
Symptom:
Panic during FIN processing on a system
experiencing memory pressure.
0x000e4450 (set_protid_registers+0x1bfc)
0x004e6ff4 (tcp_hash_insert_port+0x2c)
0x004ee800 (tcp_reinit+0x4d0)
0x004e31c8 (tcp_clean_death+0x280)
0x004f00e0 (tcp_rput+0x1838)
0x0057ea68 (csq_turnover_with_lock+0xb0)
0x0056ede0 (putnext+0x2b0)
0x0059f75c (streams_write_uio+0x204)
0x003832b0 (sosend+0x1230)
0x003783a4 (sendit+0x41c)
0x00377eac (send+0x74)
0x0031b304 (syscall+0x754)
Defect Description:
When processing a FIN, TCP does not always check to
see if an orderly release indication message has been
allocated.
Resolution:
TCP has been modified to ensure that an orderly release
indication message is allocated.
( SR number: 8606170482 ; Defect: JAGad39746 )
Symptom:
Data transfer accross TCP connections which involve
PMTU is extremely slow.
Defect Description:
When TCP has to do fragmentation due to the reception
of ICMP_FRAGMENTATION_NEEDED messages, it fails to
handle retransmissions correctly.
Resolution:
The handling of retransmissions after receiving
ICMP_FRAGMENTATION_NEEDED messages has been
changed to work correctly.
( SR number: 8606167240 ; Defect: JAGad36526 )
Symptom:
System panic's with;
4) putnext+0x18
5) ip_wput_local+0x528
6) ip_wput_ire+0x43c
7) ip_wput+0x458
8) csq_turnover_with_lock+0x88
9) osr_pop_subr+0x98c
10) osr_close_subr+0xb00
11) hpstreams_close_int+0xd40
12) hpstreams_close+0x2c
13) call_open_close+0x1f8
14) closed+0xb0
15) spec_close+0x54
16) vn_close+0x48
17) vno_close+0x20
18) closef+0x68
19) close+0x48
20) syscall+0x200
When using XTI programs over loopback.
Defect Description:
There is a race when an XTI uses t_unbind()
followed immediately by a t_close() on a connection
that is over loopback. This race causes a lookup in
the ipc table to become stale resulting in a panic.
Resolution:
The code was changed to make sure that ip_flush_readers()
is called unconditionally when t_close() is called after
a t_unbind() has been called.
PHNE_22527:
( SR number: 8606152595 ; Defect: JAGad21925 )
Symptom:
The following type of message fills up too much space
in the syslog file.
vmunix: tunioctl(0): Unknown ioctl <hex number>
Defect Description:
PPP doesn't support some of the ioctls sent by transport
to DLPI in an effort to determine how to communicate.
Resolution:
Added appropriate cases in ioctl-handling procedure to
handle spurious messages in the syslog.
( SR number: 8606157385 ; Defect: JAGad26717 )
Symptom:
Data Page Fault Panic when memory allocation has had
to be delayed.
trap+0x10f0
nokgdb+0x8
qenable+0x10
mi_ibc_qenable+0x6c
csq_protect+0x1c0
bufcall_rsrv+0xf4
str_mem_daemon+0x214
im_strmem+0x1c
DoCalllist+0xc0
Defect Description:
When processing an incoming FIN, TCP must notify the
application that the recv side of the connection has been
closed. This is done by allocating and sending an orderly
release indication message. If no memory is available,
TCP delays the sending of this message until memory is
available. If this delay is long enough, the memory
resources associated with the connection may no longer
exist and this results in a data page fault.
Resolution:
The memory for this message is preallocated when the
resources for the connection are acquired, eliminating the
need for delayed memory allocation.
( SR number: 8606158668 ; Defect: JAGad27998 )
Symptom:
A shutdown() called on a LISTEN socket returns
EINVAL.
Defect Description:
Validation checking is incorrect and causes
shutdown() to return an error.
Resolution:
The validation checking for shutdown() has
been modified to accept LISTEN sockets.
( SR number: 8606159910 ; Defect: JAGad29236 )
Symptom:
Connections getting ETIMEDOUT errors after a
connection is established.
Defect Description:
PMTU updates are getting dropped. This is
due to using the wrong counter to track
PMTU ip identifier updates.
Resolution:
The system was keeping two counters for
ip identifiers. This was changed so
that we now only have one.
( SR number: 8606161281 ; Defect: JAGad30597 )
Symptom:
The following message repeatedly appears in the
system logfile.
"T_ERROR_ACK, ERROR_prim==1"
Defect Description:
IP is logging a message indicating that an
application has tried to bind to an address that
does not exist.
Resolution:
The SL_ERROR status of this message has been reduced to
SL_INFO so that this message will only be logged if
the system administrator requests it.
( SR number: 8606164864 ; Defect: JAGad34161 )
Symptom:
A MSG_OOB recv() on a socket which has been set
to non-blocking and for which there is no OOB data
blocks rather than returning an error.
Defect Description:
The logic handling socket state variables associated
with the processing of OOB data is flawed and allows a
blocking read to occur when no OOB data is present.
Resolution:
The management of socket state variables has been
corrected so that a MSG_OOB recv() no longer blocks
when OOB data is not present on the socket.
( SR number: 8606165518 ; Defect: JAGad34812 )
Symptom:
Need to pre-enable the select performance code.
Defect Description:
Needed to add enablement code for select
performance increase to take advantage of
changes in streams code that will be
available in a future patch.
Resolution:
Support for the more performant select has been
made to transport. This support is conditional
on Streams changes. The presence or absence of
the Streams changes is determined when the system
boots.
( SR number: 8606165729 ; Defect: JAGad35020 )
Symptom:
Customer is seeing RESET's during connects if the
requested MSS is smaller than the tcp_mss_min
set on the system.
Defect Description:
The lower limit of tcp_mss_min was set to 108.
Any connection coming in with a requested MSS
value below this would get RESET.
Resolution:
Lowered the value of tcp_mss_min back to one (1).
Removed the RESET code when a requested mss comes
in under tcp_mss_min. Instead just roll to tcp_mss_min.
The default for tcp_mss_min is now 108.
( SR number: 8606159784 ; Defect: JAGad29110 )
Symptom:
getsockname() hangs for a SOCK_RAW socket.
Defect Description:
The rawip module did not respond to T_ADDR_REQ
messages.
Resolution:
The raw socket module was modified to respond
to T_ADDR_REQ messages.
PHNE_22397:
( SR number: 8606158528 ; Defect: JAGad27858 )
Symptom:
Customer's cannot load latest patch (PHNE_22067)
unresolved external streams_select3()
Defect Description:
A patch from the Streams team that the
transport was dependent on has not been
generally released. (PHNE_21676)
Resolution:
Removed the dependency on Streams until
new streams patch is available.
( SR number: 8606140338 ; Defect: JAGad09705 )
Symptom:
Applications that quickly reconnect to the same remote
port (e.g. remsh) can experience 2-second delays in
connection establishment.
Defect Description:
connect() takes 2+ seconds due to SYN retransmits
to a connection waiting to close in time_wait
Before a simple check was done to see if the new
starting sequence number were greater than the last
received sequence number of a connection in time wait.
This failed quite often when randomized sequence
numbers are used because often a valid new sequence
number would still test less than the previous
sequence number.
Resolution:
The fix is to save the starting sequence number of
a connection and test that the new sequence number
is not the same when connecting to a server in time
wait. All other inflight data can be rejected
because the client packet will be out of the exact
range of the servers sequence space, that is, its
ack will not match the server's sequence range.
( SR number: 8606160948 ; Defect: JAGad30266 )
Symptom:
TCP connections exhibit poor performance over
cellular-style wireless links.
Defect Description:
The bit-error rate and latency inherent in most
cellular-style wireless links causes poor
performance.
Resolution:
The TCP Selective Acknowledgment Option is a
mechanism that can lessen the impact of such links.
This functionality, specified in RFC 2018, is
implemented in TCP.
PHNE_22318:
( SR number: 8606158410 ; Defect: JAGad27740 )
Symptom:
System or processor appears to be hung. Symptoms are
not observed in patches PHNE_21767 or earlier.
Defect Description:
Infinite loop in tcp_options_check_est().
Resolution:
Additional logic has been added to tcp_options_check_est()
for the case in which an unknown TCP option is received.
( SR number: 8606147084 ; Defect: JAGad16427 )
Symptom:
A client will continue to use a stale route for
a virtual IP address when that address has been
reassigned to a different server.
Defect Description:
Clients do not update their routing tables when
a virtual IP address switchover occurs.
Resolution:
The ARP module notifies IP of the new mac
address for the virtual IP. IP will then
dutifully remove the stale entry and a new
one will be created.
( SR number: 8606147559 ; Defect: JAGad16901 )
Symptom:
The ACKs from the receiver machine are off by many windows.
Unfortunately, the sender machine doesn't seem to notice,
and it continues to increase the number of segments in
the window with each send -- Until the ACKs *finally* fall
outside the window gap. Then the sender drops back to
begin slow-start all over again.
Defect description:
Unnecessarily dropping into slow-start after slow/late ACKs
cause incorrect threshhold computation.
Resolution:
Modify the calculation of tcp_cwnd_ssthresh.
( SR number: 8606154650 ; Defect: JAGad23967 )
Symptom:
Some clients can cause TCP connections to be
set up which will cause excessive memory
consumption by data buffers.
