Merge branch 'maint-17' into maint

8 files changed, 191 insertions, 66 deletions

diff --git a/erts/doc/src/notes.xml b/erts/doc/src/notes.xml
index c896ee0cae..af0d4d7377 100644
--- a/erts/doc/src/notes.xml
+++ b/erts/doc/src/notes.xml
@@ -30,6 +30,65 @@
   </header>
   <p>This document describes the changes made to the ERTS application.</p>
 
+<section><title>Erts 6.3.1</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    Fix getifaddrs realloc pointer error</p>
+          <p>
+	    When a buffer was exhausted and subsequently reallocated,
+	    we could get an unsafe pointer pointing to faulty memory.</p>
+          <p>
+	    For this to occur we would need to have a large number of
+	    interfaces and a reallocation of memory to a lower
+	    addresses.</p>
+          <p>
+	    The symptom would be garbage returned from
+	    erlang:port_control(Port, 25, [])
+	    (prim_inet:getifaddrs(Port) resulting in a badarg) or a
+	    segmentation fault.</p>
+          <p>
+	    Own Id: OTP-12445</p>
+        </item>
+        <item>
+          <p>
+	    Don't close all file descriptors twice in child_setup</p>
+          <p>
+	    The commit c2b4eab25c907f453a394d382c04cd04e6c06b49
+	    introduced an error in which child_setup erroneously
+	    tried to close all file descriptors twice.</p>
+          <p>
+	    Use closefrom() if available when closing all file
+	    descriptors.</p>
+          <p>
+	    The function closefrom() was only used in the vfork()
+	    case before but is now also used in the fork() case if
+	    available.</p>
+          <p>
+	    Own Id: OTP-12446</p>
+        </item>
+        <item>
+          <p>
+	    During a crashdump all file descriptors are closed to
+	    ensure the closing of the epmd port and to reserve a file
+	    descriptor for the crashdump file.</p>
+          <p>
+	    If a driver (third party library) cannot handle closing
+	    of sockets this could result in a segmentation fault in
+	    which case a crashdump would not be produced. This is now
+	    fixed by only closing inets sockets via an emergency
+	    close callback to the driver and thus closing the epmd
+	    socket.</p>
+          <p>
+	    Own Id: OTP-12447</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
 <section><title>Erts 6.3</title>
 
     <section><title>Fixed Bugs and Malfunctions</title>
diff --git a/erts/emulator/beam/erl_driver.h b/erts/emulator/beam/erl_driver.h
index f9938fc66c..e498ac70ec 100644
--- a/erts/emulator/beam/erl_driver.h
+++ b/erts/emulator/beam/erl_driver.h
@@ -133,7 +133,7 @@ typedef struct {
 
 #define ERL_DRV_EXTENDED_MARKER		(0xfeeeeeed)
 #define ERL_DRV_EXTENDED_MAJOR_VERSION	3
-#define ERL_DRV_EXTENDED_MINOR_VERSION	1
+#define ERL_DRV_EXTENDED_MINOR_VERSION	2
 
 /*
  * The emulator will refuse to load a driver with a major version
@@ -361,6 +361,9 @@ typedef struct erl_drv_entry {
     	                        /* Called on behalf of driver_select when
 				   it is safe to release 'event'. A typical
 				   unix driver would call close(event) */
+    void (*emergency_close)(ErlDrvData drv_data);
+                                /* called when the port is closed abruptly.
+				   specifically when erl_crash_dump is called. */
     /* When adding entries here, dont forget to pad in obsolete/driver.h */
 } ErlDrvEntry;
 
diff --git a/erts/emulator/beam/global.h b/erts/emulator/beam/global.h
index 891046a8b5..32a2dc43e8 100644
--- a/erts/emulator/beam/global.h
+++ b/erts/emulator/beam/global.h
@@ -160,6 +160,7 @@ struct erts_driver_t_ {
     void (*ready_async)(ErlDrvData drv_data, ErlDrvThreadData thread_data); /* Might be NULL */ 
     void (*process_exit)(ErlDrvData drv_data, ErlDrvMonitor *monitor);
     void (*stop_select)(ErlDrvEvent event, void*); /* Might be NULL */
+    void (*emergency_close)(ErlDrvData drv_data);  /* Might be NULL */
 };
 
 extern erts_driver_t *driver_list;
@@ -852,6 +853,7 @@ Uint erts_port_ioq_size(Port *pp);
 void erts_stale_drv_select(Eterm, ErlDrvPort, ErlDrvEvent, int, int);
 
