Patch-ID# 101946-35
Keywords: kernel libsocket sockmod procfs nfs RDBMS strrput AIX cachefs security
Synopsis: SunOS 5.4_x86: kernel patch 
Date: Jun/21/96

Solaris Release: 2.4_x86

SunOS Release: 5.4_x86

Unbundled Product:

Unbundled Release:

Xref: This patch available for SPARC as patch 101945

Topic: SunOS 5.4_x86: kernel patch

        NOTE 1: If this patch is applied to a system which is used as an
                FTP server, install the driver update package DU10
                or greater. Earlier driver updates, when used with this
                patch, can result in significant degradation of file
                retrieval time.

        NOTE 2: If this patch is applied to a system installed with
                the entire configuration, the default save option
                of the installpatch utility will use approximately
                20 MB of free space in /var.

BugId's fixed with this patch: 1120225 1124354 1130791 1143479 1145457 1151364 1151509 1152710 1155298 1157053 1159330 1159986 1160112 1162269 1162834 1163335 1164319 1164519 1164800 1165675 1165687 1167235 1169686 1169775 1169791 1169909 1171008 1171478 1171939 1172009 1172243 1172260 1172542 1172731 1172926 1172979 1172998 1173212 1173301 1173309 1173969 1174222 1174685 1174786 1174830 1174851 1174913 1175115 1175127 1175304 1175356 1175368 1175478 1175668 1175931 1176467 1176508 1176618 1177091 1177228 1177469 1177572 1177578 1177600 1178114 1178236 1178391 1178400 1178506 1178641 1178761 1178824 1178835 1178889 1178898 1178957 1178985 1179311 1179625 1179738 1179884 1180414 1180578 1180819 1181009 1181201 1181259 1182051 1182105 1182158 1182458 1182492 1182509 1182597 1183395 1183552 1183568 1183662 1184134 1184256
BugId's fixed with this patch: 1184991 1185149 1185775 1186156 1186224 1186287 1186420 1186557 1186569 1186805 1187322 1187536 1187901 1187948 1188259 1188287 1188307 1188399 1188475 1188701 1188790 1189271 1189389 1189592 1189967 1189968 1191078 1191422 1191457 1192162 1192238 1192309 1192982 1193066 1193448 1193696 1193721 1194355 1194613 1194878 1194928 1195432 1195436 1195437 1195904 1197646 1197708 1197979 1198278 1198439 1198966 1199124 1199164 1199579 1199624 1200224 1200502 1201926 1202070 1202675 1203132 1203471 1204479 1205240 1205409 1205731 1206384 1206598 1206642 1207181 1207277 1207669 1207954 1208034 1208053 1208241 1209012 1209014 1209452 1209687 1209917 1210314 1210355 1211022 1211172 1211278 1211904 1213782 1213874 1214043 1214057 1214320 1216540 1217050 1217220 1217941 1218997 1219020 1219766 1220257
BugId's fixed with this patch: 1220400 1220886 1220995 1221608 1221620 1222086 1222599 1222780 1222902 1223853 1224074 1224089 1224148 1224737 1227426 1229031 1229805 1229843 12317201235099 1231871 1231997 1232866 1232869 1233719 1234879 1236149 1238343 1240151 1241611 1242481 1244917

Changes incorporated in this version: 1198966 1232869 1238343 1240151 1241611 1242481 1244917

Relevant Architectures: i386

Patches accumulated and obsoleted by this patch: 101903-01 101919-01 101970-07 101972-01 101976-01 101982-02 101984-09 102008-02 102021-04 102120-01 102170-01 102225-04 102359-01 102927-01

Patches which conflict with this patch:

Patches required with this patch:

Obsoleted by:

Files included with this patch:

