illumos gate

In a case the clnt_max_conns (an illumos tunable) is changed between lines 1908 and 1919 in connmgr_get here:

1908        if (i > clnt_max_conns) {
1909            RPCLOG(8, "connmgr_get: too many conns, dooming entry" 
1910                " %p\\n", (void *)lru_entry->x_tiptr);
1911            lru_entry->x_doomed = TRUE;
1912            goto use_new_conn;
1913        }
1914
1915        /*
1916         * If we are at the maximum number of connections to
1917         * the server, hand back the least recently used one.
1918         */
1919        if (i == clnt_max_conns) {

we could get more TCP connections than clnt_max_conns (the old one, or new one).

Scenario:

• Assume clnt_max_conns is X before line 1908.
• Assume i is X at line 1908.
• The condition at 1908 is not met, so we will continue at line 1914.
• Now somebody changes (in mdb, for example) clnt_max_conns to Y while Y < X.
• The condition at 1919 is not met too since X != Y, so a new connection is created. We will have X + 1 connections now.

To fix the issue the condition at line 1919 should be changed to:

if (i >= clnt_max_conns) {