Patch Name: PHNE_14916 Patch Description: s700 10.20 cumulative ARPA Transport patch Creation Date: 98/04/22 Post Date: 98/05/05 Hardware Platforms - OS Releases: s700: 10.20 Products: N/A Filesets: OS-Core.CORE-KRN Networking.NET-KRN Automatic Reboot?: Yes Status: General Superseded Critical: Yes PHNE_14916: PANIC PHNE_14504: PANIC PHNE_13469: PANIC PHNE_13289: PANIC PHNE_13245: PANIC PHNE_12407: PANIC PHNE_11530: PANIC PHNE_9106: PANIC PHNE_9098: PANIC PHNE_9036: PANIC Path Name: /hp-ux_patches/s700/10.X/PHNE_14916 Symptoms: PHNE_14916: This patch replaces PHNE_14504. See Defect Description PHNE_14504: See Defect Description PHNE_13469: See Defect Description PHNE_13289: See Defect Description PHNE_13245: See Defect Description PHNE_12407: See Defect Description PHNE_11530: See Defect Description PHNE_9106: See Defect Description PHNE_9098: See Defect Description PHNE_9036: See Defect Description Defect Description: PHNE_14916: ( SR number: 5003294777 ) netstat -m occasionally reports unbelievable statistics, e.g.: "4294967270 mapped pages in use" ( SR not found ) HP-UX does not have token ring multicast support for drivers that support multicasting. ( SR number: 5003409268 ) UDP datagrams are occasionally being dropped on MP machines running 10.20. An inbound UDP packet which is sent to a valid local port results in the system returning an ICMP_UNREACH_PORT ICMP message. This occurs when the system is sending a UDP packet from the local port at the same time that the inbound packet arrives. ( SR number: 5003411926 ) A panic can occur in sounlock() because of a race between two processes trying to access the same AF_UNIX socket. The stack trace is: sounlock unp_connect uipc_usrreq soconnect connect syscall PHNE_14504: ( SR number: 1653232538 ) The system panics when the Service Guard application is being stopped. ( SR number: 4701371914 ) HP-UX does not have support for a socket API interface to get the TCP state. ( SR number: 5003401802 ) The mbuf offset is not word-aligned. ( SR number: 5003408328 ) A system that has packets coming in on one interface type (i.e. Ethernet) and going out on another interface type (i.e. FDDI) can panic with a message of "m_free: freeing free mbuf". The stack trace is: panic+0x10 m_free+0x28 m_freem_train+0x1c unicast_ippkt+0x71c arp_resolve+0x288 lanc_if_output+0x48 ip_output+0x60c udp_output+0x1f8 ku_sendto_mbuf+0x8c svckudp_send+0x158 svc_sendreply+0x5c svckudp_send+0x158 svc_sendreply+0x5c PHNE_13469: ( SR number: 5003366906 ) Netstat -m displays an incorrect number of socket structures. ( SR number: 1653234245 ) When Service Guard requests a switch between two interfaces and the TARGET is not available, the ifnet structures may become corrupted. The system will crash when these structures are used later. ( SR number: 1653239764 ) If there is at least one IP packet on the ipintrq, one processor on an MP machine will do nothing but run netisr. Networking may be slow or appear to not work at all. The same problem causes single-processor machines to appear to be hung, but the machines will respond to ping. Netstat will show at least one SYN_RCVD socket where the local and remote addresses and ports are the same. PHNE_13289: ( SR number: 1653227116 ) The TCP retransmission timer range is not tuneable. PHNE_13245: ( SR number: 4701350173 ) The system panics during start-up due to a lack of defensive checks in IP interrupt processing. ( SR number: 5003361691 ) Nettune cannot tune sb_max. ( SR number: 5003379529 ) A customer wants to have more available IP addresses than what RFC 1122 will allow. ( SR number: 5003384719 ) A customer is running out of outbound ports, since the system is bounded by the port numbers 1024 to 5000. ( SR number: 1653229633 ) When using Service Guard