/etc/fs/nfs/mount
/etc/lib/unix_scheme.so.1
/etc/name_to_sysnum
/kadb
/kernel/drv/cmdk
/kernel/drv/cn
/kernel/drv/icmp
/kernel/drv/ip
/kernel/drv/logindmux
/kernel/drv/logindmux.conf
/kernel/strmod/rlmod
/kernel/drv/ip
/kernel/drv/tcp
/kernel/drv/tl
/kernel/drv/udp
/kernel/fs/autofs
/kernel/fs/cachefs
/kernel/fs/lofs
/kernel/fs/nfs
/kernel/fs/procfs
/kernel/fs/tmpfs
/kernel/fs/ufs
/kernel/mach/uppc
/kernel/misc/strategy
/kernel/misc/strplumb
/kernel/misc/swapgeneric
/kernel/sched/TS
/kernel/strmod/rlmod
/kernel/strmod/sockmod
/kernel/strmod/telmod
/kernel/strmod/timod
/kernel/sys/c2audit
/kernel/sys/kaio
/kernel/sys/nfs
/kernel/unix
/sbin/init
/sbin/su
/sbin/sulogin
/usr/bin/su
/usr/include/security/ia_appl.h
/usr/include/sys/aio_req.h
/usr/include/sys/aio.h
/usr/include/sys/asynch.h
/usr/include/sys/ddi_impldefs.h
/usr/include/sys/errno.h
/usr/include/sys/proc.h
/usr/include/sys/sema_impl.h
/usr/include/sys/sockmod.h
/usr/include/sys/stropts.h
/usr/include/sys/strsubr.h
/usr/kernel/fs/s5fs
/usr/kernel/sched/RT
/usr/kvm/adb
/usr/kvm/crash
/usr/kvm/lib/adb/sema
/usr/lib/autofs/automountd
/usr/lib/fs/autofs/automount
/usr/lib/fs/nfs/inetboot
/usr/lib/fs/nfs/mount
/usr/lib/fs/nfs/umount
/usr/lib/libaio.so.1
/usr/lib/libauth.a
/usr/lib/libauth.so.1
/usr/lib/libc.a
/usr/lib/libc.so.1
/usr/lib/libp/libc.a
/usr/lib/libsocket.a
/usr/lib/libsocket.so.1
/usr/lib/libthread.so.1
/usr/lib/libthread_db.so.0
/usr/lib/pics/libc_pic.a
/usr/lib/security/unix_scheme.so.1
/usr/lib/utmp_update
/usr/ucblib/libucb.a
/usr/ucblib/libucb.so.1
/usr/sbin/in.ftpd
/usr/sbin/in.telnetd
/usr/sbin/in.rlogind
/usr/sbin/init

Problem Description:

1242481 panic: ufs_putapage: bn == UFS_HOLE
1238343 hang after installing T101945-37
1241611 Machine panics with page_vpsub
1232869 paging thresholds are too low on very big systems causing kmem alloc failures
1240151 sockmod corrupts unix socket list due to 2 binds on same socket at same time
1198966 Buggy streams programming causes panic
1244917 syslog(3) does not correctly cache the file descriptor that it writes on

(from 101946-34)

1233719 system hangs due to idle_q > maxninode and IREF set in head inode of
ufs_idle_q
1236149 connect() on AF_UNIX/SOCK_STREAM sockets hangs on Solaris x86 platform
1231997 f77 REWIND makes error : "eor/uio [1010] off end of record" on nfs files
1223853 TCP stream may not go away when process dies
1234879 system panic with auditd: zero divide trap when 101318-75 applied.
1229805 popen assumes maximum number of file descriptors is 256
1220995 directory blocks not counted in quotas
1218997 Simple cp/rm operations hang and cannot be killed
1197979 Recursive use of xdr_pointer could blow autofs unmount thread stack

(from 101946-33)

1232866 bogus pkt_len (short one) causes ip to panic
1229843 2.4 ufs `umount' on an errored device hangs system.
1229031 page_unlock: page not locked panic occurring when locking address space
1224089 NFS writes hang when doing copy over fddi 3.0.1
1208034 SC1000 5.4 Data fault out of tcp_rput_data null pointer under heavy load
1188307 ill_frag_timeout() panic on Intergraph machines when heavily stressed
1224148 TCP performance becomes unacceptable due to bad checksums generated by 2
.4
1189967 real-time latency limits exceeded occasionally
1231871 cpu_surrender doesn't check for threads waiting on kp queue

(from 101946-32)

1221608 Automounter: NIS+ Searchpath
1211172 Automountd fails to unmount lofs file system
1224737 SC2000 panics in setf() with fd >= u.u_nofiles (setf called by lockd)
1220400 lofs becomes confused about where the present working directory "."
is
1210355 TCP goes into "throttled receive" mode when using multithread
1222902 panic in tcp_xmit_ctl because referencing through the wrong mblk.
1217941 Data fault from cron in anon_getpage
1208053 Implementation of LC_* and other environment variables causes security problem.
1222599 pullupmsg() can corrupt kernel memory and hang CPUs
1214320 lwp_cond_wait() syscall returns to user holding a kernel mutex
1205731 mktime malfunction
1222086 file server hangs when many users exceed quotas
1213782 informix server hangs in getmsg()
1174685 Performance tuning parameters have no effect on x86 machines
1235099 Using sigprof and libaio will cause program to segfault.

