Merge branch 'maint'

10 files changed, 60 insertions, 10 deletions

diff --git a/erts/doc/src/erlang.xml b/erts/doc/src/erlang.xml
index 92e979c046..b5c59847f6 100644
--- a/erts/doc/src/erlang.xml
+++ b/erts/doc/src/erlang.xml
@@ -4174,9 +4174,16 @@ RealSystem = system + MissedSystem</code>
           </item>
           <tag><c>badarg</c></tag>
           <item>
-            If the port driver so decides for any reason (probably
+            <p>If the port driver so decides for any reason (probably
             something wrong with <c><anno>Operation</anno></c>
-            or <c><anno>Data</anno></c>).
+            or <c><anno>Data</anno></c>).</p>
+	    <warning>
+	      <p>Do not call <c>port_call</c> with an unknown
+	      <c><anno>Port</anno></c> identifier and expect <c>badarg</c>
+	      exception. Any undefined behavior is possible (including node
+	      crash) depending on how the port driver interprets the supplied
+	      arguments.</p>
+	    </warning>
           </item>
         </taglist>
       </desc>
@@ -4266,6 +4273,11 @@ RealSystem = system + MissedSystem</code>
             <p>If <c><anno>Data</anno></c> is an invalid I/O list.</p>
           </item>
         </taglist>
+	<warning>
+	  <p>Do not send data to an unknown port. Any undefined behavior is
+	  possible (including node crash) depending on how the port driver
+	  interprets the data.</p>
+	</warning>
       </desc>
     </func>
 
@@ -4325,6 +4337,11 @@ RealSystem = system + MissedSystem</code>
             a busy port.
           </item>
         </taglist>
+	<warning>
+	  <p>Do not send data to an unknown port. Any undefined behavior is
+	  possible (including node crash) depending on how the port driver
+	  interprets the data.</p>
+	</warning>
       </desc>
     </func>
 
@@ -4429,6 +4446,13 @@ RealSystem = system + MissedSystem</code>
             If the port driver so decides for any reason (probably
             something wrong with <c><anno>Operation</anno></c> or
             <c><anno>Data</anno></c>).
+	    <warning>
+	      <p>Do not call <c>port_control/3</c> with an unknown
+	      <c><anno>Port</anno></c> identifier and expect <c>badarg</c>
+	      exception. Any undefined behavior is possible (including node
+	      crash) depending on how the port driver interprets the supplied
+	      arguments.</p>
+	    </warning>
           </item>
         </taglist>
       </desc>
diff --git a/erts/emulator/beam/erl_port.h b/erts/emulator/beam/erl_port.h
index 25976d38cc..039d8cf67a 100644
--- a/erts/emulator/beam/erl_port.h
+++ b/erts/emulator/beam/erl_port.h
@@ -1018,6 +1018,6 @@ int erts_port_output_async(Port *, Eterm, Eterm);
 /*
  * Signals from ports to ports. Used by sys drivers.
  */
-int erl_drv_port_control(Eterm, char, char*, ErlDrvSizeT);
+int erl_drv_port_control(Eterm, unsigned int, char*, ErlDrvSizeT);
 
 #endif
diff --git a/erts/emulator/beam/io.c b/erts/emulator/beam/io.c
index 5325480901..7322239a73 100644
--- a/erts/emulator/beam/io.c
+++ b/erts/emulator/beam/io.c
@@ -4073,7 +4073,7 @@ done:
  * to the caller.
  */
 int
-erl_drv_port_control(Eterm port_num, char cmd, char* buff, ErlDrvSizeT size)
+erl_drv_port_control(Eterm port_num, unsigned int cmd, char* buff, ErlDrvSizeT size)
 {
     ErtsProc2PortSigData *sigdp = erts_port_task_alloc_p2p_sig_data();
 
diff --git a/erts/emulator/beam/sys.h b/erts/emulator/beam/sys.h
index 869a575cb4..a69da4d762 100644
--- a/erts/emulator/beam/sys.h
+++ b/erts/emulator/beam/sys.h
@@ -1291,4 +1291,13 @@ erts_raw_env_next_char(byte *p, int encoding)
 