Defect description:
Clients which negotiate a TCP MSS size of 1 byte
(or any very small value) will cause excessive
memory consumption because of large buffers being
allocated to hold only a single byte of data.
Resolution:
The default value of the tunable variable
tcp_mss_min has been changed from 1 to 108
so that any clients will be refused if they
attempt to establish connections which request
an MSS (maximum segment size) value which is
too small.
( SR number: 8606156407 ; Defect: JAGad25744 )
Symptom:
An application listening on a server TCP socket
can hang if many clients are initiating connections
and then aborting them (resetting them) before
the server can complete the connection accept operation.
Defect Description:
A coding error in the TCP code which handles
aborted connections would cause internal
streams messages to get dropped which
are necessary for the accept processing to
complete. The accept system call would thus
hang indefinitely waiting for messages which
have been deleted.
Resolution:
The erroneous line of code in tcp.c was deleted
which caused internal streams messages to
get flushed when handling aborted connections.
( SR number: 8606157574 ; Defect: JAGad26905 )
Symptom:
Anomalous error returns may happen
while executing the accept system call.
Defect Description:
An uninitialized variable in the kernel accept code
causes a certain area of the associated code to take
nondeterministic decisions paths when processing
incoming connection requests. Usually a reasonable
action is taken but sometimes an application may
see an unexpected premature error return from accept.
Resolution:
The accept system call code was modified
to ensure that the state variable causing
the indeterminate behavior is always initialized
to a known state.
PHNE_22067:
( SR number: 8606134419 ; Defect: JAGad03554 )
Symptom:
System panics with a data page fault. Two
different stack traces are possible.
Trace 1:
crfree+0x3c
closef+0x80
close+0x48
syscall+0x480
Trace 2:
soo_select+0x10
pollscan+0xb0
poll+0x104
syscall+0x480
Defect Description:
When accept creates a new socket and closes
it immediately, it leaves a window where another
thread can access the new socket. The panic depends
on the system call that accesses the socket during
the window of opportunity.
Resolution:
Accept was modified so that the new socket cannot
be accessed until it is no longer subject to being
closed by an error.
( SR number: 8606134761 ; Defect: JAGad03896 )
Symptom:
When the SO_RCVBUF socket option is
set with setsockopt() to a large value
which exceeds the maximum allowed,
no error is returned and
the actual value set (which can be
obtained with a subsequent getsockopt() call)
is 65535 instead of the maximum allowed.
Defect Description:
When computing window scaling from the SO_RCVBUF
value, the TCP code will map any SO_RCVBUF
value which exceeds its maximum to the
window size value 65535 with no window scaling.
Resolution:
TCP now checks the SO_RCVBUF value
against the "ndd" tunable variable
tcp_hiwat_max. If the SO_RCVBUF value
exceeds this variable, the setsockopt()
call will fail with an EINVAL error.
( SR number: 8606137889 ; Defect: JAGad07049 )
Symptom:
HP-UX does not respond to unicast arp replies.
Defect Description:
HP-UX only responds to gratuitous and broadcast arps.
Resolution:
Arp was modified to recognize unicast replies.
( SR number: 8606141085 ; Defect: JAGad10446 )
Symptom:
When an application sets up to do asyncronous I/O
(signals) on a socket and calls connect(2), if it
catches a signal during the connect(2) call,
connect(2) returns EINTR. This is a correct return.
However, if the program calls connect(2) again,
connect(2) returns EINVAL. In this case, this is
an incorrect return.
Defect Description:
When the program calls connect(2) again, connect(2)
should return back either no error, or perhaps an
EISCONN, but not an EINVAL. This problem was
caused by an incorrect socket state set its connect
path.
Resolution:
The checking and setting of the socket state in its connect
path has been corrected.
( SR number: 8606144006 ; Defect: JAGad13339 )
Symptom:
Non-privileged users cannot open a UDP socket
with an ephemeral port.
Defect Description:
Updating of the next ephemeral port to use
was done incorrectly.
Resolution:
Updating of the next ephemeral port to use has
been changed so that it wraps correctly when
the upper bound is reached.
( SR number: 8606145162 ; Defect: JAGad14500 )
Symptom:
Application server hangs in recv.
Defect Description:
When an interface goes down during an
accept, the accept can fail without
notifying the application.
Resolution:
Code was modified to prevent the accept
from failing when an interface goes down.
( SR number: 8606146766 ; Defect: JAGad16109 )
Symptom:
The public domain ipfilter product cannot be installed
on 11.x due to undefined symbols (if_lookup_on_name
and ir_lookup).
Defect Description:
The new ipfilter interfaces are missing in the kernel.
Resolution:
Two new interfaces are added to the kernel
for ipfilter:
int if_lookup_on_name()
int ir_lookup()
PHNE_21890:
( SR number: 8606126852 ; Defect: JAGac59693 )
Symptom:
Select based applications slow down when moving from
10.20 to 11.00.
Defect Description:
Locks were being obtained and held in situations
where it was not needed. Also some loops ran longer
than they needed.
Resolution:
The select path was rewritten to make more
intelligent use of locks and loops.
( SR number: 8606134574 ; Defect: JAGad03709 )
Symptom:
Inbound packet traffic is seen mostly on one processor.
Need enhancement to make inbound packet schedualing better.
better.
Defect Description:
Each network card interrupts only one CPU. The packet then
goes to the top of the stack on this same CPU keeping the
CPU from doing any other work. All of the other CPU's on
the system could be idle.
Resolution:
The lower layers of the network now will send an
inbound packet to the last "known" cpu that a
thread ran on. This will distribute the inbound
packet load on the system thereby increasing
network link performance.
To enable this feature type in the following
echo" enable_tops/W1" | adb -w /stand/vmunix /dev/kmem
To disable
echo" enable_tops/W0" | adb -w /stand/vmunix /dev/kmem
The global will be removed for 11.11 and it will be on
permantly.
PHNE_21767:
( SR number: 1653286641 ; Defect: JAGaa44778 )
Symptom:
recvmsg() returns EMSGSIZE, when the message size is
correct.
defect Description:
HP-UX is not returning the correct error when recvmsg
runs out of file descriptors (when rights are received).
Resolution:
Return EMFILE when the file descriptors are
exceeded for the process.
PHNE_21606:
( SR number: 8606132568 ; Defect: JAGad01717 )
Symptom:
The connection will hang when an out of order FIN
arrives and is never retransmitted.
Defect Description:
HP-UX will drop an out of order FIN. As a result, if
the sender doesn't retransmit FIN, the connection
will hang as both sides are waiting for each other.
Resolution:
A flag will be set when an out of order FIN comes in.
After the sender is done transmitting the data, the
flag will be checked to see whether a FIN-ACK should
be sent.
( SR number: 8606134441 ; Defect: JAGad03576 )
Symptom:
Under special network load conditions
in which a machine is frequently making
ARP requests which do not succeed,
a memory leak occurs which can eventually
use up all system memory and cause a
system to panic. Symptoms are not observed
in patches prior to PHNE_20436, and
certain details depend upon which patch is
in place. In patches starting with PHNE_20436
but prior to PHNE_21038, the memory leak
is in the 32-byte bucket. Starting with
PHNE_21038, the leak is in the 64-byte bucket.
Defect description:
Code paths handling ARP requests which
time out without reply would free routing
table entries (IREs) without freeing
their associated spinlock memory.
Resolution:
Memory allocation for spinlocks
used in conjunction with IP identifier
generation (See CR JAGab25258, JAGab84237)
has been modified to avoid a memory leak.
PHNE_21318:
( SR number: 8606127632 ; Defect: JAGac78434 )
Symptom:
select() can hang when called following
a connect() call that returned EINPROGRESS.
Defect Description:
connect() will return an EINPROGRESS when
nonblocking I/O is enabled using
O_NONBLOCK, O_NDELAY, or FIOSNBIO, and
the connection cannot be completed
immediately. Waiting for completion by
calling select() for write allows a timing
window where the T_CONN_CON can arrive
after checking for it.
Resolution:
If the T_CONN_CON is missed, set up a
callback so select will be notified when
it does arrive.
( SR number: 8606129427 ; Defect: JAGac86974 )
Symptom:
Double system panics occurred duing an X.25 test.
stack trace for event 0
crash event was a panic
panic+0x14
too_much_time+0x2d8
wait_for_lock+0x120
slu_retry+0x18
mp_socket_lock+0x2c
XLS_F0_a_connect_ind+0x4c
XLS_F_handler+0x6a4
XST_F_read_put+0x398
putnext+0x16c
N2Z_F0_rserv+0x2b0
sq_wrapper+0x90
str_sched_mp_daemon+0x104
str_sched_daemon+0x2b8
main+0x538
$vstart+0x34
$locore+0x90
trace event 1
stack trace for event 1
crash event was a panic
panic+0x14
wait_for_lock+0x2b4
slu_retry+0x18
mp_socket_lock+0x2c
soaccept+0x28
sodequeue+0x19c
accept+0x154
syscall+0x1c8
$syscallrtn+0x0
Defect Decription:
A spinlock was not released correctly,
it cause a spinlock deadlock.
Resolution:
Add a release lock for a return error case.