 Port *erts_get_heart_port(void);
+void erts_emergency_close_ports(void);
 
 #if defined(ERTS_SMP) && defined(ERTS_ENABLE_LOCK_COUNT)
 void erts_lcnt_enable_io_lock_count(int enable);
diff --git a/erts/emulator/beam/io.c b/erts/emulator/beam/io.c
index 9ae973e108..012a7d1a4b 100644
--- a/erts/emulator/beam/io.c
+++ b/erts/emulator/beam/io.c
@@ -7349,6 +7349,8 @@ no_stop_select_callback(ErlDrvEvent event, void* private)
     erts_send_error_to_logger_nogl(dsbufp);
 }
 
+#define IS_DRIVER_VERSION_GE(DE,MAJOR,MINOR) \
+    ((DE)->major_version >= (MAJOR) && (DE)->minor_version >= (MINOR))
 
 static int
 init_driver(erts_driver_t *drv, ErlDrvEntry *de, DE_Handle *handle)
@@ -7396,6 +7398,7 @@ init_driver(erts_driver_t *drv, ErlDrvEntry *de, DE_Handle *handle)
     drv->timeout = de->timeout ? de->timeout : no_timeout_callback;
     drv->ready_async = de->ready_async;
     drv->process_exit = de->process_exit;
+    drv->emergency_close = IS_DRIVER_VERSION_GE(de,3,2) ? de->emergency_close : NULL;
     if (de->stop_select)
 	drv->stop_select = de->stop_select;
     else
@@ -7414,6 +7417,8 @@ init_driver(erts_driver_t *drv, ErlDrvEntry *de, DE_Handle *handle)
     }
 }
 
+#undef IS_DRIVER_VERSION_GE
+
 void
 erts_destroy_driver(erts_driver_t *drv)
 {
@@ -7557,7 +7562,7 @@ Port *erts_get_heart_port(void)
 	if (!port)
 	    continue;
 	/* only examine undead or alive ports */
-	if (erts_atomic32_read_nob(&port->state) & ERTS_PORT_SFLGS_DEAD)
+	if (erts_atomic32_read_nob(&port->state) & ERTS_PORT_SFLGS_INVALID_DRIVER_LOOKUP)
 	    continue;
 	/* immediate atom compare */
 	reg = port->common.u.alive.reg;
@@ -7568,3 +7573,23 @@ Port *erts_get_heart_port(void)
 
     return NULL;
 }
+
+void erts_emergency_close_ports(void)
+{
+    int ix, max = erts_ptab_max(&erts_port);
+
+    for (ix = 0; ix < max; ix++) {
+	Port *port = erts_pix2port(ix);
+
+	if (!port)
+	    continue;
+	/* only examine undead or alive ports */
+	if (erts_atomic32_read_nob(&port->state) & ERTS_PORT_SFLGS_INVALID_DRIVER_LOOKUP)
+	    continue;
+
+	/* emergency close socket */
+	if (port->drv_ptr->emergency_close) {
+	    port->drv_ptr->emergency_close((ErlDrvData) port->drv_data);
+	}
+    }
+}
diff --git a/erts/emulator/drivers/common/inet_drv.c b/erts/emulator/drivers/common/inet_drv.c
index 3fe5dac813..3c6922eb8e 100644
--- a/erts/emulator/drivers/common/inet_drv.c
+++ b/erts/emulator/drivers/common/inet_drv.c
@@ -268,14 +268,13 @@ static BOOL (WINAPI *fpSetHandleInformation)(HANDLE,DWORD,DWORD);
 #define sock_htonl(x)              htonl((x))
 #define sock_send(s,buf,len,flag)  send((s),(buf),(len),(flag))
 #define sock_sendv(s, vec, size, np, flag) \
-                WSASend((s),(WSABUF*)(vec),\
-				   (size),(np),(flag),NULL,NULL)
+            WSASend((s),(WSABUF*)(vec),(size),(np),(flag),NULL,NULL)
 #define sock_recv(s,buf,len,flag)  recv((s),(buf),(len),(flag))
 