(from 101946-31)

1231720 back out the patch for 1176618; it broke the 101945-35 kernel jumbo patch
1227426 system hung while doing dlm related activities

(from 101946-30)

1220257 Syslog(3) possibly can be abused to gain root access on Solaris 2.x
systems
1210314 ufs_bmap complains about about user level errors
1206642 utmp_update can be used to make bugus entries in utmp
1219766 recv() returns 0 bytes if you close socket too quickly after doing a send()
1209917 fddi crashes when MTU is larger than 4352
1197646 mktime() can not handle negative tm_isdst across year boundary
1217220 BSD sockets make SVR4 programs hang
1209687 Panic from audit_thread_free with saved path not empy
1180819 out of per-user processes message should include uid of offending user
1199124 out of per-user processes warning message should not be kern.crit
1219020 any user can hang the system with fork(); only recourse is rebooting
1224074 Sybase OpenServer client application hangs with 101945-32 or -34
1216540 potential deadlock when process auditing is enabled
1209012 hard hang in findmod: The code in the while goes round and round and round ...
1176618 prog dumps core if you printf very large string 37000
1222780 bug in ftpd that can cause it to dump core.
1211904 sc1000 running solaris 2.4 and FDDi 3.0.1 panics with "UIOSTR: strgetmsg ..."
1217050 system panics with strread: STRUIO
1208241 core dumps generated by set-uid executables possibly reveal data
1175668 automountd consumes all cpu time and loops when cd to automount directory

(from 101946-29)

1220886 patch 101945-32 breaks Informix
1221620 aioread(3) coredumps when ENOMEM is expected
1214057 crash provides open fd for /dev/mem
1213874 bug 1155298 integration port mistake affects AF_UNIX socket bind() error returns
1211278 ufs function quotadq() thrashing on a lock
1209452 When user go over quota no messages are printed to the console and messages file
1209014 uprintf can cause panic on modified OBP systems
1207954 TCP data got corrupted when using multithread libraries
1205409 sun4m intermittently goes down with PANIC: getdiskquota
1203471 Solaris does not guarantee bounded dispatch latency for RT processes
1203132 lockfs -h and umount of the UFS lying under a loopback file system causes panic
1200224 unreferenced vnodes may persist in active locks table when lockd dies
1193448 autofs unnecessarily blocks requests on already mounted filesystems
1183662 Search for lofs to unmount should stop on first match
1193066 system hangs due to deadlock between u_flock and pidlock
1191422 read on af_unix socket returns 0 when other end does a write(len = 0)
1186569 2.4FCS x86 threads causing a program to crash with SEGV
1207277 x86 threaded app SIGSEGVs when an LWP or bound thread exits
1214043 Makefile.master has wrong RELEASE info in /ws/on494-patch
1186420 in.ftpd does not call sa_auth_acctmg and thus ignores password aging, etc.
1186287 an unprivileged user can use utmp_update to clear entries from /var/adm/utmp
1184256 data fault in freeproc() caused by race with cfork()
1184134 dlmd needs to pop timod, once TCP problems resolved
1179311 1000's of zombie processes which kill further attempts to login to system.
1175356 automounter fails to remount unmounted directories
1175127 2.3 tcp performance over satellite/delayed links is very poor compared to 4.1.3

(from 101946-28)

1211022 after installing T101945-30 you cant login to a dataless client
1207669	NFS writes can fail and no error is ever returned, even to fsync or close.
1207181 kmem_cache_xxxx panics with nfs file systems.
1206598 "Cannot reset access time of file at inode x" messages during backup
1206384 fscanf function failed with EUC character
1205240 Mounts of secure file systems fail at random
1199624 queuerun indirectly causes fork() call to hang
1197708 data fault panic in sockmod
1192309 machine panics with audit_finish: residue audit record

(from 101946-27)

1204479 sprintf format "%.4S" prints improperly when strings include 0216 or 0217
1202070 one residual stop-the-clock-and-hang-the-system bug in /proc
1201926 strrput is calling queuerun() this may lead to a dead lock.
1200502 fopen() and unlink() makes a corrupt file on multi cpu machine.
1194613 getdate() bug under Solaris 2.4 .
1182105 libaio and libthread are not compatible
1199164 process won't exit due to non-zero refcount
1180578 PPP stops working after system is installed with 101318-63
1179884 Non-blocking socket connection over x25 would hang the system.
1164319 sc2000 panic with sema_v turnstile corruption -

(from 101946-26)

1178889 TCP doesn't close down properly across the loopback interface
1189592 Infinite loop in TCP
1186156 keyserv caches old private key after user's password is changed
1194878 ioctl with TCGETA doesn't work with libsocket

(from 101946-25)

1199579 flow controlled send does not generate SIGPOLL
1195432 Panic with a data fault from in.telnetd
1182509 FTP transfer hangs

(from 101946-24)