( SR number: 8606130980 ; Defect: JAGad00139 )
Symptom:
"Lock not held" Panic stack:
panic+0x14
sodequeue+0x530
accept+0x1b8
syscall+0x1c8
$syscallrtn+0x0
Defect Description:
Allocating memory with wait can cause a thread
to sleep. When awakened, the thread may be
scheduled on a different processor, causing
a "lock not held" panic when spinunlock is called.
Resolution:
Unlock the spinlock before allocating memory with
wait.
( SR number: 8606131229 ; Defect: JAGad00380 )
Symptom:
The HP-UX system does not respond to keepalive
requests.
Defect Description:
The HP-UX system does not acknowledge a keepalive
packet with a window size that is larger than
expected.
Resolution:
Ignore the change in window size and send out an
ACK in response.
( SR number: 8606125525 ; Defect: JAGac40915 )
Symptom:
A system can hang when applications
take away system resources by successfully
allocating extremely large buffers.
Defect Description:
For TCP send and receive buffers, UDP and
RAWIP receive buffers, the upper limit
is 2G, and no tunables exist to
lower these values.
Resolution:
Adding new ndd tunables,
tcp_hiwater_max for TCP SEND/RECEIVE buffer
udp_recv_hiwater_max for UDP RECEIVE buffer
rawip_recv_hiwater_max for RAWIP RECEIVE buffer
to control the upper limit of these buffers.
PHNE_21038:
( SR number: 5003453233 ; Defect: JAGaa95389 )
Symptom:
System panics when the opening of
/dev/nuls races with the closing of /dev/nuls.
This device is used by netstat.
mi_close_comm1+0x44
x_mi_close_comm+0x14
nuls_close+0x14
close_wrapper+0x38
csq_protect+0xd0
osr_pop_subr+0x1b8
osr_close_subr+0x2b8
hpstreams_close_int+0x2a0
hpstreams_close+0x24
call_open_close+0x1bc
closed+0xa0
Defect Description:
Data structures manipulated by the nuls
device were not sufficiently protected
against race conditions.
Resolution:
The open and close routines associated with
the nuls device now acquire a spinlock before
accessing data structures.
( SR not found ; Defect: JAGab67537 )
Symptom:
System panic when ifconfig is running on a X.25 interface.
Defect Description:
Ifconfig can hang while running on a X.25 interface.
By doing "Ctrl-C" getting out of the hang, and
execute another ifconfig will cause system panic.
Resolution:
When executing "Ctrl-C" to get out of ifconfig
hang, some of the data structures don't get
cleaned up properly. This is fixed by making
sure complete cleanup when ifconfig exits
abnormally.
( SR number: 8606112028 ; Defect: JAGab84237 )
Symptom:
Panic during system startup ONLY on DEBUG KERNELS.
Panic message and top of stack backtrace (output
by kernel during panic) look like this:
panic: assertion failed (alloc_spinlock: spinlocks held)
at line 1844 in /ux/core/kern/sys/spinlock.c
PC-Offset Stack Trace (read down, top of stack is 1st):
0x001cb4fc (panic+0x54)
0x001cbf5c (assfail+0x3c)
0x001cc118 (_assfail+0x30)
0x001d4f74 (alloc_spinlock+0x11c)
0x00539364 (ire_create+0xec)
0x00547400 (ipif_up_arp_and_ires+0x430)
0x00546d28 (ipif_up+0x308)
0x00545d08 (ipif_loopback_init+0x110)
0x00519394 (ip_open+0x364)
Defect description:
When starting up the transport code, a spinlock
is allocated incorrectly. This doesn't hurt anything
but a sanity check in debug kernels causes the system
to panic.
Resolution:
Allocation of spinlocks during
transport startup has been changed
to avoid failing the sanity check.
( SR number: 8606114887 ; Defect: JAGac29660 )
Symptom:
IP addresses assigned to loopback interfaces (lo0:<N>)
can not be reached from the network.
Defect Description:
HP-UX does not support virtual loopback
interfaces.
Resolution:
Added support for virtual loopback interfaces.
( SR number: 8606124808 ; Defect: JAGac40200 )
Symptom:
T_ORDREL_REQ out of state error messages appear in
nettl.LOG file.
Defect Description:
Multiple calls to shutdown() on a bound socket with
the argument 'how' set to SHUT_WR or SHUT_RDWR will
send multiple T_ORDREL_REQs.
Resolution:
Make sure that one and only one T_ORDREL_REQ is sent.
( SR number: 8606125177 ; Defect: JAGac40568 )
Symptom:
The command 'netstat -a' sometimes causes
a panic with the following stack trace.
udp_snmp_get+0x218
snmpcom_req+0x130
udp_wput_other+0x218
udp_wput+0x1c0
putnext+0x198
putmsg_subr+0x174
putmsg+0x190
syscall+0x200
$syscallrtn+0x0
Defect description:
A race condition existed on a udp data structure
which resulted in attempting to dereference a null pointer.
Resolution:
The race condition is avoided by making a local
copy of the required field of the udp data structure.
( SR number: 8606125342 ; Defect: JAGac40733 )
Symptom:
System panics with the following stack trace.
ip_rput_local+0x21c
ip_rput+0x894
putnext+0x1a4
hp_dlpi_unitdata_in+0x5a0
hp_dlpi_mblk_intr_put+0x2d8
streams_put_release+0x2c8
hp_dlpi_mblk_intr+0x80
---
---
Defect description:
Under highly unlikely circumstances, an uninitialized
variable is dereferenced.
Resolution:
The local variable always gets initialized,
( SR number: 8606126203 ; Defect: JAGac56768 )
Symptom:
A RST is sent when a SYN is received.
Defect Discription:
If TCP initial sequence numbers are messed up,
a RST packet is sent in response to a SYN received
during TCP TIME_WAIT state.
Resolution:
Send an ACK rather than a RST in response to a bad
initial sequence number.
PHNE_20735:
( SR number: 8606110756 ; Defect: JAGab83504 )
Symptom:
Accept() threads don't exist when their process
is killed.
Defect description:
The accept thread is blocked in
streams_getmsg() forever:
_sleep+0xe78
read_sleep+0x57c
streams_getmsg+0x1a4
soaccept+0x33c
sodequeue+0x24c
accept+0x168
syscall+0x480
$syscallrtn+0x0
If a signal is sent to the process,
accept threads wakeup temporarily and
then continue sleeping.
Resolution:
The routine soaccept() has been modified to correctly
set and unset its socket state flag.
( SR number: 8606123969 ; Defect: JAGac39329 )
Symptom:
System panics when closing AF_UNIX sockets with the
following stack;
b_owns_sema+0x8
unp_discard+0x60
unp_scan+0x88
unp_dispose+0x1c
sorflush+0x90
sofree+0x8c
soclose+0x7d0
soo_close+0x7c
closef+0x64
exit+0x2f0
psig+0x220
syscall+0x914
$syscallrtn+0x0
Defect Description:
Socket operations were done on a non-socket when
closing down a AF_UNIX socket that still had
unreceived file descriptors in the receive
buffer.
Resolution:
Validated that a file descriptor pointed to a socket
before performing socket operations on it.
PHNE_20633:
( SR number: 8606107486 ; Defect: JAGab77719 )
Symptom:
A temporary file /tmp/stcp.conf is left around
unnecessarily.
Defect Description:
/sbin/init.d/net.init references an inappropriate file.
Resolution:
Changed /sbin/init.d/net.init to reference the correct
file.
( SR number: 4701413963 ; Defect: INDaa30107 )
Symptom:
Ifconfig may initialize network interfaces incorrectly
during system startup.
Defect Description:
Netconf/nddconf related startup scripts run ifconfig before
running "ndd -c". Some of the nddconf parameters can alter
the behaviour of ifconfig. If ifconfig runs before "ndd -c",
there is no opportunity for ndd to alter those parameters
at startup time resulting in incorrectly initialized network
interfaces.
Resolution:
Changed /sbin/init.d/net to reverse the calls to ndd and
ifconfig.
( SR number: 4701430850 ; Defect: JAGab50646 )
Symptom:
When using a sendfile related application,
the system can panic.
Stack trace with vmtrace on
crash event was a panic
panic+0x14
vmtrace_kfree+0x230
kfree_common+0x2d0
getnewbuf+0x828
ogetblk+0x110
getblk1+0x290
realloccg+0x2f8
bmap+0x710
rwip+0xecc
ufs_rdwr+0x388
vno_rw+0x84
write+0x108
syscall+0x200
$syscallrtn+0x0
Defect Description:
bc_checksum() which is called by sendfile() doesn't
expect that the buffer cache for the file it's sending will
get reallocated to a larger size during its holding period.
When this happens, bc_checksum() can write into
memory that it doesn't own.
Resolution:
Add defensive check inside bc_checksum() to ensure
that writes to memory are within bounds.
( SR number: 8606110207 ; Defect: JAGab82910 )
Symptom:
SNMP returns wrong tcpCurrEstab mib value
Defect Description:
Per-CPU base mib macro does not work for tcpCurrEstab.
Resolution:
Use local variable to get total tcpCurrEstab value.
( SR number: 8606110239 ; Defect: JAGab82942 )
Symptom:
If a server receives a RESET on a socket and does not
close it, all new connections for the SAME remote
port will be dropped.
Defect Description:
The system does not do an IP unbind when a tcp stream
is closing until it is in the TCPS_TIME_WAIT state.
