Merge branch 'maint' into hans/ssh/ssh_dbg_hostkey/OTP-14658

5 files changed, 179 insertions, 14 deletions

diff --git a/erts/doc/src/notes.xml b/erts/doc/src/notes.xml
index 1a5bea8820..cd0aa634e7 100644
--- a/erts/doc/src/notes.xml
+++ b/erts/doc/src/notes.xml
@@ -31,6 +31,30 @@
   </header>
   <p>This document describes the changes made to the ERTS application.</p>
 
+<section><title>Erts 9.1.1</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+	    <p>The new zlib module returned a data_error when
+	    inflating concatenated streams, which was incompatible
+	    with the old module's behavior of returning the
+	    uncompressed data up to the end of the first stream.</p>
+          <p>
+	    Own Id: OTP-14648</p>
+        </item>
+        <item>
+	    <p>zlib:gunzip/1 will no longer stop at the end of the
+	    first stream when decompressing concatenated gzip
+	    files.</p>
+          <p>
+	    Own Id: OTP-14649</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
 <section><title>Erts 9.1</title>
 
     <section><title>Fixed Bugs and Malfunctions</title>
@@ -959,6 +983,91 @@
 
 </section>
 
+<section><title>Erts 8.3.5.3</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    A timer internal bit-field used for storing scheduler id
+	    was too small. As a result, VM internal timer data
+	    structures could become inconsistent when using 1024
+	    schedulers on the system. Note that systems with less
+	    than 1024 schedulers are not effected by this bug.</p>
+          <p>
+	    This bug was introduced in ERTS version 7.0 (OTP 18.0).</p>
+          <p>
+	    Own Id: OTP-14548 Aux Id: OTP-11997, ERL-468 </p>
+        </item>
+        <item>
+          <p>
+	    Fixed bug in <c>binary_to_term</c> and
+	    <c>binary_to_atom</c> that could cause VM crash.
+	    Typically happens when the last character of an UTF8
+	    string is in the range 128 to 255, but truncated to only
+	    one byte. Bug exists in <c>binary_to_term</c> since ERTS
+	    version 5.10.2 (OTP_R16B01) and <c>binary_to_atom</c>
+	    since ERTS version 9.0 (OTP-20.0).</p>
+          <p>
+	    Own Id: OTP-14590 Aux Id: ERL-474 </p>
+        </item>
+        <item>
+          <p>
+	    Fix bug causing VM crash when a module with
+	    <c>-on_load</c> directive is loaded while
+	    <c>erlang:trace(on_load, ...)</c> is enabled.</p>
+          <p>
+	    Own Id: OTP-14612</p>
+        </item>
+        <item>
+          <p>
+	    Fixed bug that could cause a VM crash when a corrupt
+	    message is received on distribution channel from other
+	    node.</p>
+          <p>
+	    Own Id: OTP-14661 Aux Id: ERIERL-80 </p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>Erts 8.3.5.2</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    Fix performance bug in pre-allocators that could cause
+	    them to permanently fall back on normal more expensive
+	    memory allocation. Pre-allocators are used for quick
+	    allocation of short lived meta data used by messages and
+	    other scheduled tasks. Bug exists since OTP_R15B02.</p>
+          <p>
+	    Own Id: OTP-14491</p>
+        </item>
+        <item>
+	    <p>Fixed a bug that prevented TCP sockets from being
+	    closed properly on send timeouts.</p>
+          <p>
+	    Own Id: OTP-14509</p>
+        </item>
+        <item>
+          <p>
+	    Fixed bug in operator <c>bxor</c> causing erroneuos
+	    result when one operand is a big <em>negative</em>
+	    integer with the lowest <c>N*W</c> bits as zero and the
+	    other operand not larger than <c>N*W</c> bits. <c>N</c>
+	    is an integer of 1 or larger and <c>W</c> is 32 or 64
+	    depending on word size.</p>
+          <p>
+	    Own Id: OTP-14514</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
 <section><title>Erts 8.3.5.1</title>
     <section><title>Fixed Bugs and Malfunctions</title>
       <list>
diff --git a/erts/emulator/beam/erl_message.c b/erts/emulator/beam/erl_message.c
index c1af70592a..b30c4a49d7 100644
--- a/erts/emulator/beam/erl_message.c
+++ b/erts/emulator/beam/erl_message.c
@@ -568,14 +568,11 @@ erts_msg_attached_data_size_aux(ErtsMessage *msg)
 
     sz = erts_decode_dist_ext_size(msg->data.dist_ext);
     if (sz < 0) {
-	/* Bad external; remove it */
-	if (is_not_nil(ERL_MESSAGE_TOKEN(msg))) {
-	    ErlHeapFragment *heap_frag;
-	    heap_frag = erts_dist_ext_trailer(msg->data.dist_ext);
-	    erts_cleanup_offheap(&heap_frag->off_heap);
-	}
-	erts_free_dist_ext_copy(msg->data.dist_ext);
-	msg->data.dist_ext = NULL;
+	/* Bad external
+	 * We leave the message intact in this case as it's not worth the trouble
+	 * to make all callers remove it from queue. It will be detected again
+	 * and removed from message queue later anyway.
+	 */
 	return 0;
     }
 
diff --git a/erts/emulator/test/distribution_SUITE.erl b/erts/emulator/test/distribution_SUITE.erl
index b4ec99f902..4a0b299e03 100644
--- a/erts/emulator/test/distribution_SUITE.erl
+++ b/erts/emulator/test/distribution_SUITE.erl
@@ -56,6 +56,7 @@
          bad_dist_ext_process_info/1,
          bad_dist_ext_control/1,
          bad_dist_ext_connection_id/1,
+         bad_dist_ext_size/1,
 	 start_epmd_false/1, epmd_module/1]).
 