1195436 With patch T101945-20 /.profile is not executed
1194928 System paniced when shutting down. Data fault panic in canputnext.
1194355 tcp server detects checksum error and loops
1193721 data fault in putq() due to NULL q_last pointer
1189389 machine panics with a data fault in mutex enter
1182158 Some cmds (ls, pwd) will hang when executed on nfs mounted directories.
1193696 kernel memory allocator: invalid free: buffer not in cache kmem_alloc_1152
1186805 other [] too many write error and EDQUOT messages from nfs to syslog
1191078 Machine hangs with many proc's in rmalloc_wait - memory leak
1178641 NFS client should fail to open files with the mandlock bit set
1175931 nfs loops on async write errors
1198278 ksh loops in kernel making NFS read calls on its history file.
1180414 streams allocb failure results in data corruption
1162834 deadlock between prioctl() and munmap()
1177469 /proc causes page deadlock in NFS
1182597 swapped out lwp->lwp_ar0 in prgetprregs causes data fault and hang
1187536 Deadlock using /proc
1188701 assertion failed: new_state != LMS_WAIT_CPU
1189271 procfs: run-on-last-close doesn't always work
1192982 deadlock condition detected: cycle in blocking chain
1198439 procfs is out-of-spec with respect to microstate accounting
1145457 ksh does not set the correct arguments for su -

(from 101946-23)

1195437 Panic in ip layer (icmp_inbound_error missing pullupmsg)
1124354 Scorpion and Gal-Ross panics on Scheduler stress test

(from 101946-22)

1187901 Process hung in nanosleep
1185149 nl_langinfo is not MT-safe

(from 101946-21)

1192238 "noac" mount option not honored immediately after mount
1172926 application hangs on a TCP connection if the remote system dies
1130791 2.x setsockopt SO_SNDBUF fails with protocol error for stream AF_UNIX domain

(from 101946-20)

1189968 Need strict multihoming in IP to prevent breakins over the Internet 
1188475 pentium fp work-around
1187948 machine is hung because a thread is looping in connopen() (no-25

(from 101946-19)

1191457 DROPEN failed executing Fortran program

(from 101946-18)

1188259 ls -a .. causes Data fault panic after lockfs -h and umount the file system
1182051 sched: Text fault while telnet test
1173309 system panics with assertion failed: tcp->tcp_rcv_head == NULL
1164519 Socket returns with "address already in use" because conn in "BOUND" state

(from 101946-17)

1188287 NFS mounted files get truncated
1177228 Data fault in freeb routine while running sundiag
1165675 rquotad returns inappropriate error on nfs client

This fix includes a modified sys/errno.h which introduces a
new error number: EDQUOT (49). When an over-quota condition
is encountered, the following filesystem-related system calls
will fail and the errno will be set to EDQUOT. Previously,
the errno was set to ENOSPC.

The affected system calls are: creat(2), link(2), mkdir(2),
mknod(2), open(2), rename(2), symlink(2), and write(2)

Any applications that check for an over-quota condition
during a failed system call may encounter EDQUOT (49) as
a valid value for errno.

(from 101946-16)

1155298 bind of AF_UNIX address simultaneously from multiple processes can fail
1143479 setuid/setgid program takes on default system limits

(from 101946-15)

1186557 pid_ref field wraps around manifests as kmem list corruption.
1186224 socket select hangs in NON-BLOCKED mode
1178506 INN wounded after upgrade to SunOS 5.4
1181009 setsockopt returns error when expanding max receive size to 20KB (AF_UNIX)
1169775 Solaris 2.X does not correctly handle Copy-On-Write faults on a page

(from 101946-14)

1175368	SECURITY anyone can gain root access to a 2.4 machine

(from 101946-13)

1183568 NFS client get old data after file on server being updated

(from 101946-12)

1183395 strategy: x86 System hangs when lomemalloc fails
1178114 ioctl SIOCSPGRP/FIOSETOWN path broken for MT libsocket(linked to libthread) code
1171008 Mux hangs when expecting messages on lower stream during I_LINK/UNLINK
1159986 lckpwdf causes passwd to crash

(from 101946-11)

1177600 No way to cache the root and /usr file systems with CacheFS

(from 101946-10)

1178957 sigurg not delivered on second oob data arrival
1164800 panic: ddi_setcallback: no callback structures

(from 101946-09)

1178835 RCS operations fail on file system NFS mounted from AIX system

The problem happens when application do fchmod between writes (which is very
rare) which has a chance to lead different views of the file attributes on
client from that on server. The solution purges the client cache before doing
setattr so that the views will be the same.

(from 101946-08)

1178641 NFS client should fail to open files with the mandlock bit set
1175478 Panic in prototype inkernel logdmuxunlink() after munlink failed
1178236 System panics with data fault in free_zero_zero()
1175115 nfs write error "(file handle: xxx xxx" message cannot be redirected by syslog

The problem occurs when nfs encounters write errors. NFS will print a write
error to the console. In some cases the physical console is printed upon in
the event that the console driver is deprived or resources. What has been done
is to put a throttle on NFS write error messages, enabling the administrator to
type on the console and try to figure out what is going on.

Socket interface networking programs under heavy use may panic the
machine with free_zero_zero() on the kernel call stack. This fixes
the problem in the sockmod module.

I_UNLINK or I_PUNLINK commands may time out and close the stream before
the multiplexor has processed the command.

The NFS server will deny access to mandatory lock files.  This is done
for two reasons.  First, mandatory locking is not supported over NFS.
Second, it is dangerous for the server to access mandatory lock files.
It would be very easy for a normal user to completely hang the NFS
server.  The user could create a file and set the mode to indicate
that it is a mandatory lock file.  It could then lock the file with
a program which then just does a pause.  This user could then go to
an NFS client and try to access the file.  With each request from the
client, including retries, another NFS server daemon on the server
would get blocked, until the server ran out of NFS server daemons.

(from 101946-07)

1177091 prgetstatus can generate pagefault holding p_lock, can deadlock
if freemem is 0
1177578 strmakemsg/strgeterr causes panic in strrput due to NULL mblk ptr
1176467 fcntl system call fails in process run by rcmd
1172243 Customer runs application from dumb terminal and system crashes.

The system can freeze under heavy swapping pressure
due to procfs holding a critical lock when it takes
a page fault.

Doing I_SETSIG on a console window through serial line and exiting the process could cause a system panic.

Kernel panic in putnext/ptcwrite.

A socket endpoint not created through the socket library (by dup()
of a socket endpoint for example) may experience some failures
on fcntl()/ioctl() calls. (This bug is only limited to 2.4 release)

(from 101946-06)

1177572 installing Solaris 2.4 ON patch 101945-05 and running OW causes machine to panic

The patch to bug ID 1151364 broke OW's consolidation. This happened
bacause releasef() changed to have an extra argument. OW shouldn't
have been dependent on releasef() which is private to the ON
consolidation. Since this problem was not discovered until after
the patch was made, it made more sense for ON to produce a new
patch which restores releasef() to have its old interface. The
interface changed for kaio. A new interface is added called areleasef()
which is only used by kaio.

(from 101946-05)

1174830 savecore on diskless machine didn't generate unix, vmcore is trash
1151364 asynchronous I/O in the user level hurts RDBMS performance 

This is a performance improvement for applications that are using libaio
for doing async IO to raw files or devices. There are no API changes, only
a new version of libaio.so.1 is installed. One side benefit of this fix
is that async IO to tape should now work.  This patch to bug 1151364
requires installation of libaio/kaio patch 102021-01 or later)

Kernel crash dumps generated on diskless sun4m, sun4d or i86pc systems are
not complete.

(from 101946-04)

1172243 Customer runs application from dumb terminal and system crashes
1169686 4.1.3 system on network goes down, hangs 2.3 system

The problem shows up when a "ps" thread is running through the virtual memory
area to get the address space size for a mapped file. The address space lock is
held and a get attributes function is called. This initiates an nfs get 
attribute request. If the machine that the request is made to is not responding
the nfs request will block. The address space lock which is held by the blocked
ps thread might block other processes on the local machine.

Typically when a server goes down all nfs file system activity is blocked
on any clients. The nfs operation resumes once the server comes up. In this
situation a server is powered down and causes a client to hang. The hang is
due to a process pile-up. The client is doing a ps and its thread is holding
the address space lock (as_lock) for a running process lets call A. The A
process is a mapped file from the server. The client ps thread path has reached
rm_assize() which needs to get the file size so it calls VOP_GETATTR()
which goes across the wire to the server. This operation goes nowhere because
the server is not running. The as_lock held by the ps process is blocking
other processes such as init.

The solution is not to go over the wire but to return a cached entry for the
file size. The change is to define a new attribute flag in vnode.h called
ATTR_HINT. The rm_assize() function recognizes will use this flag when it
calls VOP_GETATTR(). The nfs getattr function will see that the size of the
file is requested and that the passed in flag is ATTR_HINT. It will return the
file size from the rnode rather than make a request to the server.