Resolution:
If a SYN arrives on a stream that is in TCPS_BOUND,
do a IP unbind. The SYN packet is also sent to
the default global listen queue so that it can find
its stream and be ACKed.
( SR number: 8606110349 ; Defect: JAGab83053 )
Symptom:
System panic - Data page fault
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
TPI_conn_conf+0x14
so_check_inb_conn_conf+0xc8
soo_select+0x328
select+0x12c4
syscall+0x480
$syscallrtn+0x0
Defect description:
A race condition can occur when multiple threads
access a socket which is processing a connect.
Resolution:
The routine TPI_conn_conf() has been modified to check
the socket stream head using the correct read queue lock.
( SR number: 8606112290 ; Defect: JAGab84607 )
Symptom:
SYNs sent to an XTI listen socket are sometimes
dropped.
Defect Description:
A RST arriving on the XTI listen socket while it
is processing an accept causes the state of the
socket to disagree with the state of the underlying
TCP connection.
Resolution:
The RST now causes TCP to rebind with IP. This allows
SYNs to be handled correctly.
PHNE_20436:
( SR not found ; Defect: JAGaa95395 )
Symptom:
SO_LINGER does not work.
Defect Description:
The SO_LINGER socket option is effectively disabled when
tcp_conn_strategy is in use.
Resolution:
The close path now takes this into consideration.
( SR number: 1653309039 ; Defect: JAGab25258 )
Symptom:
Programs or subsystems (such as NFS) using large
packet sizes could see data corruption when used
on multiprocessor systems with multiple clients
sending data to the same server.
Defect description:
IP code generating IP packet identifiers (used
for re-assembling fragmented packets) did not
use proper multiprocessor synchronization, so
that sometimes different packets would receive
the same identifier when being sent. This would
cause the receiver to erroneously assemble parts
of different packets into a single corrupted packet
which could go undetected (especially though not
necessarily with UDP checksums turned off).
Resolution:
IP packet identifier generation code was
modified to use spinlocks to guarantee
that unique identifiers would correctly
be generated.
( SR not found ; Defect: JAGab32011 )
Symptom:
Data page fault:
stack trace for event 0
crash event was a panic
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xe08
nokgdb+0x8
ip_rput_dlpi+0x1c4
ip_rput+0x6ec
putnext+0x80
LDI_F0_send_error_ack+0x78
LDI_F_error_ack+0x8c
LDI_F0_error_action+0x50
LDI_F_handler+0x2c8
LEC_F0_uwproto+0x158
LEC_F0_uwput+0x94
puthere+0x84
ip_wput_nondata+0x26c
ip_wput+0x16c
...
Defect Description:
IP was executing a freed memory block.
Resolution:
Save the original memory block data in a local
variable before freeing the memory block.
( SR number: 8606104338 ; Defect: JAGab71774 )
Symptom:
T_ORDREL_REQ out of state error messages
appear in nettl.LOG file.
Defect Description:
A shutdown() on an unbound tcp socket
involves the tcp layer when it doesn't need to.
Resolution:
Check for an unconnected socket in soshutdown()
and return EINVAL.
( SR number: 8606106267 ; Defect: JAGab75241 )
Symptom:
For a connection between 10.20 and 11.00,
when the 10.20 advertises 0 window for
some period of time, 11.00 can get
hung.
Defect Description:
For the connection between 10.20 and 11.00,
if the window on 10.20 stays 0 for a while,
due to the use of fix for silly window
syndrome, 10.20 can advertise 0 even
though there are some window openings.
However, since 10.20 will still ack
what 11.00 sends, 11.00 can get confused,
and the system can be hung.
Resolution:
When detecting that the other side of
the connection still ACKs the incoming
packet even though it's advertising
a 0 window, 11.00 will recognize that
the other side implements the fix
for silly window syndrome and moves
ahead even though the other side
has 0 window.
( SR number: 8606106481 ; Defect: JAGab75639 )
Symptom:
Panic in kmalloc() called via sockname().
panic+0x14
trap+0xdb8
nokgdb+0x8
kmalloc+0x350
allocb_wait+0x290
sockname+0x54
Defect Description:
The procedure sockname() does not check for
a negative length parameter.
Resolution:
Procedure sockname() now checks for a negative
length, and returns EINVAL.
( SR number: 8606113535 ; Defect: JAGab75825 )
Symptom:
When the receive side of a socketpair (AF_UNIX) is
"full" the system leaks memory and loses data.
Defect Description:
The calculation of how much room is left on the
socket was incorrect.
Resolution:
The size of the receiving socket is now checked correctly.
( SR number: 8606113563 ; Defect: JAGab76769 )
Symptom:
When the receive side of a socketpair (AF_UNIX) contains
file descriptors and the socket is closed without reading
the data the system loses those descriptors.
Defect Description:
The code responsible for cleaning up the file descriptors
when a full socket was closed was not properly enabled.
Resolution:
The code that does the cleanup when a socket is closed was
re-enabled.
( SR number: 8606113564 ; Defect: JAGab76776 )
Symptom:
Blocking sendmsg() returns EMSGSIZE when receive side is
close to being full. This can happen on blocking or
non-blocking.
Defect Description:
Miscalculation of how much was going to be sent causes
overflow of receive side resulting in the EMSGSIZE.
Resolution:
The calculation that is done before sending was corrected
for the 64-bit case.
( SR number: 8606107144 ; Defect: JAGab76839 )
Symptom:
A debug kernel panics when sleeping while
holding a lock.
Defect Description:
A thread may sleep in TPI_exdata_ind() while
holding a socket lock.
Resolution:
Release the socket lock prior to sleeping
and then reacquire upon wakeup.
( SR number: 8606107729 ; Defect: JAGab78013 )
Symptom:
Cose version of recvmsg does not get the file.
Defect Description:
Cose version of sendmsg and recvmsg did not
correctly assign the file descriptor.
Resolution:
Set correct flag and memory length to
handle the file description.
( SR number: 8606107946 ; Defect: JAGab78256 )
Symptom:
q4> trace event 0
stack trace for event 0
crash event was a panic
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
tcp_detach+0x5b0
tcp_close+0xec
close_wrapper+0x38
csq_protect+0x120
osr_pop_subr+0x1f4
osr_close_subr+0xb00
hpstreams_close_int+0xc3c
streams_close+0x14
soclose+0xe8
soo_close+0x90
closef+0x68
close+0x48
syscall+0x8f0
$syscallrtn+0x0
Defect Description:
TCP structure is deallocated, when FIN_WAIT2 is
timeout.
Resolution:
Release lock after FIN_WAIT2 timeout checking.
( SR number: 8606108899 ; Defect: JAGab81600 )
Symptom:
By using a special scanner, TCP
Initial sequence number exposes
a small possibility of predictability.
Defect Description:
TCP Initial Sequence Number is not
random enough.
Resolution:
Choose a more random formula for
picking TCP initial sequence number.
( SR number: 8606109254 ; Defect: JAGab81953 )
Symptom:
memory corruption.
Defect Description:
The streams queue could be changed during
socket calls the expedite indication.
Resolution:
Look at the message block after streams
synchronization protection.
( SR number: 8606109950 ; Defect: JAGab82651 )
Symptom:
OOB data was not removed from data queue
Defect Description:
OOB data was not correctly handle by OOB data indication.
Resolution:
look into data queue, remove all the contiguous oob
data block and save the last oob data is followed by
regular data.
PHNE_20041:
( SR number: 8606105057 ; Defect: JAGab72884 )
Symptom:
Ping still sends packets when a lan cable is disconnected.
Defect description:
When a local host is configured as a default gateway,
routing table management generates LOOPBACK
routing entries for all the associated remote IPs.
Resolution:
Exclude IRE_LOOPBACK routing entries associated
with addresses of down interfaces.
( SR number: 8606105583 ; Defect: JAGab73749 )
Symptom:
When the receive side of a socketpair (AF_UNIX) is
"full" the system leaks file descriptors and loses data.
Defect Description:
The return of an append operation was
not tested to find out if it was successful.
Resolution:
The return value of the append is now checked.
( SR number: 8606106074 ; Defect: JAGab74913 )
Symptom:
A non-blocking accept() call blocks in the kernel.
Defect description:
The socket code soaccept() was incorrectly checking
if it was in blocking or non-blocking mode.
Resolution:
The routine soaccept() has been modified to correctly
check whether the socket is in blocking or non_blocking
mode.
PHNE_19899:
( SR number: 8606104784 ; Defect: JAGab65709 )
Symptom:
System panic in streams write queue.
sth_putq_owned+0x124
sth_rput_slow+0x620
sth_rput+0x870
putnext+0x50
tcp_rput_other+0x4ac
tcp_rput+0x1734
putnext+0x15c
ip_rput_local+0x328
ip_rput+0x648
putnext+0x50
hp_dlpi_mblk_fast_in+0x50
hp_dlpi_mblk_intr_put+0x6d0
streams_put_release+0x154
hp_dlpi_mblk_intr+0x3clanc_ether_ics+0xf8
btlan4_process_packet+0xac
btlan4_receive_pkts+0x944
btlan4_isr+0x110
dino_isr+0x128
mp_ext_interrupt+0x33c
ivti_patch_to_nop3+0x0
lanc_ether_ics+0xf8
btlan4_process_packet+0xac
Defect Description:
There is no streams queue synchronization protection,
when sockets try to remove an expedited data
indication from the streams queue.