 #define sock_recvfrom(s,buf,blen,flag,addr,alen) \
-                recvfrom((s),(buf),(blen),(flag),(addr),(alen))
+	    recvfrom((s),(buf),(blen),(flag),(addr),(alen))
 #define sock_sendto(s,buf,blen,flag,addr,alen) \
-                sendto((s),(buf),(blen),(flag),(addr),(alen))
+	    sendto((s),(buf),(blen),(flag),(addr),(alen))
 #define sock_hostname(buf, len)    gethostname((buf), (len))
 
 #define sock_getservbyname(name,proto) getservbyname((name),(proto))
@@ -360,9 +359,9 @@ static ssize_t writev_fallback(int fd, const struct iovec *iov, int iovcnt, int
 #define sock_accept(s, addr, len)   accept((s), (addr), (len))
 #define sock_send(s,buf,len,flag)   inet_send((s),(buf),(len),(flag))
 #define sock_sendto(s,buf,blen,flag,addr,alen) \
-                sendto((s),(buf),(blen),(flag),(addr),(alen))
+	    sendto((s),(buf),(blen),(flag),(addr),(alen))
 #define sock_sendv(s, vec, size, np, flag) \
-		(*(np) = writev_fallback((s), (struct iovec*)(vec), (size), (*(np))))
+	    (*(np) = writev_fallback((s), (struct iovec*)(vec), (size), (*(np))))
 #define sock_sendmsg(s,msghdr,flag) sendmsg((s),(msghdr),(flag))
 
 #define sock_open(af, type, proto)  socket((af), (type), (proto))
@@ -1178,6 +1177,7 @@ static ErlDrvSSizeT tcp_inet_ctl(ErlDrvData, unsigned int,
 static void tcp_inet_timeout(ErlDrvData);
 static void tcp_inet_process_exit(ErlDrvData, ErlDrvMonitor *); 
 static void inet_stop_select(ErlDrvEvent, void*); 
+static void inet_emergency_close(ErlDrvData);
 #ifdef __WIN32__
 static void tcp_inet_event(ErlDrvData, ErlDrvEvent);
 static void find_dynamic_functions(void);
@@ -1288,7 +1288,8 @@ static struct erl_drv_entry tcp_inet_driver_entry =
     ERL_DRV_FLAG_USE_PORT_LOCKING|ERL_DRV_FLAG_SOFT_BUSY,
     NULL,
     tcp_inet_process_exit,
-    inet_stop_select
+    inet_stop_select,
+    inet_emergency_close
 };
 
 
@@ -1341,7 +1342,8 @@ static struct erl_drv_entry udp_inet_driver_entry =
     ERL_DRV_FLAG_USE_PORT_LOCKING,
     NULL,
     NULL,
-    inet_stop_select
+    inet_stop_select,
+    inet_emergency_close
 };
 #endif
 
@@ -1375,7 +1377,8 @@ static struct erl_drv_entry sctp_inet_driver_entry =
     ERL_DRV_FLAG_USE_PORT_LOCKING,
     NULL,
     NULL, /* process_exit */
-    inet_stop_select
+    inet_stop_select,
+    inet_emergency_close
 };
 #endif
 
@@ -1421,7 +1424,7 @@ static int packet_inet_input(udp_descriptor* udesc, HANDLE event);
 static int packet_inet_output(udp_descriptor* udesc, HANDLE event);
 #endif
 
-/* convert descriptor poiner to inet_descriptor pointer */
+/* convert descriptor pointer to inet_descriptor pointer */
 #define INETP(d) (&(d)->inet)
 