Typically when a server goes down all nfs file system activity is blocked
on any clients. The nfs operation resumes once the server comes up. In this
situation a server is powered down and causes a client to hang. The hang is
due to a process pile-up. The client is doing a ps and its thread is holding
the address space lock (as_lock) for a running process lets call A. The A
process is a mapped file from the server. The client ps thread path has reached
rm_assize() which needs to get the file size so it calls VOP_GETATTR()
which goes across the wire to the server. This operation goes nowhere because
the server is not running. The as_lock held by the ps process is blocking
other processes such as init.

The solution is not to go over the wire but to return a cached entry for the
file size. The change is to define a new attribute flag in vnode.h called
ATTR_HINT. The rm_assize() function recognizes will use this flag when it
calls VOP_GETATTR(). The nfs getattr function will see that the size of the
file is requested and that the passed in flag is ATTR_HINT. It will return the
file size from the rnode rather than make a request to the server.

Running applications that do I_SETSIG on console, when console
is the serial port (i.e not the frame buffer), causes system
to crash, when attempting to send signal to a process.

(from 101946-03)

1169909 Running xlib code in Realtime class causes code to block. in poll()
1167235 panic data fault in strioctl - apparently doing TIOCSPGRP

Protect with mutex the testing and setting of the session and controlling
terminal related flags in the streamhead. 

Real time stream threads will block in a poll.

(from 101946-02)

1172979 spurious SIGALRM received in test program that forks child processes
1172009 recv() on sockets should return the error only once for SunOS 4.X compatibility
1165687 non-blocking reads on sockets block under Solaris 2.3
1160112 socket library accidentally closes file descriptor on error
1120225 recv() returns EPIPE when called with MSG_PEEK
1152710 socket lib in 2.3/2.2 have problems with not clearing bad connections and errno
1171478 socket recv() calls fail with EINVAL due to bad fix in 494

AF_UNIX and AF_INET sockets can sometimes get EPIPE errors for recv(MSG_PEEK).
When the socket library sees the EPIPE error it will in some cases close
the file descriptor causing the application to get EBADF errors for subsequent
operations.

A AF_UNIX listening socket can get into a permanent error state 
(returning EPIPE or ECONNRESET) for any operation until the socket is closed.

The non-blocking attribute of a socket endpoint is not transferred
from a non-blocking listener endpoint to a accepting endpoint.
This causes some socket non-blocking programs to block. This
patch fixes the problem by setting the accepting endpoint non-blocking
attribute if the listener was non-blocking.

In SunOS 4.X sockets when a read() or recv*() call returns an error the 
application can do another read()/recv*() and get an EOF. This patch applies 
this subtle aspect of socket semantics to SunOS 5.X.

This specification of signal actions from the signal(5)
manual page was being violated:

                Setting  a  signal action to SIG_IGN for a signal
     that is pending causes the pending signal to  be  discarded,
     whether or not it is blocked.  Any queued values pending are
     also discarded, and the resources used  to  queue  them  are
     released and made available to queue other signals.

The condition under which the pending signal was not being
discarded was the specific case of SIGALRM signals generated
by the setitimer(ITIMER_REAL) interface.  The malfunction
happens in a narrow race condition which will be triggered
under intensive setting of a signal handler and setting it
to SIG_IGN while the itimer is active.

(from 101946-01)

1173969 MT process doesn't stop on multi processor systems

dbx appears to malfunction when controlling a multithreaded
process that does many fork1()s.  The bug is in the system, not dbx.

Also, stopping dbx with a jobcontrol signal from the terminal, ^Z,
while it is controlling a multithreaded process will cause the
multithreaded process to becomed permanently stopped.

(from 101903-01)

1172542 gettimeofday() returns negative nanosecond value on x86
1171939 Process dump core at random  on loaded systems
1169791 processes often getting killed with SIGABRT and  core dumped on MP IntelExpress

gettimeofday() call can return negative nsec value at times.
Processes can dump core on heavily loaded systems.

(from 101919-01)

1157053 System panics when doing a copy to NFS file system mounted across FDDI-S

Cause of problem is due to non-aligned transfers.  The memory address alignment trap happened in xdr_writeargs() when copying data in a loop. The address was not on a long word boundary, it was on a word boundary. nfs_feedback() can adjust the transfer address and size for a request such as for a retransmission. The xdr_writeargs() can make use of bcopy(). The xdr_writeargs() is in file nfs_xdr.c. There are a few other functions in this file that do a similar copy operation that should be changed to use bcopy.

(from 101976-01)

1173301

Files can sometimes be missing from a cachefs mounted directory.  This
can happen if the entry in question is the last one in the directory
block, but would be the first one in the cachefs front file. If a
client system runs touch on this file, it will erase the contents of
the file on the server.