Resolution:
Added calls to streams queue synchronization
protection functions to cover the process of
removing the expedited data indication from the
streams queue.
( SR number: 5003448498 ; Defect: JAGaa46666 )
Symptom:
getsockname() doesn't return address family
if socket is not bound.
Defect Description:
The address family is not set until bound
in 11.0. This is not binary compatible with
10.20.
Resolution:
Initialize the Address Family field before
socket is bound
( SR number: 8606102973 ; Defect: JAGab69105 )
Symptom:
The system hangs due to a timing issue.
Defect Description:
tcp_accept() has assigned the 'accept queue' to
the ESTABLISHED tcp_t, but it has not yet
completed. An external interrupt occurs due to
an incoming packet destined for this established
tcp_t, causing an eventual hang.
The stack of the problem processor will loop,
looking for the correct tcp_t:
csq_turnover+0x20
puthere+0xfc
tcp_rput_context_check+0xa10
tcp_rput+0xc88
puthere+0x170
tcp_rput_context_check+0x504
tcp_rput+0xc88
csq_turnover+0xa8
puthere+0xfc
tcp_rput_context_check+0xa10
tcp_rput+0xc88
putnext+0xcc
ip_rput_local+0x354
ip_rput+0x1d0
putnext+0xcc
Other processors may be stuck in
ip_flush_readers():
ip_flush_readers+0x144
ip_ulp_unbind+0x114
tcp_close+0x5c
close_wrapper+0x38
csq_protect+0x120
osr_pop_subr+0x220
osr_close_subr+0x324
hpstreams_close_int+0x314
streams_close+0x14
soclose+0xf4
soo_close+0x90
closef+0x68
exit+0x324
rexit+0x28
syscall+0x480
$syscallrtn+0x0
Resolution:
A datagram arriving for a nascent tcp_t is
now discarded.
( SR not found ; Defect: JAGab69620 )
Symptom:
System panics when dereferencing a null pointer.
Defect Description:
Duplicate SYN packets are dropped. In this case,
a SYN+data packet is delivered to an established
tcp_t. However, a previous data packet was lost.
The reassembly routine returns a null mp pointer,
indicating there is nothing to reassemble.
Because the SYN bit is set though, the packet is
dropped and attempts to free the mp, resulting
in a panic.
Resolution:
The mp pointer is checked before deallocation.
( SR not found ; Defect: JAGab71212 )
Symptom:
When a heavily-loaded multiprocessor system is
running a program with multiple threads or processes
accessing the same non-blocking socket, and doing
both 'connect' and 'select' operations simultaneously,
the kernel can panic. (Seen with Netscape proxy server
as application.)
Defect description:
Kernel socket code fails to provide proper multiprocessor
protection on access to socket structure and associated
stream head.
Resolution:
socket code in sys_socket.c and uipc_socket.c
failed to use SOCKET_LOCK and SOCKET_UNLOCK
in several places which were modifying the
socket structure flags (so->so_flags) which
protect the stream head during connect and
select operations. Necessary calls to SOCKET_LOCK
and SOCKET_UNLOCK were added to provide this
protection.
( SR number: 8606104549 ; Defect: JAGab72160 )
Symptom:
System TOCs due to three simultaneous MIB extractions.
Defect Description:
A huge old ire table and inefficient MIB extractions
caused the extreme resource consumption.
Resolution:
Put only selected IRE_ROUTEs on the old ire table and
make MIB extractions more efficient.
PHNE_19375:
( SR not found ; Defect: JAGaa57204 )
Symptom:
Transfer of data over loopback connections
is slow. First data packet takes about
one second to transfer.
Defect Description:
First data packet over a loopback connection
is ignored by the server until it has been
retransmitted by the client.
Resolution:
Handling of first data packet was altered
so that the server no longer ignores the first
data packet over a loopback connection.
( SR not found ; Defect: JAGab12875 )
Symptom:
System panics in network interface drivers.
Defect Description:
Unplumbing a network interface with a large
max fragment size results in IP sending oversized
packets to the default network interface.
This is known to happen when ATM or hyperfabric
links are brought down on systems which have
LAN default interfaces.
This only happens if the ROUTE command has been
used to create routes for the interface which
has been unplumbed.
Resolution:
IP was modified to ensure that the max
fragment size is set correctly when determining
new routes after an interface goes down.
( SR number: 1653309237 ; Defect: JAGab25385 )
Symptom:
Sometimes Service Guard switch does not work.
Defect Description:
SIOCSWITCHIFADDR does not switch the
first interface of the interface list.
Resolution:
Set a right offset for ioctl return data pointer.
( SR number: 4701431221 ; Defect: JAGab53651 )
Symptom:
ifconfig <interface> unplumb
can leave behind stale routes. If IP attempts to
use these stale routes, the system will panic.
Defect Description:
System may panic when using a stale route.
Resolution:
When an interace is unplumbed IRE_LOOPBACK routes
are looked for and deleted.
( SR not found ; Defect: JAGab65705 )
Symptom:
IP multicast local switch does not work properly.
Defect Description:
After an local switch, IP multicast addresses are
copied instead of moved.
Resolution:
Delete multicast address from ipif table
after IP local switch.
PHNE_19110:
( SR not found ; DTS number: INDaa29785 )
When using setsockop() with
IP_BROADCAST_IF, validation
check for the address isn't
available.
Resolution:
When using setsockopt and the
IP_BROADCAST_IF option, the address is
now validated at the time that the
setsockopt is called. If not then
EADDRNOTAVAIL is returned.
( SR number: 1653245829 ; DTS number: INDaa31082 )
When a new connect request arrives at the local TCP,
and it is immediately followed by a RESET from the
remote system, the server application is awakened
twice to perform accept() calls. Each accept() call
is returned with ENOBUFS.
Resolution:
ENOBUFS is the correct return value.
The problem is the accepting server application should
not be awakened twice. This was caused by mishandling
the connection id in TPI messages. This problem is
fixed by correctly tracking the connection id between
the socket and TCP layers.
( SR number: 4701397927 ; DTS number: INDaa31339 )
During a Service Guard switchover if the names of
the two interfaces are of different lengths but
match the portion of the shorter name, (lan1 vs lan10)
the switchover will fail.
Resolution:
Check the length of the names before checking if they
are the same name.
( SR not found ; Defect: JAGaa43046 )
Getsockopt() can cause memory corruption when the
socket option size is larger than four bytes. The
following socket options are affected:
SO_LINGER, KEEPALIVE_OPT, INET_IP, IPPROTO_IP,
ADD_MEMBERSHIP_OPT, DROP_MEMBERSHIP_OPT,
BROADCAST_IFNAME_OPT.
Resolution:
Pass opt as a array of "int" to TPI_optmgmt_ack().
( SR number: 1653293993 ; Defect: JAGaa93498 )
Memory (512 bytes) is leaked when EAGAIN is returned
from a non-blocking shutdown system call.
Resolution:
If an error occurs that would leave memory allocated
free that memory.
( SR number: 1653297184 ; Defect: JAGaa94482 )
When passing descriptors via Unix Domain Sockets,
dynamically allocated memory may be freed more
than once resulting in a panic.
freeb+0x4c
freemsg+0x18
sendit2+0x2b0
sendmsg2+0x94
syscall+0x1c8
$syscallrtn+0x0
Resolution:
Possible codepaths that contained double-
deallocations of the same area of memory
were eliminated.
( SR not found ; Defect: JAGab15907 )
The identified call to SOCKET_UNLOCK() does not have
a matching call to SOCKET_LOCK(). The call to
SOCKET_UNLOCK() needs to be removed.
Resolution:
Removed an un-matched unlock call from an error-path.
( SR not found ; Defect: JAGab20900 )
When several processes try to accept
connections on a TCP port at the
same time, one of the processes may get hung
in accept(). This hung process can't be killed
without a system reboot.
Resolution:
This problem was caused by missing socket protection
around socket's file reference flag. This problem
is fixed by adding SOCKET lock around the flag.
( SR number: 1653307850 ; Defect: JAGab20953 )
Routes disappear if interface is downed.
Resolution:
Leave a "loopback" route when taking down an
interface either by the ifconfig command
or from the device driver. This will
"allow" processes to keep working in
loopback even over an interface that is down.
( SR not found ; Defect: JAGab24408 )
System panic when calling mi_ibc_qenable after
memory shortage:
panic+0x14
report_trap_or_int_and_panic+0x80
trap+0xdb8
nokgdb+0x8
asm_spinlock_usav+0x14
qenable+0x40
mi_ibc_qenable+0x40
Resolution:
Fix pointer arithmetic bug in mi_ibc_qenable.
( SR not found ; Defect: JAGab25437 )
getsockname()/getpeername() doesn't return
EINVAL when the socket has been shutdown
Resolution:
Both getsockname() and getpeername() return EINVAL after
shutdown() is called.
( SR number: 8606125171 ; Defect: JAGab30443 )
It is not possible to force an aio_read on a socket
to complete.
Resolution:
Workaround added for specific customers using
POSIX AIO on a TCP socket.
PHNE_18708:
( SR not found ; Defect: JAGab15944 )
Install kernel panics during boot.
panic: callout table overflow
Resolution:
Change in the method used by the network timer code
to determine the existence of its patch dependencies.