 #ifdef __OSE__
@@ -4727,6 +4730,36 @@ static char* sockaddr_to_buf(struct sockaddr* addr, char* ptr, char* end)
     return NULL;
 }
 
+/* sockaddr_bufsz_need
+ * Returns the number of bytes needed to store the information
+ * through sockaddr_to_buf
+ */
+
+static size_t sockaddr_bufsz_need(struct sockaddr* addr)
+{
+    if (addr->sa_family == AF_INET || addr->sa_family == 0) {
+	return 1 + sizeof(struct in_addr);
+    }
+#if defined(HAVE_IN6) && defined(AF_INET6)
+    else if (addr->sa_family == AF_INET6) {
+	return 1 + sizeof(struct in6_addr);
+    }
+#endif
+#if defined(AF_LINK)
+    if (addr->sa_family == AF_LINK) {
+	struct sockaddr_dl *sdl_p = (struct sockaddr_dl*) addr;
+	return 2 + sdl_p->sdl_alen;
+    }
+#endif
+#if defined(AF_PACKET) && defined(HAVE_NETPACKET_PACKET_H)
+    else if(addr->sa_family == AF_PACKET) {
+	struct sockaddr_ll *sll_p = (struct sockaddr_ll*) addr;
+	return 2 + sll_p->sll_halen;
+    }
+#endif
+    return 0;
+}
+
 static char* buf_to_sockaddr(char* ptr, char* end, struct sockaddr* addr)
 {
     buf_check(ptr,end,1);
@@ -5805,6 +5838,11 @@ done:
 }
 
 #elif defined(HAVE_GETIFADDRS)
+#ifdef  DEBUG
+#define GETIFADDRS_BUFSZ (1)
+#else
+#define GETIFADDRS_BUFSZ (512)
+#endif
 
 static ErlDrvSSizeT inet_ctl_getifaddrs(inet_descriptor* desc_p,
 					char **rbuf_pp, ErlDrvSizeT rsize)
@@ -5815,15 +5853,15 @@ static ErlDrvSSizeT inet_ctl_getifaddrs(inet_descriptor* desc_p,
     char *buf_p;
     char *buf_alloc_p;
 
-    buf_size = 512;
-    buf_alloc_p = ALLOC(buf_size);
+    buf_size = GETIFADDRS_BUFSZ;
+    buf_alloc_p = ALLOC(GETIFADDRS_BUFSZ);
     buf_p = buf_alloc_p;
 #   define BUF_ENSURE(Size)						\
     do {								\
 	int NEED_, GOT_ = buf_p - buf_alloc_p;				\
 	NEED_ = GOT_ + (Size);						\
 	if (NEED_ > buf_size) {						\
-	    buf_size = NEED_ + 512;					\
+	    buf_size = NEED_ + GETIFADDRS_BUFSZ;			\
 	    buf_alloc_p = REALLOC(buf_alloc_p, buf_size);		\
 	    buf_p = buf_alloc_p + GOT_;					\
 	}								\
@@ -5836,7 +5874,7 @@ static ErlDrvSSizeT inet_ctl_getifaddrs(inet_descriptor* desc_p,
 	    while (! (P_ = sockaddr_to_buf((sa), buf_p,			\
 					   buf_alloc_p+buf_size))) {	\
 		int GOT_ = buf_p - buf_alloc_p;				\
-		buf_size += 512;					\
+		buf_size += GETIFADDRS_BUFSZ;				\
 		buf_alloc_p = REALLOC(buf_alloc_p, buf_size);		\
 		buf_p = buf_alloc_p + GOT_;				\
 	    }								\
@@ -5893,10 +5931,11 @@ static ErlDrvSSizeT inet_ctl_getifaddrs(inet_descriptor* desc_p,
 		     || ifa_p->ifa_addr->sa_family == AF_PACKET
 #endif
 		     ) {
-		char *bp = buf_p;
-		BUF_ENSURE(1);
-		SOCKADDR_TO_BUF(INET_IFOPT_HWADDR, ifa_p->ifa_addr);
-		if (buf_p - bp < 4) buf_p = bp; /* Empty hwaddr */
+		size_t need = sockaddr_bufsz_need(ifa_p->ifa_addr);
+		if (need > 3) {
+		    BUF_ENSURE(1 + need);
+		    SOCKADDR_TO_BUF(INET_IFOPT_HWADDR, ifa_p->ifa_addr);
+		}
 	    }
 #endif
 	}
@@ -5911,6 +5950,7 @@ static ErlDrvSSizeT inet_ctl_getifaddrs(inet_descriptor* desc_p,
     return buf_size;
 #   undef BUF_ENSURE
 }
+#undef GETIFADDRS_BUFSZ
 