in a spanning tree environment it is possible to lose the unsoliticited ARP_REQUESTS sent out when an IP address moves from one interface to another. ( SR number: 4701345082 ) If connections in TIME_WAIT reuse the same port, the socket options will get lost. PHNE_12407: ( SR number: 5003314351 ) HP-UX does not allow different subnets for IP aliases. ( SR number: 1653163436 ) A TCP client that is connected to itself will hang the session. ( SR number: 1653204198 ) An additional urgent byte could be sent in an AF_INET/STREAM socket if the send buffer is much larger than 64K bytes. ( SR number: 1653214981 ) ip_output() is using the PMTU from the dynamic route, but TCP is not, resulting in fragmentation and sub-optimal behavior. ( SR number: 5003366898 ) Whenever the PMTU value is changed, the remote system starts logging TCP checksum errors and existing connections time out. ( SR number: 1653221549 ) A Catalyst 5000's system does not reply to an HP-UX ARP request. ( SR number: 4701362756 ) poll() is not supported on series 800 machines. ( SR number: 4701363333 ) nfsd's are hanging because they sleep until the driver or other lower layer has released the memory for the packet that was sent down. This memory is not being freed. PHNE_11530: ( SR number: 5003320655 ) The HP 9000/UX BSD ARP implementation causes caching of the least optimal path to a remote host on a Token Ring network among multiple possible paths through various source routing bridges. This is true for both outbound and inbound ARP resolution cases. In the case of outbound ARP resolution, after HP 9000/UX issues an ARP broadcast request to a remote host which results in multiple requests reaching to that host, it begins to receive multiple responses, and for each such response it overwrites the cache data for that host. This results in the cache having the longest path corresponding to the last response received. Similarly, in the case of inbound ARP resolution, HP 9000/UX receives multiple ARP requests over multiple paths, and with each request it updates its cache with the path over which that request was received. This results in the cache finally containing the path over which the last request was received which may be the longest path in most cases. ( SR number: 5003355875 ) In 10.X TCP MSS does not behave the same way as in 9.X even when PMTU is disabled. ( SR not found ) The system may hang due to a memory leak caused by failed setsockopt(2) calls. ( SR number: 5003372144 ) The system will panic due to a null pointer dereference during a bind(2) system call. PHNE_9106: ( SR not found ) HP-UX does not allow tuning of the TCP hash table size. ( SR number: 5003345207 ) An application that is bound to a multicast address does not receive packets sent to that multicast address. ( SR number: 1653192054 ) IBM RS/6000 systems reject our arp requests. ( SR number: 1653198069 ) The system hangs in sbdrop() during shutdown. ( SR number: 5003352872 ) An active TCP connection that receives a TCP packet from its peer with the urgent pointer pointing to a place in the stream that has not arrived yet will hang networking. ( SR not found ) HP-UX does not support IP directed broadcast forwarding. PHNE_9098: ( SR number: 5000710814 ) An ENXIO error is presently passed from the transport layer up to the application error as a "hard", or irrecoverable error. It is left up to the application to decide how to handle this situation. This is incorrect, because ENXIO is generated by the driver(s) in situations which *may* be recoverable, such as the imfamous 82596 LAN chip error. The user will see applications fail with a connection failure error which may be accompanied by a log message from the driver indicating that some sort of hardware error has occurred. ( SR