( SR not found ; Defect: JAGab16252 )
The console may occasionally output the
following STREAMS error message:
"ip_rput: lan<X> forced us to pullup pkt"
(where <X> is the PPA number of an interface)
during bootup.
Resolution:
The resolution to this problem is to change
the default for ip_rput_pullups in the
kernel during bootup. This is done via ndd.
( SR not found ; Defect: JAGab16550 )
Possible memory leak and panic in soreceive() when
using PR_ATOMIC sockets.
Resolution:
The memory is now freed and the
character count is updated
properly.
( SR not found ; Defect: JAGab17225 )
Panic in rawip_rput when closing a SOCK_RAW socket.
Inbound packet is being processed after rawip
structure has been freed and q_ptr == 0.
Resolution:
Unbind the raw socket from the protocol earlier to
avoid the race condition during close().
PHNE_18611:
( SR not found ; Defect: JAGab15175 )
A program can become unkillable when
using SO_LINGER and a remote system
quits responding.
Resolution:
When a program is exiting we no longer
allow "sleeping" on SO_LINGER sockets.
Unless the linger would have resulted
in a RESET being sent. In that case we
do not change the behavior.
( SR not found ; Defect: JAGab16046 )
Performance enhancement in timer code.
Resolution:
Enable network timer performance enhancement.
PHNE_18554:
( SR not found ; Defect: JAGab15829 )
Documentation inside source files needs to be clearer.
Resolution:
Documentation was improved where needed.
PHNE_18553:
( SR number: 5003443846 ; Defect: JAGaa44800 )
Customer's application gets the wrong value from fstat().
Resolution:
The value returned via st_blksize is now retrieved
from the same info as in 10.20.
( SR not found ; DTS number: INDaa29778 )
read() will read past the Out of Band data
pointer.
Resolution:
recv() will stop at the out of band
pointer if one exists.
( SR number: 4701426817 ; Defect: JAGaa79750 )
Customer will see apparent hangs or extremely
long transfer times when using any application
that uses sendfile (I.E. ftp and rcp ) AND the
file system does not have a default block size
of 8k bytes.
The enhanced version of sendfile() does not
handle a filesystem with a block size GREATER
than 8k. The reason for this is that when this
happens it is assumed that there is a checksum
provided by the file system. In that case the
checksum would properly be computed. However in
the error case there isn't a provided checksum
AND the block size is greater than 8K so neither
of the routines that would calculate the checksum
are invoked.
Resolution:
The fix is to add in a computing of the checksum.
( SR not found ; Defect: JAGaa93103 )
Nettl tracing for transport generates
the following errors.
I_BACKENDTRACE_ACTIVE ioctl failure: Invalid argument
Resolution:
Removed IPSec code in stcpmap_copyin_done() for
SS_START_TRACE action. This was causing incorrect values to
be passed up to nettl thus causing nettl to not correctly
setup IP or ICMP tracing.
( SR not found ; Defect: JAGaa93449 )
System panic's when allocating a new socket under heavy
memory pressure.
Resolution:
The problem that was found here is that when the
system is under memory pressure it may fail an
allocation of memory while creating a socket.
In the code there was a free to a socket buffer
structure that would normally need to be done
on AF_UNIX sockets but not on AF_INET. The
free was done unconditionally not checking
what the domain of the socket was. So by
taking out the free when the socket is AF_INET
the problem is solved.
( SR not found ; Defect: JAGaa93936 )
unp_externalize() does not work correctly on
64-bit kernels. As a result, file pointers
that are passed may not be converted into
file descriptors correctly.
Resolution:
Extra variables were used that could handle
64-bit pointer values.
( SR number: 1653297044 ; Defect: JAGaa94252 )
If a server receives a RESET on a socket but does not
close it then any new connections for the SAME remote
port will be dropped.
To save on cpu cycles the system does not do an IP
unbind when a tcp stream is closing until it is in the
TCPS_TIME_WAIT state. This is because it is possible for
the application to _reuse_ the same stream and would have
to do a new IP bind. By waiting for the TCPS_TIME_WAIT
state before doing the unbind if an application reuses
the stream it is ready with many less instructions.
Most applications close sockets that have been reset
fairly quickly. When they do the tcp state transitions
from TCPS_BOUND to TCPS_TIME_WAIT. This would close the
window that we have of dropping packets because of a
stream in TCPS_BOUND state. We may rarely drop the
first SYN but normally would not drop the second.
Resolution:
The way that we have solved the problem is that if we DO
get a SYN on a stream that is in TCPS_BOUND to send back
down the stream to do a IP unbind. This way the next time
a packet comes in the system will not find it in its list
and therefore NOT send the packet up this stream. The
system would then look at the listener list and find the
correct listen queue and send up the packet.
To solve the problem of maybe dropping the first SYN
that came in we also send the packet to the default
global listen queue so that it can find its stream and
properly be acknowledged.
( SR not found ; Defect: JAGaa94273 )
When an application uses a protocol of type
PR_ATOMIC, receives N bytes of a large message,
and confirms that the first message size in the
socket receive queue is larger than N bytes, the
socket drops the first record without freeing
the memory block.
Resolution:
The kernel frees the associated memory
block when it drops a record.
( SR number: 5003455758 ; Defect: JAGaa94547 )
After receiving a remote shutdown,
send() gets EPIPE/SIGPIPE error.
Resolution:
To solve this backwards compatibility issue,
the SS_CANTSENDMORE flag is turned off after
disconnecting the socket.
( SR not found ; Defect: JAGaa95836 )
Cannot use ifconfig <ifname>X:0.
ifconfig <ifname>X works fine.
Example:
#ifconfig lan0:0 15.13.136.150
netmask 255.255.248.0 up
#netstat -in
Name Mtu Network Address
lan0 1500 none none
lan0* 1500 none none
lan0* 1500 none none
lan0* 1500 15.0.0.0 15.13.136.150
lan0* 1500 none none
lan0* 1500 none none
lo0 4136 127.0.0.0 127.0.0.1
Resolution:
Check for a ":0" at the end of an
interface name and treat it the same
as a name without a suffix.
( SR not found ; Defect: JAGab03650 )
soaccept did not reset the a new socket
SS_ACCEPT_PENDING state after returning
from soclone.
Resolution:
Reset the SS_ACCEPT_PENDING flag
after returning from soclone.
( SR number: 4701422667 ; Defect: JAGab11188 )
Server applications keep getting
"Address already in Use". This has
been particularly noticed in
syslog.log coming from inetd.
An application that did not notice that its socket
had received a RST could potentially keep a new
copy of the same program from starting.
This would be the case even if the user specified
SO_REUSEADDR. If both SO_REUSEADDR _and_
SO_REUSEPORT were used then the problem does not
appear.
Resolution:
The reason for this problem is that this state was
considered to be short lived so the chance of a
race should be minimal. Also another part
of the problem is that the assumption that an
ACCEPTED tcp_t could go to TCPS_BOUND was
incorrect. It should be going to TCPS_IDLE.
The resolution is to go to TCPS_IDLE.
( SR not found ; Defect: JAGab13907 )
Application hangs while trying to close socket while
using SO_LINGER and a RESET has been received.
Resolution:
The problem was solved by checking the state of the
tcp connection for the idle state.
PHNE_17662:
( SR number: 1653250993 ; DTS number: INDaa29881 )
If a listen socket is set to be nonblocking
with fcntl() with either O_NONBLOCK or
O_NDELAY, then the new socket created by
accept() is also in nonblocking mode.
However, this mode cannot be disabled in
any way through fcntl().
( SR number: 5003446658 ; Defect: JAGaa45906 )
send() when called non-blocking returns EWOULDBLOCK
rather than EAGAIN.
( SR number: 5003451260 ; Defect: JAGaa72824 )
Various panics all related to timers. Stack
trace varies, but generally appears as follows:
... (may be dupb+b8)
tcp_wput+0x???
tcp_timer+0x310
tcp_wput+0x2ac
puthere+0x138
mi_timeout_exec+0x2f8
( SR number: 1653292912 ; Defect: JAGaa93194 )
A recv() with MSG_PEEK on a socket that
1. contains no data on it
2. has been set to non-blocking mode
with an ioctl() with FIOSNBIO
3. has not been set to non-blocking
mode with a fcntl() with O_NONBLOCK
or a fcntl() with O_NDELAY
will return ENODATA when it should
return EWOULDBLOCK.
( SR number: 4701417675 ; Defect: JAGaa93344 )
For 100BT btlan6 interfaces, disconnecting and
nd reconnecting the lan card results in the card
state being marked UP. This causes ServiceGuard
lan switchback to fail with EBUSY.
( SR not found ; Defect: JAGaa93448 )
System panic during memory shortage
panic+0x14
report_trap_or_int_and_panic+0x80
interrupt+0x1d4
$ihndlr_rtn+0x0
mi_open_comm1+0x614
mi_open_detached_debug+0x38
tcp_open_detached+0x20
tcp_conn_ind+0xf0
tcp_rput+0xbc8
putnext+0xcc
ip_rput_local+0x198c
ip_rput+0x198
PHNE_17613:
( SR not found ; DTS number: INDaa30743 )
Some macros in led.h do not parenthesize
properly, leading to possible unintended errors.
( SR not found ; Defect: JAGaa44077 )
Calling setsockopt() with an inappropriate
optlen field may result in a panic.