(from 101970-07)

1182458 network interface can hang on NFS server with high ipReasmDuplicates counts

(from 101970-06)

1178985 Multicast routing broken in Solaris 2.4
1179625 freeb(): bad pointer passed to kmem_cache_free

A performance problem with T101969-05 will be seen in TCP/IP
network connections over high bandwidth network interfaces (FDDI,
ATM, 100Base-T, but not 10Base-T EtherNet) resulting in lower
then expected throughput. There is no impact on TCP/IP functionality.

IP Multicast routing does not work correctly in 2.4.
The (publicly available) mrouted program does not receive any 
IGMP_HOST_MEMBERSHIP_REPORT messages due to the kernel incorrectly
thinking that these messages are malformed.

(from 101970-05)

1179625 freeb(): bad pointer passed to kmem_cache_free

Kernel PANIC in freeb(), from freemsg(), from tcp_closei(), ... may be caused by TCP freemsg()ing an already freed mblk. This bug was introduced in a bug fix for 1167357.

(from 101970-04)

1178391 system with PPP device using the same IP address as le0 will stop working
1178400 NFS copies btw 690MP(512) server and Sunos 4.1.3 corrupt data without any error

MPs can transmit IP packets with the same ip_id field potentially causing
fragmented packets to be reassembled incorrectly. Normally this is not
a problem since the corruption will be detected by the UDP/TCP checksum.
However, SunOS 4.X does not by default verify the UDP checksum in which case
the incorrectly reassembled packets can cause NFS file corruption.

When an IP address is shared between an ethernet and a point-to-point links
and if the links go down and point-to-point links comes up first,  the ethernet
link will not be able to come up with the shared IP address..

(from 101970-03)

1172731 After PPP connects improper routing entries cause problems

When an IP address is shared between a POINT-TO_POINT interface and a numbered
interface can result in invalid routing entries.

(from 101970-02)

1174786 Unnumbered interfaces with respect to PPP have problems
1174851 SC2000 hang due to no ip clow control when used with FDDI board

When a high bandwith network interface is receiving a large number of packets addressed to it, but with no one bound to the specified port, then IP does a lot of processing. IP sends an ICMP unreachable packet back to the source of the original packet. This can cause large amounts of kmem to be consumed, which can cause subsequent kmem_alloc() failures, including allocb() failures in the driver for the high bandwidth interface driver. This can cause subsequent fragments of large IP frames to be dropped by the driver.  IP will then hold on to these incomplete frames awaiting the arival of the missing fragments which will never show up, IP holds on to these frames for 60 seconds. Which in the case of a NPI FDDI interface at 80Mb/S can be 300Mbyte of kmem.

When a point-to-point interface shares an ip address with a numbered interface,
point-to-point link will stop receiving packets if the numbered interface is
shutdown.

(from 101970-01)

1162269 all net IP broadcast packets (255.255.255.255) have a ttl of 1

Applications and environments that depend on routers forwarding broadcast
packets might run into problems with the fact that IP sets the TTL of
all broadcast packets to 1 (in order to avoid any broadcast storms when
there are misconfigured machines on the wire). This patch makes it possible
to override the default TTL of 1.

(from 101972-01)

1172260 5.4 <-> 4.1.2 socket connection looses sync and delays transfer of data

A TCP connection might not start immediately when a window update is
received after the Solaris 5.4 side has sent a zero window probe.

With some TCP implementations at the remote end there will be a few seconds 
of delay (waiting for a retransmit timeout).

(from 101982-02)

1179738 Users with 8 characters name or more will not be logged into utmp

(from 101982-01)

1173212 SECURITY: su can display root password in the console

If a username is too long (greater than 8 characters), when su root fails or succeeds for that user, the characters typed in as the password are echoed to the console.

(from 102170-01)

1178761 ufs_putapage:bn == UFS_HOLE panic when filesystem fills up

A corrupt inode can be created when extending a UFS file and running
out of space.  This can later cause a panic 'ufs_putapage: bn==UFS_HOLE'.

(from 102927-01)

1178824 When catman is invoked on a system w/BSM & 101318-54 the system crashes

(from 102120-01)

1163335 SS1000 interactive performance very poor with > 200 users logged in

Traditional BSD-derived systems require per-character processing to be handled
by the rlogin and telnet daemons.  This is very inefficient, since it often
requires several user level context switches per input character.  This patch
provides a "fast path" entirely in the kernel, which eliminates the added
overhead of processing by a user-level daemon for normal data traffic.

(from 102021-04)

1195904 usr/src/uts/common/sys/Makefile missing ascii.h

(from 102021-03)

1185775 KAIO thorttling too conservative, Sybase cannot install on low memory machines

(from 102021-02)

1151364 asynchronous I/O in the user level hurts RDBMS performance

This patch provides the complete set of deliverables to fix
1151364.