 %% Internal exports.
@@ -92,6 +93,7 @@ groups() ->
       [dist_auto_connect_never, dist_auto_connect_once]},
      {bad_dist_ext, [],
       [bad_dist_ext_receive, bad_dist_ext_process_info,
+       bad_dist_ext_size,
        bad_dist_ext_control, bad_dist_ext_connection_id]}].
 
 %% Tests pinging a node in different ways.
@@ -1672,6 +1674,57 @@ bad_dist_ext_connection_id(Config) when is_list(Config) ->
     stop_node(Offender),
     stop_node(Victim).
 
+%% OTP-14661: Bad message is discovered by erts_msg_attached_data_size
+bad_dist_ext_size(Config) when is_list(Config) ->
+    {ok, Offender} = start_node(bad_dist_ext_process_info_offender),
+    %%Prog = "Prog=/home/uabseri/src/otp_new3/bin/cerl -rr -debug",
+    Prog = [],
+    {ok, Victim} = start_node(bad_dist_ext_process_info_victim, [], Prog),
+    start_node_monitors([Offender,Victim]),
+
+    Parent = self(),
+    P = spawn_link(Victim,
+                   fun () ->
+                           Parent ! {self(), started},
+                           receive check_msgs -> ok end,  %% DID CRASH HERE
+                           bad_dist_ext_check_msgs([one]),
+                           Parent ! {self(), messages_checked}
+                   end),
+
+    receive {P, started} -> ok end,
+    P ! one,
+
+    Suspended = make_ref(),
+    S = spawn(Victim,
+              fun () ->
+                      erlang:suspend_process(P),
+                      Parent ! Suspended,
+                      receive after infinity -> ok end
+              end),
+
+    receive Suspended -> ok end,
+    pong = rpc:call(Victim, net_adm, ping, [Offender]),
+    verify_up(Offender, Victim),
+    send_bad_msgs(Offender, P, 1, dmsg_bad_tag()),
+
+    %% Make sure bad msgs has reached Victim
+    rpc:call(Offender, rpc, call, [Victim, erlang, node, []]),
+
+    verify_still_up(Offender, Victim),
+
+    rpc:call(Victim, erlang, process_info, [P, total_heap_size]),
+
+    verify_down(Offender, connection_closed, Victim, killed),
+
+    P ! check_msgs,
+    exit(S, bang),  % resume Victim
+    receive {P, messages_checked} -> ok end,
+
+    unlink(P),
+    verify_no_down(Offender, Victim),
+    stop_node(Offender),
+    stop_node(Victim).
+
 
 bad_dist_struct_check_msgs([]) ->
     receive
@@ -1775,9 +1828,12 @@ send_bad_structure(Offender,Victim,Bad,WhereToPutSelf,PayLoad) ->
 send_bad_msg(BadNode, To) ->
     send_bad_msgs(BadNode, To, 1).
 
-send_bad_msgs(BadNode, To, Repeat) when is_atom(BadNode),
-                                        is_pid(To),
-                                        is_integer(Repeat) ->
+send_bad_msgs(BadNode, To, Repeat) ->
+    send_bad_msgs(BadNode, To, Repeat, dmsg_bad_atom_cache_ref()).
+
+send_bad_msgs(BadNode, To, Repeat, BadTerm) when is_atom(BadNode),
+                                                 is_pid(To),
+                                                 is_integer(Repeat) ->
     Parent = self(),
     Done = make_ref(),
     spawn_link(BadNode,
@@ -1787,7 +1843,7 @@ send_bad_msgs(BadNode, To, Repeat) when is_atom(BadNode),
                        DPrt = dport(Node),
                        DData = [dmsg_hdr(),
                                 dmsg_ext({?DOP_SEND, ?COOKIE, To}),
-                                dmsg_bad_atom_cache_ref()],
+                                BadTerm],
                        repeat(fun () -> port_command(DPrt, DData) end, Repeat),
                        Parent ! Done
                end),
@@ -1874,6 +1930,9 @@ dmsg_ext(Term) ->
 dmsg_bad_atom_cache_ref() ->
     [$R, 137].
 
+dmsg_bad_tag() ->  %% Will fail early at heap size calculation
+    [$?, 66].
+
 start_epmd_false(Config) when is_list(Config) ->
     %% Start a node with the option -start_epmd false.
     {ok, OtherNode} = start_node(start_epmd_false, "-start_epmd false"),
diff --git a/erts/preloaded/src/zlib.erl b/erts/preloaded/src/zlib.erl
index 611010550f..3170ab6351 100644
--- a/erts/preloaded/src/zlib.erl
+++ b/erts/preloaded/src/zlib.erl
@@ -692,4 +692,4 @@ enqueue_input_1(Z, IOVec) ->
     end.
 
 enqueue_nif(_Z, _IOVec) ->
-    erlang:nif_error(undef).
\ No newline at end of file
+    erlang:nif_error(undef).
diff --git a/erts/vsn.mk b/erts/vsn.mk
index 380be1b534..1c6472a0ab 100644
--- a/erts/vsn.mk
+++ b/erts/vsn.mk
@@ -18,7 +18,7 @@
 # %CopyrightEnd%
 # 
 
-VSN = 9.1
+VSN = 9.1.1
 
 # Port number 4365 in 4.2
 # Port number 4366 in 4.3