( SR not found ; Defect: JAGaa48864 )
Calling sendmsg() with an inappropriate
msg_accrightslen or msg_controllen field
may result in a panic.
( SR number: 5003450247 ; Defect: JAGaa59074 )
Receiving an IP packet with zero length
causes panic.
The stack trace shows:
panic+0x14
report_trap_or_int_and_panic+0x4c
interrupt+0x1e8
$ihndlr_rtn+0x0
ip_rput_local+0x16c
ip_rput+0x23c
putnext+0x50
hp_dlpi_intr_put+0x1cc
streams_put+0x74
hp_dlpi_intr+0x80
...
PHNE_17446:
( SR not found ; Defect: JAGaa43378 )
There was no method of obtaining the
inbound TOS field from the IP header
of the SYN packet.
( SR number: 4701409722 ; Defect: JAGaa44726 )
Memory leak in AF_UNIX/SOCK_STREAM sockets when using
socketpair() system call.
( SR not found ; Defect: JAGaa44803 )
Defects in tcp retransmit timer may cause API hang.
( SR number: 4701410415 ; Defect: JAGaa45469 )
TCP RTO calculation causes a performance problem.
( SR number: 1653288514 ; Defect: JAGaa45800 )
inetd can hang when an excessive amount
of RST packets are seen at one of its
well-known ports.
( SR not found ; Defect: JAGaa45930 )
System panics if the ip fragment reassembly memory runs
out.
( SR number: 5003438580 ; Defect: JAGaa46463 )
Strong ES mode does not work for multiple
broadcast packets.
PHNE_17227:
( SR number: 1653282012 ; Defect: JAGaa42953 )
Unlike 10.20 Transport, the 11.00 Transport does not
provide an ioctl to tell ARP to rebroadcast IP address
definitions.
( SR not found ; Defect: JAGaa44566 )
System panics while doing an sosleep on sockets
other than AF_UNIX, or AF_INET.
panic+0x14
wait_for_lock+0x1c8
sl_retry+0x18
get_sleep_lock+0x34
unselect+0x24
invoke_callouts_for_self+0xac
sw_service+0x94
inttr_emulate_save_fpu+0x100
sosleep+0x14c
sbwait+0x30
soreceive+0x944
recvit+0x138
recv+0x4c
syscall+0x688
( SR number: 1653249706 ; DTS number: INDaa29763 )
A panic may occur when trying to open a UNIX
domain socket.
( SR not found ; Defect: JAGaa40511 )
Various panics in streams code on 32 processor
V2500 boxes.
( SR not found ; Defect: JAGaa43478 )
OOB causes memory leak.
PHNE_17117:
( SR not found ; Defect: JAGaa57274 )
Sockets code comments require clarification.
PHNE_17018:
( SR not found ; DTS number: INDaa31704 )
IP dropped both duplicate fragments.
( SR not found ; Defect: JAGaa43135 )
TCP-generated segments sent to all-zeros broadcast address.
( SR not found ; Defect: JAGaa43864 )
TCP determined when to send a FIN based upon incorrect
information, and this delayed the FIN for 500ms.
( SR number: 1653284844 ; Defect: JAGaa44015 )
TCP starts "discard with cksum error"
after ICMP FRAG NEEDED received.
PHNE_17017:
( SR not found ; DTS number: INDaa31672 )
traceroute may fail with the following error message:
ttl not correct, ttl = 1, ttl2 = 0
( SR not found ; Defect: JAGaa40492 )
Kernels containing this bug *might* see a hang soon
after booting, or they might not hang at all.
Machines that have seen the hang:
D-class, 782, 887, 897
Machines that ran fine without seeing the hang:
J210, K460
( SR number: 4701404426 ; Defect: JAGaa40908 )
select() on a TCP socket was not returning true
when out-of-band data was received.
( SR not found ; Defect: JAGaa43365 )
The value of a STATIC variable might be changed by another
thread, thus causing the routine to look at the wrong item
in a table.
( SR not found ; Defect: JAGaa43403 )
Doing an accept on an AF_INET socket under
conditions of extreme memory pressure can result
in a Data Page Fault panic.
trap+0x808
kfree_common+0x200
soclone+0x5e8
soaccept+0x98
sodequeue+0xac
accept+0x128
syscall+0x1cc
$syscallrtn+0x0
PHNE_16645:
( SR number: 1653272674 ; DTS number: INDaa31588 )
The maximum size for socket send and receive buffers for
AF_UNIX sockets was hardcoded to 32,767 bytes.
( SR not found ; DTS number: INDaa31592 )
System leaks memory when using AF_UNIX sockets.
( SR not found ; DTS number: JAGaa40308 )
Memory leak in soclone() and sonewconn().
( SR number: 1653279430 ; DTS number: JAGaa40890 )
Customer may see the following panics;
panic+0x14
report_trap_or_int_and_panic+0x4c
trap+0xe8c
$RDB_trap_patch+0x20
spinlock_usav+0x10
mp_socket_lock+0x30
soo_ioctl+0x28
ioctl+0x13c
syscall+0x1c8
$syscallrtn+0x0
AND/OR
panic+0x14
report_trap_or_int_and_panic+0x4c
trap+0xe8c
$RDB_trap_patch+0x20
spinlock_usav+0x10
mp_socket_lock+0x30
soo_stat+0x48
fstat+0x100
syscall+0x1c8
$syscallrtn+0x0
PHNE_16497:
( SR not found ; DTS number: INDaa28388 )
The setting of TCP_NODELAY was not inherited across
an accept() call.
( SR number: 1653271866 ; DTS number: INDaa31445 )
Point-to-point connections do not remain after a
switchover.
( SR not found ; DTS number: INDaa31446 )
When using the system call socketpair() with AF_UNIX the
system will leak memory.
( SR number: 4701399261 ; DTS number: INDaa31505 )
Incorrect IP fragmentation may cause
the system to panic.
Stack trace:
panic+0x14
report_trap_or_int_and_panic+0x7c
interrupt+0x1d4
$ihndlr_rtn+0x0
ill_frag_timeout+0xa8
ip_rtimer+0xd8
ip_rput+0x300
puthere+0x84
mi_timeout_exec+0x330
invoke_callouts_for_self+0xc0
sw_service+0xb0
mp_ext_interrupt+0x12c
( SR number: 1653270728 ; DTS number: INDaa31563 )
When a ICMP_FRAGMENTATION_NEEDED message was
received on a TCP connection, the portion of
data that had not been acknowledged was
re-sent endlessly.
( SR number: 5003432989 ; DTS number: INDaa31628 )
System may panic with the following stack;
panic+0x14
unp_disconnect+0xdc
uipc_usrreq+0x500
sodisconnect+0x4c
soconnect+0x3c4
connect+0x310
syscall+0x6c0
$syscallrtn+0x0
PHNE_16283:
( SR not found ; DTS number: INDaa28344 )
The sendfile system call can trigger the Nagle algorithm,
decreasing file transfer performance.
( SR number: 5003428474 ; DTS number: INDaa31304 )
Customer may see a 'hang' where all networking will hang.
This would also include AF_UNIX connections.
( SR not found ; DTS number: INDaa31373 )
Calling getsockopt() with a large buffer length
argument may result in a panic.
( SR not found ; DTS number: INDaa31444 )
Data page fault in socket_merged(), the panic stack trace
looks like this: trap, crfree, socket_merged, socket,
syscall
( SR number: 5003431122 ; DTS number: INDaa31504 )
AF_UNIX socket dupb() causes panic.
The root cause is fixed in streams patch PHNE_16290.
The stack trace shows:
stack trace for event 0
crash event was a panic
panic+0x14
report_trap_or_int_and_panic+0x7c
trap+0xd58
$call_trap+0x28
freeb+0x54
unp_detach+0xec
uipc_usrreq+0x580
soclose+0x1f8
soo_close+0x90
closef+0x64
close+0x48
syscall+0x6c0
$syscallrtn+0x0
( SR number: 5003430355 ; DTS number: INDaa31542 )
A panic occurs when receiving a strange
TCP/IP packet from MSDOS. Stack trace shows:
panic+0x14
report_trap_or_int_and_panic+0x4c
interrupt+0x1ec
$ihndlr_rtn+0x0
tcp_rput+0x10a0
putnext+0x50
ip_rput_local+0x644
ip_rput+0x164
putnext+0x50
hp_dlpi_unitdata_in+0xddc
hp_dlpi_intr_put+0x6e8
streams_put+0x74
hp_dlpi_intr+0x84
lan2_process_packet+0x7cc
lan2_int_fr_rnr+0x198
lan2_isr+0x170
lasi_interrupt+0x5c
mp_ext_interrupt+0x31c
ivti_patch_to_nop3+0x0
idle+0x278
swidle_exit+0x0
( SR not found ; DTS number: INDaa31552 )
Unable to add a second route for a host which
using the local address as the gateway.
PHNE_15995:
( SR number: 5003426320 ; DTS number: INDaa31147 )
A socket with many connections queued on it may
panic the system. This may occur when a RST
packet is sent by the other end or during an
accept() call on the socket.
( SR number: 5003427336 ; DTS number: INDaa31214 )
After first urgent data packet, the second send fails
with ENOBUFS.