number: 4701313866 ) Corrected an apparent typo where we malloc()'ed with one #define constant and free()'d with another #define constant that only differs by one letter from the first one. ( SR not found ) In a threaded environment, unp_externalize() can no longer depend on the file descriptor state being the same because another thread of the same process can change the state. ( SR number: 5003316810 ) A TCP client-server application can cause an ACK storm which will hang the system. ( SR number: 5003318543 ) A memory leak occurs when an IPPROTO_TCP setsockopt() is done on a closed socket. ( SR not found ) netstat improperly displays the interface field for clan0. ( SR not found ) HP-UX does not have protocol switch entries for Raptor. ( SR number: 1653175810 ) ICMP packets sent to 255.255.255.255 cause system hangs on UP machines and a panic on MP machines. ( SR not found ) For a SYN, when the socket is not found in the listen queue, we search the whole list. This takes too long. It causes performance degradation in netscape. The above may happen when a service is not started. ( SR number: 1653176644 ) A panic occurs when we call audit_send_dgram (). ( SR number: 5003327973 ) Data is put in the socket buffer before calling TCP to send it out. If TCP gets an error from the interface (which may be transient), TCP returns the error to the application. If the application attempts to resend the data instead of exiting, potential data corruption can occur. ( SR number: 5003326199 ) A K400 system running ServiceGuard on 10.01 panics when pinging a floating ip address of a package that is being shutdown. ( SR not found ) The code does not ensure that there is always space left for '\0' for the case when an interface's unit number > 9. ( SR not found ) The default for a listen() queue has been increased from 20 to 4K. ( SR not found ) The maximum value of 20 for a listen() queue is inadequate for many applications. ( SR not found ) HP-UX was taking an unnecessarily long time to close TCP. ( SR not found ) Using a Fibre Channel driver with Service Guard causes a memory leak resulting in a hang. ( SR number: 4701333427 ) tcp_ctloutput() may cause a panic due to inproper locking and unlocking of inp. ( SR number: 5000716316 ) The system will hang when a second connect() is called on the same socket. ( SR number: 1653182782 ) Fast retransmission is not activated after three duplicate ACKs if window scaling is on (RFC 1323). ( SR number: 4701335596 ) A syn attack can result in Denial Of Service (DOS) to legitimate users. ( SR number: 1653184861 ) Customers in 9.x can tune sb_max, but cannot do it in 10.x. ( SR not found ) Customers may find it difficult to combine routine precedence with normal delay if they only use our header files. ( SR number: 4701339044 ) A panic will occur in sounlock() when an application forks off multiple processes that call accept() on the same socket. ( SR number: 1653189852 ) A directed broadcast to a different network fails. ( SR number: 5003345215 ) Multicast addresses don't transfer over to the new interface during switchover. PHNE_9036: ( SR number: 5003342071 ) ping with illegal packets can cause panic. SR: 5000710814 4701313866 5003294777 5003316810 5003318543 5003320655 1653175810 5003314351 1653176644 5003327973 5003326199 4701333427 5000716316 1653182782 1653163436 4701335596 1653184861 5003342071 4701339044 1653189852 5003345215 5003345207 1653192054 1653198069 5003352872 4701345082 5003355875 1653204198 4701350173 1653214981 5003366906 5003372144 5003366898 5003361691 1653221549 5003379529 4701362756 4701363333 1653227116 5003384719 1653229633 1653232538 1653234245 4701371914 1653239764 5003401802 5003408328 5003409268 5003411926 Patch Files: /usr/conf/lib/libinet.a(udp_usrreq.o) /usr/conf/lib/libinet.a(tcp_usrreq.o) /usr/conf/lib/libinet.a(tcp_timer.o) /usr/conf/lib/libinet.a(tcp_subr.o) /usr/conf/lib/libinet.a(tcp_output.o) /usr/conf/lib/libinet.a(tcp_input.o) /usr/conf/lib/libhp-ux.a(nm_tune.o) /usr/conf/lib/libinet.a(ip_output.o) /usr/conf/lib/libinet.a(ip_input.o) /usr/conf/lib/libinet.a(ip_icmp.o) /usr/conf/lib/libinet.a(in_proto.o) /usr/conf/lib/libinet.a(in_pcb.o) /usr/conf/lib/libinet.a(in.o) /usr/conf/lib/libinet.a(if_ether.o) /usr/conf/lib/libnet.a(route.o) /usr/conf/lib/libuipc.a(netisr.o) /usr/conf/lib/libnet.a(if_ni.o) /usr/conf/lib/libhp-ux.a(dgram_aud.o) /usr/conf/lib/libuipc.a(sys_socket.o) /usr/conf/lib/libuipc.a(uipc_init.o) /usr/conf/lib/libuipc.a(uipc_socket2.o) /usr/conf/lib/libuipc.a(uipc_usrreq.o) /usr/conf/lib/libhp-ux.a(uipc_mbuf.o) /usr/conf/lib/libuipc.a(uipc_socket.o) /usr/conf/lib/libuipc.a(uipc_syscall.o) /usr/conf/lib/libtpiso.a(xtiso.o) what(1) Output: /usr/conf/lib/libinet.a(udp_usrreq.o): PHNE_14916 udp_usrreq.c $Revision: 1.8.112.12 $ $Dat e: 98/03/17 18:21:37 $ /usr/conf/lib/libinet.a(tcp_usrreq.o): PHNE_14916 tcp_usrreq.c $Revision: 1.10.112.11 $ $Da te: 98/01/12 18:24:30 $ /usr/conf/lib/libinet.a(tcp_timer.o): PHNE_14916 tcp_timer.c $Revision: 1.8.112.4 $ /usr/conf/lib/libinet.a(tcp_subr.o): PHNE_14916 tcp_subr.c $Revision: 1.8.112.10 $ $Date: 97/12/02 08:07:47 $ /usr/conf/lib/libinet.a(tcp_output.o): PHNE_14916 tcp_output.c $Revision: 1.6.112.5 $ $Date : 97/08/05 18:02:43 $ /usr/conf/lib/libinet.a(tcp_input.o): PHNE_14916 tcp_input.c $Revision: 1.11.112.20 $ $Dat e: 97/12/08 10:38:26 $ /usr/conf/lib/libhp-ux.a(nm_tune.o): PHNE_14916 nm_tune.c $Revision: 1.3.112.8 $ /usr/conf/lib/libinet.a(ip_output.o): PHNE_14916 ip_output.c $Revision: 1.7.112.6 $ $Date: 96/11/05 15:13:12 $ /usr/conf/lib/libinet.a(ip_input.o): PHNE_14916 ip_input.c $Revision: 1.8.112.10 $ $Date: 97/10/24 12:08:39 $ /usr/conf/lib/libinet.a(ip_icmp.o): PHNE_14916 ip_icmp.c $Revision: 1.9.112.5 $ /usr/conf/lib/libinet.a(in_proto.o): PHNE_14916 in_proto.c $Revision: 1.4.112.4 $ $Date: 96/08/19 18:40:49 $ /usr/conf/lib/libinet.a(in_pcb.o): PHNE_14916 in_pcb.c $Revision: 1.10.112.10 $ $Date: 98/03/17 18:31:06 $ /usr/conf/lib/libinet.a(in.o): PHNE_14916 in.c $Revision: 1.9.112.13 $ $Date: 97/11 /19 10:25:46 $ /usr/conf/lib/libinet.a(if_ether.o): PHNE_14916 TOKEN if_ether.c $Revision: 1.10.112.15 $ /usr/conf/lib/libnet.a(route.o): PHNE_14916 route.c $Revision: 1.8.112.8 $ /usr/conf/lib/libuipc.a(netisr.o): PHNE_14916 netisr.c $Revision: 1.12.112.8 $ /usr/conf/lib/libnet.a(if_ni.o): PHNE_14916 if_ni.c $Revision: 1.8.112.3 $ $Date: 98/ 03/27 11:50:24 $ /usr/conf/lib/libhp-ux.a(dgram_aud.o): PHNE_14916 dgram_aud.c $Revision: 1.3.112.2 $ $Date: 96/08/02 20:37:56 $ /usr/conf/lib/libuipc.a(sys_socket.o): PHNE_14916 sys_socket.c $Revision: 1.7.112.4 $ /usr/conf/lib/libuipc.a(uipc_init.o): FILESET BSDIPC-SOCKET: lib uipc: Version: A.10.00 PHNE_14916 uipc_init.c $Date: 98/04/07 22:39:36 $ $R evision: 1.7.112.2 $ /usr/conf/lib/libuipc.a(uipc_socket2.o): PHNE_14916 uipc_socket2.c $Revision: 1.10.112.9 $ $D ate: 98/03/27 13:03:49 $ /usr/conf/lib/libuipc.a(uipc_usrreq.o): PHNE_14916 uipc_usrreq.c $Revision: 1.8.112.7 $ /usr/conf/lib/libhp-ux.a(uipc_mbuf.o): PHNE_14916 uipc_mbuf.c $Revision: 1.9.112.5 $ $Date: 98/03/27 12:57:17 $ /usr/conf/lib/libuipc.a(uipc_socket.o): PHNE_14916 uipc_socket.c $Revision: 1.11.112.13 $ $D ate: 98/03/27 13:01:34 $ /usr/conf/lib/libuipc.a(uipc_syscall.o): PHNE_14916 uipc_syscall.c $Revision: 1.10.112.4 $ $D ate: 96/12/16 10:45:36 $ /usr/conf/lib/libtpiso.a(xtiso.o): PHNE_14916 xtiso.c $Revision: 1.4.112.6 $ $Date: 97/ 01/28 17:34:36 $ cksum(1) Output: 3547670444 15228 /usr/conf/lib/libinet.a(udp_usrreq.o) 861985328 11776 /usr/conf/lib/libinet.a(tcp_usrreq.o) 