 #else
 
@@ -8215,6 +8255,19 @@ static void inet_stop(inet_descriptor* desc)
     FREE(desc);
 }
 
+static void inet_emergency_close(ErlDrvData data)
+{
+    /* valid for any (UDP, TCP or SCTP) descriptor */
+    tcp_descriptor* tcp_desc = (tcp_descriptor*)data;
+    inet_descriptor* desc = INETP(tcp_desc);
+    DEBUGF(("inet_emergency_close(%ld) {s=%d\r\n",
+	    (long)desc->port, desc->s));
+    if (desc->s != INVALID_SOCKET) {
+	sock_close(desc->s);
+    }
+}
+
+
 static void set_default_msgq_limits(ErlDrvPort port)
 {
     ErlDrvSizeT q_high = INET_HIGH_MSGQ_WATERMARK;
diff --git a/erts/emulator/sys/unix/erl_child_setup.c b/erts/emulator/sys/unix/erl_child_setup.c
index 94eb6b1547..5ad92dad02 100644
--- a/erts/emulator/sys/unix/erl_child_setup.c
+++ b/erts/emulator/sys/unix/erl_child_setup.c
@@ -101,7 +101,9 @@ main(int argc, char *argv[])
     if (sscanf(argv[CS_ARGV_FD_CR_IX], "%d:%d", &from, &to) != 2)
 	return 1;
 
-#if defined(__ANDROID__)
+#if defined(HAVE_CLOSEFROM)
+    closefrom(from);
+#elif defined(__ANDROID__)
     for (i = from; i <= to; i++) {
 	if (i!=__system_properties_fd)
 	    (void) close(i);
@@ -109,13 +111,6 @@ main(int argc, char *argv[])
 #else
     for (i = from; i <= to; i++)
 	(void) close(i);
-#endif /* __ANDROID__ */
-
-#if defined(HAVE_CLOSEFROM)
-    closefrom(from);
-#else
-    for (i = from; i <= to; i++)
-	(void) close(i);
 #endif
 
     if (!(argv[CS_ARGV_WD_IX][0] == '.' && argv[CS_ARGV_WD_IX][1] == '\0')
@@ -147,8 +142,6 @@ main(int argc, char *argv[])
     return 1;
 }
 
-
-
 #if defined(__ANDROID__)
 int __system_properties_fd(void)
 {
diff --git a/erts/emulator/sys/unix/sys.c b/erts/emulator/sys/unix/sys.c
index 0d677d5f34..cd87b320e2 100644
--- a/erts/emulator/sys/unix/sys.c
+++ b/erts/emulator/sys/unix/sys.c
@@ -202,8 +202,6 @@ static erts_smp_atomic_t sys_misc_mem_sz;
 #if defined(ERTS_SMP)
 static void smp_sig_notify(char c);
 static int sig_notify_fds[2] = {-1, -1};
-#elif defined(USE_THREADS)
-static int async_fd[2];
 #endif
 
 #if CHLDWTHR || defined(ERTS_SMP)
@@ -246,6 +244,8 @@ static void note_child_death(int, int);
 static void* child_waiter(void *);
 #endif
 
+static int crashdump_companion_cube_fd = -1;
+
 /********************* General functions ****************************/
 
 /* This is used by both the drivers and general I/O, must be set early */
@@ -575,6 +575,14 @@ erts_sys_pre_init(void)
       close(fd);
     }
 
