Part of this patch is wrong and will introduce failures. It changes the flow of control from

clean up connection data structure
if connection input buffer size is over a threshold, free the conn structure
else add it to the freelist

to

clean up connection data structure
add connection to the freelist
if connection input buffer size is over a threshold, free the conn structure

The problem is that if the buffer size is large, the freelist now contains a pointer to freed memory which will doubtless be allocated to something else at some point.

The other part of the patch (allocating a msghdr if needed) seems harmless to me. I haven't seen the failure mode it's apparently intended to address -- the UDP protocol is running fine on our network, processing billions of requests a day with no crashes or bogus responses -- but it doesn't seem like it can hurt anything and is probably a smart sanity check.

Any chance you (or the original author) can supply a test case to demonstrate the UDP failures? I saw Tomash Brechko's translation (thanks!) but the problem description is too vague.

-Steve

Reply via email to