 #endif /* #if ERTS_GLB_INLINE_INCL_FUNC_DEF */
 
+/*
+ * Magic numbers for our driver port_control callbacks.
+ * Kept them below 1<<27 to not inflict extra bignum garbage on 32-bit.
+ */
+#define ERTS_TTYSL_DRV_CONTROL_MAGIC_NUMBER  0x018b0900U
+#define ERTS_INET_DRV_CONTROL_MAGIC_NUMBER   0x03f1a300U
+#define ERTS_SPAWN_DRV_CONTROL_MAGIC_NUMBER  0x04c76a00U
+#define ERTS_FORKER_DRV_CONTROL_MAGIC_NUMBER 0x050a7800U
+
 #endif
diff --git a/erts/emulator/drivers/common/inet_drv.c b/erts/emulator/drivers/common/inet_drv.c
index 1c7aa56199..78411f324c 100644
--- a/erts/emulator/drivers/common/inet_drv.c
+++ b/erts/emulator/drivers/common/inet_drv.c
@@ -9955,6 +9955,7 @@ static ErlDrvSSizeT tcp_inet_ctl(ErlDrvData e, unsigned int cmd,
 {
     tcp_descriptor* desc = (tcp_descriptor*)e;
 
+    cmd -= ERTS_INET_DRV_CONTROL_MAGIC_NUMBER;
     switch(cmd) {
     case INET_REQ_OPEN: { /* open socket and return internal index */
 	int domain;
@@ -12184,6 +12185,7 @@ static ErlDrvSSizeT packet_inet_ctl(ErlDrvData e, unsigned int cmd, char* buf,
     int type = SOCK_DGRAM;
     int af = AF_INET;
 
+    cmd -= ERTS_INET_DRV_CONTROL_MAGIC_NUMBER;
     switch(cmd) {
     case INET_REQ_OPEN:   /* open socket and return internal index */
 	DEBUGF(("packet_inet_ctl(%ld): OPEN\r\n", (long)desc->port)); 
diff --git a/erts/emulator/drivers/unix/ttsl_drv.c b/erts/emulator/drivers/unix/ttsl_drv.c
index 11bb4373d8..f6864f96da 100644
--- a/erts/emulator/drivers/unix/ttsl_drv.c
+++ b/erts/emulator/drivers/unix/ttsl_drv.c
@@ -394,6 +394,8 @@ static ErlDrvSSizeT ttysl_control(ErlDrvData drv_data,
 {
     char resbuff[2*sizeof(Uint32)];
     ErlDrvSizeT res_size;
+
+    command -= ERTS_TTYSL_DRV_CONTROL_MAGIC_NUMBER;
     switch (command) {
     case CTRL_OP_GET_WINSIZE:
 	{
@@ -419,7 +421,7 @@ static ErlDrvSSizeT ttysl_control(ErlDrvData drv_data,
 	}
 	break;
     default:
-	return 0;
+	return -1;
     }
     if (rlen < res_size) {
 	*rbuf = driver_alloc(res_size);
diff --git a/erts/emulator/drivers/win32/ttsl_drv.c b/erts/emulator/drivers/win32/ttsl_drv.c
index 99e7fb25a4..d19bfa3079 100644
--- a/erts/emulator/drivers/win32/ttsl_drv.c
+++ b/erts/emulator/drivers/win32/ttsl_drv.c
@@ -176,6 +176,8 @@ static ErlDrvSSizeT ttysl_control(ErlDrvData drv_data,
 {
     char resbuff[2*sizeof(Uint32)];
     ErlDrvSizeT res_size;
+
+    command -= ERTS_TTYSL_DRV_CONTROL_MAGIC_NUMBER;
     switch (command) {
     case CTRL_OP_GET_WINSIZE:
 	{
@@ -201,7 +203,7 @@ static ErlDrvSSizeT ttysl_control(ErlDrvData drv_data,
 	}
 	break;
     default:
-	return 0;
+	return -1;
     }
     if (rlen < res_size) {
 	*rbuf = driver_alloc(res_size);
diff --git a/erts/emulator/sys/unix/sys_drivers.c b/erts/emulator/sys/unix/sys_drivers.c
index 2f5459bee5..042a091db1 100644
--- a/erts/emulator/sys/unix/sys_drivers.c
+++ b/erts/emulator/sys/unix/sys_drivers.c
@@ -732,7 +732,8 @@ static ErlDrvData spawn_start(ErlDrvPort port_num, char* name,
         proto->u.start.fds[1] = ifd[1];
         proto->u.start.fds[2] = stderrfd;
         proto->u.start.port_id = opts->exit_status ? erts_drvport2id(port_num) : THE_NON_VALUE;
-        if (erl_drv_port_control(forker_port, 'S', (char*)proto, sizeof(*proto))) {
+        if (erl_drv_port_control(forker_port, ERTS_FORKER_DRV_CONTROL_MAGIC_NUMBER,
+                                 (char*)proto, sizeof(*proto))) {
             /* The forker port has been killed, we close both fd's which will
                make open_port throw an epipe error */
             close(ofd[0]);
@@ -759,6 +760,9 @@ static ErlDrvSSizeT spawn_control(ErlDrvData e, unsigned int cmd, char *buf,
     ErtsSysDriverData *dd = (ErtsSysDriverData*)e;
     ErtsSysForkerProto *proto = (ErtsSysForkerProto *)buf;
 
