From 6bff6df27227c12c78cafabe0dab51d2900f8fb3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Mon, 16 Sep 2024 09:10:36 +0200
Subject: [PATCH] Limit the outgoing UDP send queue size

If the operating system UDP queue gets full and the outgoing UDP sending
starts to be delayed, BIND 9 could exhibit memory spikes as it tries to
enqueue all the outgoing UDP messages.  As those are not going to be
delivered anyway (as we argued when we stopped enlarging the operating
system send and receive buffers), try to send the UDP messages directly
using `uv_udp_try_send()` and if that fails, drop the outgoing UDP
message.

(cherry picked from commit b576c4c9771e967e035e3fe761cd256a2067f754)
---
 lib/isc/netmgr/netmgr-int.h |  1 +
 lib/isc/netmgr/udp.c        | 54 ++++++++++++++++++++++++++++++++-----
 2 files changed, 49 insertions(+), 6 deletions(-)

diff --git a/lib/isc/netmgr/netmgr-int.h b/lib/isc/netmgr/netmgr-int.h
index 1b7e881b5b..d45734ecc7 100644
--- a/lib/isc/netmgr/netmgr-int.h
+++ b/lib/isc/netmgr/netmgr-int.h
@@ -60,6 +60,7 @@
  */
 #define ISC_NETMGR_UDP_RECVBUF_SIZE UINT16_MAX
 #endif
+#define ISC_NETMGR_UDP_SENDBUF_SIZE UINT16_MAX
 
 /*
  * The TCP send and receive buffers can fit one maximum sized DNS message plus
diff --git a/lib/isc/netmgr/udp.c b/lib/isc/netmgr/udp.c
index 653ef778d3..cd2d9c174a 100644
--- a/lib/isc/netmgr/udp.c
+++ b/lib/isc/netmgr/udp.c
@@ -19,6 +19,7 @@
 #include <isc/buffer.h>
 #include <isc/condition.h>
 #include <isc/errno.h>
+#include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
@@ -27,6 +28,7 @@
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/sockaddr.h>
+#include <isc/stdtime.h>
 #include <isc/thread.h>
 #include <isc/util.h>
 #include <isc/uv.h>
@@ -640,6 +642,19 @@ udp_send_cb(uv_udp_send_t *req, int status) {
 	isc__nm_sendcb(sock, uvreq, result, false);
 }
 
+static _Atomic(isc_stdtime_t) last_udpsends_log = 0;
+
+static bool
+can_log_udp_sends(void) {
+	isc_stdtime_t now = isc_stdtime_now();
+	isc_stdtime_t last = atomic_exchange_relaxed(&last_udpsends_log, now);
+	if (now != last) {
+		return (true);
+	}
+
+	return (false);
+}
+
 /*
  * Send the data in 'region' to a peer via a UDP socket. We try to find
  * a proper sibling/child socket so that we won't have to jump to
@@ -697,12 +712,39 @@ isc__nm_udp_send(isc_nmhandle_t *handle, const isc_region_t *region,
 		goto fail;
 	}
 
-	r = uv_udp_send(&uvreq->uv_req.udp_send, &sock->uv_handle.udp,
-			&uvreq->uvbuf, 1, sa, udp_send_cb);
-	if (r < 0) {
-		isc__nm_incstats(sock, STATID_SENDFAIL);
-		result = isc_uverr2result(r);
-		goto fail;
+	if (uv_udp_get_send_queue_size(&sock->uv_handle.udp) >
+	    ISC_NETMGR_UDP_SENDBUF_SIZE)
+	{
+		/*
+		 * The kernel UDP send queue is full, try sending the UDP
+		 * response synchronously instead of just failing.
+		 */
+		r = uv_udp_try_send(&sock->uv_handle.udp, &uvreq->uvbuf, 1, sa);
+		if (r < 0) {
+			if (can_log_udp_sends()) {
+				isc__netmgr_log(
+					worker->netmgr, ISC_LOG_ERROR,
+					"Sending UDP messages failed: %s",
+					isc_result_totext(isc_uverr2result(r)));
+			}
+
+			isc__nm_incstats(sock, STATID_SENDFAIL);
+			result = isc_uverr2result(r);
+			goto fail;
+		}
+
+		RUNTIME_CHECK(r == (int)region->length);
+		isc__nm_sendcb(sock, uvreq, ISC_R_SUCCESS, true);
+
+	} else {
+		/* Send the message asynchronously */
+		r = uv_udp_send(&uvreq->uv_req.udp_send, &sock->uv_handle.udp,
+				&uvreq->uvbuf, 1, sa, udp_send_cb);
+		if (r < 0) {
+			isc__nm_incstats(sock, STATID_SENDFAIL);
+			result = isc_uverr2result(r);
+			goto fail;
+		}
 	}
 	return;
 fail: