erts: Patch 1113

    OTP-8475  Driver threads, such as async threads, using port data locks
              peeked at the port status field without proper locking when
              looking up the driver queue.

    OTP-8487  A call to the BIF unregister(RegName) when a port had the
              name RegName registered in the runtime system without SMP
              support caused a runtime system crash. (Thanks to Per Hedeland
              for the bugfix and test case.)

    OTP-8591  Fix memory management bug causing crash of non-SMP emulator
              with async threads enabled. The bug did first appear in
              R13B03.

2 files changed, 45 insertions, 21 deletions

diff --git a/erts/emulator/test/driver_SUITE_data/ioq_exit_drv.c b/erts/emulator/test/driver_SUITE_data/ioq_exit_drv.c
index 2048d06123..c7a42aa687 100644
--- a/erts/emulator/test/driver_SUITE_data/ioq_exit_drv.c
+++ b/erts/emulator/test/driver_SUITE_data/ioq_exit_drv.c
@@ -1,19 +1,20 @@
-/* ``The contents of this file are subject to the Erlang Public License,
+/*
+ * %CopyrightBegin%
+ *
+ * Copyright Ericsson AB 2007-2010. All Rights Reserved.
+ *
+ * The contents of this file are subject to the Erlang Public License,
  * Version 1.1, (the "License"); you may not use this file except in
  * compliance with the License. You should have received a copy of the
  * Erlang Public License along with this software. If not, it can be
- * retrieved via the world wide web at http://www.erlang.org/.
- * 
+ * retrieved online at http://www.erlang.org/.
+ *
  * Software distributed under the License is distributed on an "AS IS"
  * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
  * the License for the specific language governing rights and limitations
  * under the License.
- * 
- * The Initial Developer of the Original Code is Ericsson Utvecklings AB.
- * Portions created by Ericsson are Copyright 1999, Ericsson Utvecklings
- * AB. All Rights Reserved.''
- * 
- *     $Id$
+ *
+ * %CopyrightEnd%
  */
 
 /*
@@ -77,6 +78,7 @@ typedef struct {
     int ofd;
     int outstanding_async_task;
     long async_task;
+    ErlDrvPDL pdl;
 #ifdef HAVE_POLL_H
     struct erl_drv_event_data event_data;
 #endif
@@ -144,6 +146,7 @@ start(ErlDrvPort port, char *command)
     ddp->ofd = -1;
     ddp->outstanding_async_task = 0;
     ddp->async_task = -1;
+    ddp->pdl = driver_pdl_create(port);
 #ifdef HAVE_POLL_H
     ddp->event_data.events = (short) 0;
     ddp->event_data.revents = (short) 0;
@@ -217,8 +220,9 @@ static int control(ErlDrvData drv_data,
 	res_str = "error: command not supported";
 	goto done;
     }
-
+    driver_pdl_lock(ddp->pdl);
     driver_enq(ddp->port, "!", 1);
+    driver_pdl_unlock(ddp->pdl);
     ddp->test = (IOQExitTest) command;
     res_str = "ok";
 
@@ -333,8 +337,11 @@ static void ready_input(ErlDrvData drv_data, ErlDrvEvent event)
 	ddp->ifd = -1;
 	if (ddp->test == IOQ_EXIT_READY_INPUT_ASYNC)
 	    do_driver_async(ddp);
-	else
+	else {
+	    driver_pdl_lock(ddp->pdl);
 	    driver_deq(ddp->port, 1);
+	    driver_pdl_unlock(ddp->pdl);
+	}
     }
 #endif
 }
@@ -352,8 +359,11 @@ static void ready_output(ErlDrvData drv_data, ErlDrvEvent event)
 	ddp->ofd = -1;
 	if (ddp->test == IOQ_EXIT_READY_OUTPUT_ASYNC)
 	    do_driver_async(ddp);
-	else
+	else {
+	    driver_pdl_lock(ddp->pdl);
 	    driver_deq(ddp->port, 1);
+	    driver_pdl_unlock(ddp->pdl);
+	}
     }
 #endif
 }
@@ -366,8 +376,11 @@ static void timeout(ErlDrvData drv_data)
 
     if (ddp->test == IOQ_EXIT_TIMEOUT_ASYNC)
 	do_driver_async(ddp);
-    else
+    else {
+	driver_pdl_lock(ddp->pdl);
 	driver_deq(ddp->port, 1);
+	driver_pdl_unlock(ddp->pdl);
+    }
 }
 
 static void ready_async(ErlDrvData drv_data, ErlDrvThreadData thread_data)
@@ -377,7 +390,9 @@ static void ready_async(ErlDrvData drv_data, ErlDrvThreadData thread_data)
     PRINTF(("ready_async(%p, %p) called\r\n", drv_data, thread_data));
 
     if (drv_data == (ErlDrvData) thread_data) {
+	driver_pdl_lock(ddp->pdl);
 	driver_deq(ddp->port, 1);
+	driver_pdl_unlock(ddp->pdl);
 	ddp->outstanding_async_task = 0;
     }
 }
@@ -397,8 +412,11 @@ static void event(ErlDrvData drv_data,
 	ddp->ofd = -1;
 	if (ddp->test == IOQ_EXIT_EVENT_ASYNC)
 	    do_driver_async(ddp);
-	else
+	else {
+	    driver_pdl_lock(ddp->pdl);
 	    driver_deq(ddp->port, 1);
+	    driver_pdl_unlock(ddp->pdl);
+	}
     }
 #endif
 }
diff --git a/erts/emulator/test/port_SUITE.erl b/erts/emulator/test/port_SUITE.erl
index 9a09d20eab..b9100738e4 100644
--- a/erts/emulator/test/port_SUITE.erl
+++ b/erts/emulator/test/port_SUITE.erl
@@ -1,19 +1,19 @@
 %%
 %% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 1997-2009. All Rights Reserved.
-%% 
+%%
+%% Copyright Ericsson AB 1997-2010. All Rights Reserved.
+%%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
 %% compliance with the License. You should have received a copy of the
 %% Erlang Public License along with this software. If not, it can be
 %% retrieved online at http://www.erlang.org/.
-%% 
+%%
 %% Software distributed under the License is distributed on an "AS IS"
 %% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 %% the License for the specific language governing rights and limitations
 %% under the License.
-%% 
+%%
 %% %CopyrightEnd%
 %%
 
@@ -88,7 +88,8 @@
 	 otp_3906/1, otp_4389/1, win_massive/1, win_massive_client/1,
 	 mix_up_ports/1, otp_5112/1, otp_5119/1, otp_6224/1,
 	 exit_status_multi_scheduling_block/1, ports/1,
-	 spawn_driver/1,spawn_executable/1]).
+	 spawn_driver/1,spawn_executable/1,
+	 unregister_name/1]).
 
 -export([]).
 
@@ -112,7 +113,8 @@ all(suite) ->
      otp_3906, otp_4389, win_massive, mix_up_ports,
      otp_5112, otp_5119,
      exit_status_multi_scheduling_block,
-     ports, spawn_driver, spawn_executable
+     ports, spawn_driver, spawn_executable,
+     unregister_name
     ].
 
 -define(DEFAULT_TIMEOUT, ?t:minutes(5)).
@@ -1434,6 +1436,10 @@ spawn_executable(Config) when is_list(Config) ->
     ?line test_server:timetrap_cancel(Dog),
     ok.
 
+unregister_name(Config) when is_list(Config) ->
+    ?line true = register(crash, open_port({spawn, "sleep 100"}, [])),
+    ?line true = unregister(crash).
+
 test_bat_file(Dir) ->
     FN = "tf.bat",
     Full = filename:join([Dir,FN]),