(from 102021-01)

1151364 asynchronous I/O in the user level hurts RDBMS performance

This is a performance improvement for applications that are using libaio
for doing async IO to raw files or devices. There are no API changes, only
a new version of libaio.so.1 is installed. One side benefit of this fix
is that async IO to tape should now work.

(from 101984-09)

1202675 automountd can dump core due to double endnetconfig() call

(from 101984-08)

1181201 port option does not work with autofs.

(from 101984-07)

1181259 NFS mount fails with: couldnt bind to reserved port

(from 101984-06)

1176508 panic mutex adaptive exit under 2.4 fcs when accessing directory over nfs.
1172998 x86: auto_lookup(): assertion failure in mutex_exit() on non-existent fs

(from 101984-05)

1182492 autmountd's macro_expand function may cause buffer to overflow

(from 101984-04)

1159330 automountd unmounts the wrong lofs

(from 101984-03)

1174913 autofs checking for local subnets doesn't work when NIS+ is the
nameservice

This patch is to fix bug 1174913: autofs checking for local subnets doesn't
work when NIS+ is the nameservice. The problem is that when a mount takes
place ,its not giving a preference to the interface that the client machine
is sitting on. It should be mounting from the servers interface that the
client machine is attached to first and then an alternate if that does not
respond. This is because that the automounter is looking up the table netmask
while it should be looking up the table netmasks.

(from 101984-02)

1151509 automounter's built in timeout is too short for low speed lines

automountd by default only waits 15 seconds for servers to
reply to its initial connection requests. This timeout may be too
short for slow links or for very busy servers. This patch allows the
system administrator to tune the total timeout by specifying the
number of attempts (original + retries). This is done by adding a
retry=n entry to the options list for the busy server entry in the
automounter map. The default is one attempt (retry=0), when no
retry=n option is specified in the options field, or when the
retry=n option is invalid. Each retry is equivalent to approximately
30 seconds.

Since automountd is currently single-threaded, this option should be
used with care, as it will cause automountd to take more time to decide
whether a server is dead or not (reply received or not), causing incoming
autofs kernel requests to be queued for longer periods of time.

For example, the following /etc/auto_home map uses the retry=1 option
to force automountd to send the original request, and retry it once more,
before giving up with a "server not responding error". If the reply is
received before the next retry, there will be no retransmission.

NOTE: It is not recommended to set this option as the map default, since
      it will cause automountd to needlessly wait longer for replies from
      real dead servers which otherwise would have replied without the
      need for retries had they been up.

        /etc/auto_home:

# Home directory map for automounter
#
userx   -nosuid,hard,intr,retry=1       busy_server:/export/home/userx
+auto_home

(from 101984-01)

1174222 automounter does not mount from 4.1.3 NFS servers with libc patch

automountd first makes a null RPC call to the remote portmapper (rpcbind) 
of the server from which it needs to mount to determine if the server 
is able to respond to mount requests or not. In some cases (multiple
servers specified on map entry) it would call the remote portmapper using
version 3, which is not available on non SVR4 systems. Some systems are
now silent about version mismatches, which causes automountd to assume
the server is dead (or at least it's rpcbind/portmapper). This patch fixes
this problem by always using version 2 of the portmapper protocol.

(from 102008-02)

1184991 2.3/2.4 - panics in tmpnode_hold - data fault - TMPFS

(from 102008-01)

1175304 vnode v_count is not maintained correctly

vnode v_count numbers are not maintained correctly causing vnodes to
never disappear or, in the earliest bug, drop to zero prematurely and
panic the system.

(from 102225-04)

1192162 programs using cond_timedwait eventually hang
1187322 cannot thr_continue the "main" thread of execution after a call to thr_suspend

(from 102225-03)

1188399 sema_init with USYNC_PROCESS does not work properly

(from 102225-02)

1188790 cond_timedwait occaisonally returns incorrectly
1186569 2.4FCS x86 threads causing a program to crash with SEGV

(from 102225-01)

1178898

(from 102359-01)

1183552 ftpd processes hang at httpd (WWW server) sitesq

Patch Installation Instructions:
--------------------------------
Refer to the Install.info file within the patch for instructions on
using the generic 'installpatch' and 'backoutpatch' scripts provided
with each patch. Any other special or non-generic installation
instructions should be described below.

Special Install Instructions:

-----------------------------

1) Stop automountd
# /etc/init.d/autofs stop

2) Install patch

3) Edit the necessary entries on your automounter maps
   (add the retry=n option).

4) Restart automountd
# /etc/init.d/autofs start

Reboot system after patch installation.