+    if (cmd != ERTS_SPAWN_DRV_CONTROL_MAGIC_NUMBER)
+        return -1;
+
     ASSERT(len == sizeof(*proto));
     ASSERT(proto->action == ErtsSysForkerProtoAction_SigChld);
 
@@ -799,6 +803,8 @@ static ErlDrvSSizeT fd_control(ErlDrvData drv_data,
 {
     int fd = (int)(long)drv_data;
     char resbuff[2*sizeof(Uint32)];
+
+    command -= ERTS_TTYSL_DRV_CONTROL_MAGIC_NUMBER;
     switch (command) {
     case FD_CTRL_OP_GET_WINSIZE:
 	{
@@ -810,7 +816,7 @@ static ErlDrvSSizeT fd_control(ErlDrvData drv_data,
 	}
 	break;
     default:
-	return 0;
+	return -1;
     }
     if (rlen < 2*sizeof(Uint32)) {
 	*rbuf = driver_alloc(2*sizeof(Uint32));
@@ -1693,7 +1699,8 @@ static void forker_sigchld(Eterm port_id, int error)
        already used by the spawn_driver, we use control instead.
        Note that when using erl_drv_port_control it is an asynchronous
        control. */
-    erl_drv_port_control(port_id, 'S', (char*)proto, sizeof(*proto));
+    erl_drv_port_control(port_id, ERTS_SPAWN_DRV_CONTROL_MAGIC_NUMBER,
+                         (char*)proto, sizeof(*proto));
 }
 
 static void forker_ready_input(ErlDrvData e, ErlDrvEvent fd)
@@ -1778,6 +1785,9 @@ static ErlDrvSSizeT forker_control(ErlDrvData e, unsigned int cmd, char *buf,
     ErlDrvPort port_num = (ErlDrvPort)e;
     int res;
 
+    if (cmd != ERTS_FORKER_DRV_CONTROL_MAGIC_NUMBER)
+        return -1;
+
     if (first_call) {
         /*
          * Do driver_select here when schedulers and their pollsets have started.
diff --git a/erts/preloaded/ebin/prim_inet.beam b/erts/preloaded/ebin/prim_inet.beam
index 1e6eb3a37f..f211971529 100644
--- a/erts/preloaded/ebin/prim_inet.beam
+++ b/erts/preloaded/ebin/prim_inet.beam
diff --git a/erts/preloaded/src/prim_inet.erl b/erts/preloaded/src/prim_inet.erl
index cc2711b540..4fe570ec53 100644
--- a/erts/preloaded/src/prim_inet.erl
+++ b/erts/preloaded/src/prim_inet.erl
@@ -2679,12 +2679,13 @@ get_ip6([X1,X2,X3,X4,X5,X6,X7,X8,X9,X10,X11,X12,X13,X14,X15,X16 | T]) ->
 	?u16(X9,X10),?u16(X11,X12),?u16(X13,X14),?u16(X15,X16)},
       T }.
 
+-define(ERTS_INET_DRV_CONTROL_MAGIC_NUMBER, 16#03f1a300).
 
 %% Control command
 ctl_cmd(Port, Cmd, Args) ->
     ?DBG_FORMAT("prim_inet:ctl_cmd(~p, ~p, ~p)~n", [Port,Cmd,Args]),
     Result =
-	try erlang:port_control(Port, Cmd, Args) of
+	try erlang:port_control(Port, Cmd+?ERTS_INET_DRV_CONTROL_MAGIC_NUMBER, Args) of
 	    [?INET_REP_OK|Reply]  -> {ok,Reply};
 	    [?INET_REP]  -> inet_reply;
 	    [?INET_REP_ERROR|Err] -> {error,list_to_atom(Err)}