+    /* We need a file descriptor to close in the crashdump creation.
+     * We close this one to be sure we can get a fd for our real file ...
+     * so, we create one here ... a stone to carry all the way home.
+     */
+
+    crashdump_companion_cube_fd = open("/dev/null", O_RDONLY);
+
+    /* don't lose it, there will be cake */
 }
 
 void
@@ -719,14 +727,13 @@ static ERTS_INLINE int
 prepare_crash_dump(int secs)
 {
 #define NUFBUF (3)
-    int i, max;
+    int i;
     char env[21]; /* enough to hold any 64-bit integer */
     size_t envsz;
     DeclareTmpHeapNoproc(heap,NUFBUF);
     Port *heart_port;
     Eterm *hp = heap;
     Eterm list = NIL;
-    int heart_fd[2] = {-1,-1};
     int has_heart = 0;
 
     UseTmpHeapNoproc(NUFBUF);
@@ -749,43 +756,22 @@ prepare_crash_dump(int secs)
 	alarm((unsigned int)secs);
     }
 
-    if (heart_port) {
-	/* hearts input fd
-	 * We "know" drv_data is the in_fd since the port is started with read|write
-	 */
-	heart_fd[0] = (int)heart_port->drv_data;
-	heart_fd[1] = (int)driver_data[heart_fd[0]].ofd;
-	has_heart   = 1;
+    /* close all viable sockets via emergency close callbacks.
+     * Specifically we want to close epmd sockets.
+     */
 
-	list = CONS(hp, make_small(8), list); hp += 2;
+    erts_emergency_close_ports();
 
+    if (heart_port) {
+	has_heart = 1;
+	list = CONS(hp, make_small(8), list); hp += 2;
 	/* send to heart port, CMD = 8, i.e. prepare crash dump =o */
 	erts_port_output(NULL, ERTS_PORT_SIG_FLG_FORCE_IMM_CALL, heart_port,
 			 heart_port->common.id, list, NULL);
     }
 
-    /* Make sure we unregister at epmd (unknown fd) and get at least
-       one free filedescriptor (for erl_crash.dump) */
-
-    max = max_files;
-    if (max < 1024)
-	max = 1024;
-    for (i = 3; i < max; i++) {
-#if defined(ERTS_SMP)
-	/* We don't want to close the signal notification pipe... */
-	if (i == sig_notify_fds[0] || i == sig_notify_fds[1])
-	    continue;
-#elif defined(USE_THREADS)
-	/* We don't want to close the async notification pipe... */
-	if (i == async_fd[0] || i == async_fd[1])
-	    continue;
-#endif
-	/* We don't want to close our heart yet ... */
-	if (i == heart_fd[0] || i == heart_fd[1])
-	    continue;
-
-	close(i);
-    }
+    /* Make sure we have a fd for our crashdump file. */
+    close(crashdump_companion_cube_fd);
 
     envsz = sizeof(env);
     i = erts_sys_getenv__("ERL_CRASH_DUMP_NICE", env, &envsz);
@@ -1574,9 +1560,13 @@ static ErlDrvData spawn_start(ErlDrvPort port_num, char* name, SysDriverOpts* op
 			goto child_error;
 	    }
 
+#if defined(HAVE_CLOSEFROM)
+	    closefrom(opts->use_stdio ? 3 : 5);
+#else
 	    for (i = opts->use_stdio ? 3 : 5; i < max_files; i++)
 		(void) close(i);
-	    
+#endif
+
 	    if (opts->wd && chdir(opts->wd) < 0)
 		goto child_error;
 
diff --git a/erts/vsn.mk b/erts/vsn.mk
index d0dc8f7243..e4b071b090 100644
--- a/erts/vsn.mk
+++ b/erts/vsn.mk
@@ -17,7 +17,7 @@
 # %CopyrightEnd%
 # 
 
-VSN = 6.3
+VSN = 6.3.1
 
 # Port number 4365 in 4.2
 # Port number 4366 in 4.3