PHNE_15911:
( SR not found ; DTS number: INDaa29195 )
System crashes with the following stack while running
AF_UNIX DGRAM sockets;
sounlock
mp_socket_unlock
uipc_usrreq
sosend
sendit
sendto
syscall
$syscallrtn
( SR number: 1653262717 ; DTS number: INDaa30786 )
TCP clients attempting to connect with a server
time out (ETIMEDOUT error) even though 'netstat -a'
shows that a LISTEN socket exists for the server.
In general this problem will affect a single
service. Other services will continue accepting
connections normally.
( SR number: 5003418889 ; DTS number: INDaa30965 )
Some firewalls do not respond to ICMP ECHO Requests.
Dead Gateway Detection assumes that the lack of response
means that the gateway is dead, and valid route entries
are incorrectly marked as invalid.
( SR number: 1653266171 ; DTS number: INDaa31078 )
When a connection is in the FIN_WAIT_1 state and
an ICMP unreachable packet with NEEDFRAG arrives
and forces a retransmission, the system to panics
with a data page fault. The stack trace shows:
panic+0x14
report_trap_or_int_and_panic+0x4c
interrupt+0xec
$ihndlr_rtn+0x0
dupb+0xd0
tcp_xmit_mp+0x2b8
tcp_wput+0x46c
tcp_rput+0x378
putnext+0x50
ip_rput_local+0x430
ip_rput+0x160
putnext+0x50
hp_dlpi_fast_in+0xbc
hp_dlpi_intr_put+0xf8
streams_put+0x74
...
( SR number: 5003421818 ; DTS number: INDaa31117 )
Gated delete command for the default route
does not work because the Internet Route
Entry has the mask as 0xffffffff.
netstat -rvn shows :
default/255.255.255.255 ...
ndd -get /dev/ip ip_ire_status shows:
... mask ... gateway
ffffffff IRE_NET
Route delete host default $(hostname)
also fails when mask is 0xffffffff.
PHNE_15692:
( SR not found ; DTS number: INDaa30948 )
Added per-CPU MIB functionality performance tuning.
PHNE_15583:
( SR number: 5003411926 ; DTS number: INDaa30157 )
A panic can occur in sounlock because of a race between
two processes trying to access the same AF_UNIX socket.
Here is the panic string;
sounlock
unp_connect
uipc_usrreq
soconnect
connect
syscall
( SR number: 1653258848 ; DTS number: INDaa30372 )
Zero window probes were not being started when
the window became zero octets and there was
no data ready to be sent.
( SR number: 5003418822 ; DTS number: INDaa30467 )
TCP was ignoring inbound keepalive probes where the
sequence number *and* the ack number were both decremented.
Such keepalive probes are sent by machines running BSD-based
code, although the 4.4BSD code contains a compile-time
option for sending probes where only the sequence number
is decremented.
Keepalive probes from HP-UX 11.0 (or Solaris) boxes were not
ignored.
( SR number: 1653258830 ; DTS number: INDaa30675 )
Half-open connections were not being reset when
the disconnected side tried to reconnect with
the same address and port.
( SR number: 1653262980 ; DTS number: INDaa30752 )
Data page fault caused by ip_csuma routine: go_again.
Key panic stack trace looks like this:
go_again+0x20
icmp_pkt+0x140
icmp_source_quench+0xa4
icmp_inbound+0x98c
ip_rput_local+0xbcc
ip_rput+0x180
...
( SR number: 4701393090 ; DTS number: INDaa30787 )
System may panic with either a already freed mblk
or a corrupted one.
PHNE_15047:
( SR number: 5003410076 ; DTS number: INDaa30102 )
Connect to a connected UDP socket does not disconnect the
original connection.
If the resolv.conf file has multiple servers
listed and the first nameserver is not running
named, the secondary nameserver gets an
ICMP_PORT_UNREACHABLE message.
( SR number: 5003413591 ; DTS number: INDaa30268 )
System may panic when using NON-BLOCKING connect() and
select().
PHNE_14876:
( SR not found ; DTS number: INDaa30315 )
Transferring a file using FTP can cause a
data page fault panic in sendfp_by_bread().
Stack Trace:
sendfp_by_bread
sendfp
sendfile
PHNE_14730:
( SR number: 1653250456 ; DTS number: INDaa29935 )
Copying a smaller file on top of a file being shipped via
sendfile() (eg FTP) can result in a tight loop inside
sendfp_by_rdwr() which grabs the CPU forever.
PHNE_14702:
( SR not found ; DTS number: INDaa30079 )
sendmsg() does not send 65535-byte and larger msgs correctly
( SR number: 1653256222 ; DTS number: INDaa30182 )
When a new PMTU is discovered after the TCP FIN has been
sent on a connection, a panic can occur during
retransmission of the data.
( SR not found ; DTS number: INDaa30226 )
TCP SYN packets which have the PUSH flag set are
dropped.
( SR number: 1653256388 ; DTS number: INDaa30230 )
Calling recv() with MSG_PEEK flag set when OOB data
(TCP urgent data) has been received can result in the
process hanging and eventually the system memory is used
up. The exact circumstances to provoke the problem is to
do a recv() with MSG_PEEK set on a socket without the
SO_OOBINLINE option set when there is unread OOB data
(TCP urgent data) available.
PHNE_14575:
( SR not found ; DTS number: INDaa30030 )
During Service Guard local lan failover with Fibre Channel
network interfaces, failover from primary to secondary works
properly, but fail back from secondary to primary when the
primary interface recovers fails to work.
ioctl(SIOCSWITCHIFADDR) returns errno 16 "Device Busy".
PHNE_14279:
( SR not found ; DTS number: INDaa29460 )
Panic - data page fault in ip_rput_dlpi_up
PHNE_14274:
( SR number: 1653251702 ; DTS number: INDaa29894 )
When an IP address is added as a secondary interface -- e.g.
when a ServiceGuard (SG) package runs -- one of two errors
can result when certain conditions are met:
1. Using an r-command (e.g. rlogin, rcp) or an SG
cm-command results in a "Permission denied" error if
the secondary IP address is not in the .rhosts file on
the remote system. This affects commands and
applications that bind to INADDR_ANY.
2. SG loses its heartbeat and detects a spurious
"failure" if the secondary IP address is a duplicate
of one of the remote system's IP addresses, a
configuration error. This happens when the system
must send an ARP request to locate the remote system.
PHNE_14260:
( SR not found ; DTS number: INDaa29680 )
ip_snmp_get race condition.
( SR not found ; DTS number: INDaa29726 )
On fast CPUs the command
netstat -an
can cause data page fault panics. On slower machines,
this panic only occurs when numerous netstat
commands are executed in parallel.
PHNE_14017:
( SR not found ; DTS number: INDaa29579 )
shutdown blocks on a non-blocking socket
( SR not found ; DTS number: INDaa29598 )
paniced in ip_flush_readers(), already owns lock
PHNE_13692:
( SR number: 1653239764 ; DTS number: INDaa29253 )
If the system is a single processor machine they may see it
hang. It will still respond to "ping" but the console and
all other activity will stop.
If the system is a multiprocessor machine the customer may
see that one processor is 100% busy running netisr. The
rest of the system will be working OK with the exception of
the one processor being out of the picture. Networking may
be slow or not working at all.
Netstat will show one of this systems IP addresses connected
to itself along with the local and remote port being the
same. The state of the socket will be SYN_RCVD.
PHNE_13405:
( SR not found ; DTS number: INDaa27472 )
write() to a closed socket returns ECONNRESET instead
of the expected EPIPE.
( SR not found ; DTS number: INDaa28544 )
HA switchover takes up to 7 seconds to complete.
( SR not found ; DTS number: INDaa28665 )
Calling recv(), recvmsg(), and recvfrom() with the
MSG_PEEK flag set on UNIX domain datagram sockets
may discard some data.
( SR not found ; DTS number: INDaa28833 )
data page fault when executing
"ndd -get /dev/ip ip_ill_report"
( SR not found ; DTS number: INDaa28992 )
Multiprocessor systems may hang on an accept() call.
( SR not found ; DTS number: INDaa29086 )
These device files are not intended to be used as a general
purpose input/output devices. Using /dev/tun* as the
standard input or output device generates an ioctl
command which is not supported by the device driver.
Due to a lack of robustness in this driver, the format
of this ioctl causes a panic.
By adding additional sanity checks to the ioctl processing
code, the correct action can be taken, which is to
reject the ioctl call with an errno of EINVAL.
( SR not found ; DTS number: INDaa29102 )
Set initial transport kernel segment file basemode
value to 0777.
( SR not found ; DTS number: INDaa29194 )
data page fault in tcp_linger_callback().
Enhancement:
No
SR:
1653239764 5003418889 8606125342 8606164046 8606209264
1653245829 5003421818 8606125525 8606164864 8606211448
1653249706 5003426320 8606126203 8606165518 8606213513
1653250456 5003427336 8606126852 8606165729 8606215148
1653250993 5003428474 8606127632 8606165984 8606217657
1653251702 5003430355 8606129427 8606166814 8606218753
1653256222 5003431122 8606130980 8606167240 8606219937
1653256388 5003432989 8606131229 8606167654 8606220568
1653258830 5003438580 8606131836 8606169570 8606220677
1653258848 5003443846 8606132568 8606170482 8606221602
1653262717 5003446658 8606134419 8606170531 8606221777
1653262980 5003448498 8606134441 8606175299 8606222508
&