3540424553 13352 /usr/conf/lib/libinet.a(tcp_timer.o) 2797979438 10952 /usr/conf/lib/libinet.a(tcp_subr.o) 3704944615 7520 /usr/conf/lib/libinet.a(tcp_output.o) 1374735941 21336 /usr/conf/lib/libinet.a(tcp_input.o) 3703350811 9880 /usr/conf/lib/libhp-ux.a(nm_tune.o) 297717136 12424 /usr/conf/lib/libinet.a(ip_output.o) 1918749519 17588 /usr/conf/lib/libinet.a(ip_input.o) 362183570 7344 /usr/conf/lib/libinet.a(ip_icmp.o) 3196766821 3188 /usr/conf/lib/libinet.a(in_proto.o) 1214444352 17464 /usr/conf/lib/libinet.a(in_pcb.o) 2175295489 16364 /usr/conf/lib/libinet.a(in.o) 4224415742 47992 /usr/conf/lib/libinet.a(if_ether.o) 4248076902 17908 /usr/conf/lib/libnet.a(route.o) 2834071669 8892 /usr/conf/lib/libuipc.a(netisr.o) 1960868233 10504 /usr/conf/lib/libnet.a(if_ni.o) 3507077012 2504 /usr/conf/lib/libhp-ux.a(dgram_aud.o) 2885941061 4184 /usr/conf/lib/libuipc.a(sys_socket.o) 2901458751 4408 /usr/conf/lib/libuipc.a(uipc_init.o) 3448616439 21716 /usr/conf/lib/libuipc.a(uipc_socket2.o) 2093450226 13676 /usr/conf/lib/libuipc.a(uipc_usrreq.o) 1411374339 12692 /usr/conf/lib/libhp-ux.a(uipc_mbuf.o) 3547234510 21236 /usr/conf/lib/libuipc.a(uipc_socket.o) 1746027256 17108 /usr/conf/lib/libuipc.a(uipc_syscall.o) 1256076605 60068 /usr/conf/lib/libtpiso.a(xtiso.o) Patch Conflicts: None Patch Dependencies: None Hardware Dependencies: None Other Dependencies: None Supersedes: PHNE_9036 PHNE_9098 PHNE_9106 PHNE_11530 PHNE_12407 PHNE_13245 PHNE_13289 PHNE_13469 PHNE_14504 Equivalent Patches: None Patch Package Size: 490 KBytes Installation Instructions: Please review all instructions and the Hewlett-Packard SupportLine User Guide or your Hewlett-Packard support terms and conditions for precautions, scope of license, restrictions, and, limitation of liability and warranties, before installing this patch. ------------------------------------------------------------ 1. Back up your system before installing a patch. 2. Login as root. 3. Copy the patch to the /tmp directory. 4. Move to the /tmp directory and unshar the patch: cd /tmp sh PHNE_14916 5a. For a standalone system, run swinstall to install the patch: swinstall -x autoreboot=true -x match_target=true \ -s /tmp/PHNE_14916.depot 5b. For a homogeneous NFS Diskless cluster run swcluster on the server to install the patch on the server and the clients: swcluster -i -b This will invoke swcluster in the interactive mode and force all clients to be shut down. WARNING: All cluster clients must be shut down prior to the patch installation. Installing the patch while the clients are booted is unsupported and can lead to serious problems. The swcluster command will invoke an swinstall session in which you must specify: alternate root path - default is /export/shared_root/OS_700 source depot path - /tmp/PHNE_14916.depot To complete the installation, select the patch by choosing "Actions -> Match What Target Has" and then "Actions -> Install" from the Menubar. 5c. For a heterogeneous NFS Diskless cluster: - run swinstall on the server as in step 5a to install the patch on the cluster server. - run swcluster on the server as in step 5b to install the patch on the cluster clients. By default swinstall will archive the original software in /var/adm/sw/patch/PHNE_14916. If you do not wish to retain a copy of the original software, you can create an empty file named /var/adm/sw/patch/PATCH_NOSAVE. Warning: If this file exists when a patch is installed, the patch cannot be deinstalled. Please be careful when using this feature. It is recommended that you move the PHNE_14916.text file to /var/adm/sw/patch for future reference. To put this patch on a magnetic tape and install from the tape drive, use the command: dd if=/tmp/PHNE_14916.depot of=/dev/rmt/0m bs=2k Special Installation Instructions: None