recvfrom() on raw sockets sometimes gives bad source address

[Chris Torek]

> The bug fix you suggested is close, but incorrect.

> The sbappendaddr routine free's its input chain if it is sucessful
> (returns 1) If it is unsucessful, the data chain is not freed.
> Therefore the call to m_free is not needed, and may cause panic
> freeing free mbuf.

Are we looking at the same code?

The m_free is freeing the *header*, not the *data chain*; the reason
for moving the call was that &rhp->rh_src (wonder if I remembered that
right) is right in the mbuf ``m'', so the m_free must be moved down
a bit.

That sbappendaddr returns 1 for success and 0 for failure, rathern
than 0 for success and -1 (or an error code) for failure, is another
matter entirely....
-- 
(This line accidently left nonblank.)

In-Real-Life: Chris Torek, Univ of MD Comp Sci Dept (301) 454-7690
UUCP:	{seismo,allegra,brl-bmd}!umcp-cs!chris
CSNet:	chris at umcp-cs		ARPA:	chris at maryland