From 22ecae32fb0a0a9777cb00599a3b6440adb7bd83 Mon Sep 17 00:00:00 2001
From: Lukas Larsson <lukas@erlang.org>
Date: Wed, 14 Jun 2017 10:47:54 +0200
Subject: erts: Cleanup dropped port tasks correctly

Before this fix, the extra data attached to a port task had to
be cleaned up by the calling function. This caused problems
because the outputv call, co-allocates the extra data with the
port task. So in rare circumstances the port task would be
free'd before the extra data was free'd which led to segfault
when looking at the port task.

This has been fixed by the generic PORT_TASK_ABORT behaviour
being used even for tasks dropped in the erts_schedule_proc2port_signal
API.
---
 erts/emulator/beam/erl_port_task.c | 26 ++++++++++++----
 erts/emulator/beam/io.c            | 62 ++++++++++++--------------------------
 2 files changed, 40 insertions(+), 48 deletions(-)

diff --git a/erts/emulator/beam/erl_port_task.c b/erts/emulator/beam/erl_port_task.c
index 3102e44c11..8d78b22228 100644
--- a/erts/emulator/beam/erl_port_task.c
+++ b/erts/emulator/beam/erl_port_task.c
@@ -852,10 +852,11 @@ schedule_port_task_handle_list_free(ErtsPortTaskHandleList *pthlp)
 }
 
 static ERTS_INLINE void
-abort_nosuspend_task(Port *pp,
-		     ErtsPortTaskType type,
-		     ErtsPortTaskTypeData *tdp,
-		     int bpq_data)
+abort_signal_task(Port *pp,
+                  int abort_type,
+                  ErtsPortTaskType type,
+                  ErtsPortTaskTypeData *tdp,
+                  int bpq_data)
 {
 
     ASSERT(type == ERTS_PORT_TASK_PROC_SIG);
@@ -863,18 +864,28 @@ abort_nosuspend_task(Port *pp,
     if (!bpq_data)
 	tdp->psig.callback(NULL,
 			   ERTS_PORT_SFLG_INVALID,
-			   ERTS_PROC2PORT_SIG_ABORT_NOSUSPEND,
+			   abort_type,
 			   &tdp->psig.data);
     else {
 	ErlDrvSizeT size = erts_proc2port_sig_command_data_size(&tdp->psig.data);
 	tdp->psig.callback(NULL,
 			   ERTS_PORT_SFLG_INVALID,
-			   ERTS_PROC2PORT_SIG_ABORT_NOSUSPEND,
+			   abort_type,
 			   &tdp->psig.data);
 	aborted_proc2port_data(pp, size);
     }
 }
 
+
+static ERTS_INLINE void
+abort_nosuspend_task(Port *pp,
+		     ErtsPortTaskType type,
+		     ErtsPortTaskTypeData *tdp,
+		     int bpq_data)
+{
+    abort_signal_task(pp, ERTS_PROC2PORT_SIG_ABORT_NOSUSPEND, type, tdp, bpq_data);
+}
+
 static ErtsPortTaskHandleList *
 get_free_nosuspend_handles(Port *pp)
 {
@@ -1625,6 +1636,9 @@ fail:
 	erts_port_dec_refc(pp);
 #endif
 
+    abort_signal_task(pp, ERTS_PROC2PORT_SIG_ABORT,
+                      ptp->type, &ptp->u.alive.td, 0);
+
     if (ns_pthlp)
 	erts_free(ERTS_ALC_T_PT_HNDL_LIST, ns_pthlp);
 
diff --git a/erts/emulator/beam/io.c b/erts/emulator/beam/io.c
index c3eb610fdc..caf8bfc294 100644
--- a/erts/emulator/beam/io.c
+++ b/erts/emulator/beam/io.c
@@ -1968,7 +1968,6 @@ int
 erts_port_output_async(Port *prt, Eterm from, Eterm list)
 {
 
-    ErtsPortOpResult res;
     ErtsProc2PortSigData *sigdp;
     erts_driver_t *drv = prt->drv_ptr;
     size_t size;
@@ -2102,26 +2101,18 @@ erts_port_output_async(Port *prt, Eterm from, Eterm list)
 	sigdp->u.output.size = size;
 	port_sig_callback = port_sig_output;
     }
-    sigdp->flags = 0;
     ns_pthp = NULL;
     task_flags = 0;
 
-    res = erts_schedule_proc2port_signal(NULL,
-					 prt,
-					 ERTS_INVALID_PID,
-					 NULL,
-					 sigdp,
-					 task_flags,
-					 ns_pthp,
-					 port_sig_callback);
+    erts_schedule_proc2port_signal(NULL,
+                                   prt,
+                                   ERTS_INVALID_PID,
+                                   NULL,
+                                   sigdp,
+                                   task_flags,
+                                   ns_pthp,
+                                   port_sig_callback);
 
-    if (res != ERTS_PORT_OP_SCHEDULED) {
-	if (drv->outputv)
-	    cleanup_scheduled_outputv(evp, cbin);
-	else
-	    cleanup_scheduled_output(buf);
-	return 1;
-    }
     return 1;
 
 bad_value:
@@ -2554,10 +2545,6 @@ erts_port_output(Process *c_p,
 					 port_sig_callback);
 
     if (res != ERTS_PORT_OP_SCHEDULED) {
-	if (drv->outputv)
-	    cleanup_scheduled_outputv(evp, cbin);
-	else
-	    cleanup_scheduled_output(buf);
 	return res;
     }
 
@@ -2736,21 +2723,14 @@ erts_port_exit(Process *c_p,
 					   &bp->off_heap);
     }
 
-    res = erts_schedule_proc2port_signal(c_p,
-					 prt,
-					 c_p ? c_p->common.id : from,
-					 refp,
-					 sigdp,
-					 0,
-					 NULL,
-					 port_sig_exit);
-
-    if (res == ERTS_PORT_OP_DROPPED) {
-	if (bp)
-	    free_message_buffer(bp);
-    }
-
-    return res;
+    return erts_schedule_proc2port_signal(c_p,
+                                          prt,
+                                          c_p ? c_p->common.id : from,
+                                          refp,
+                                          sigdp,
+                                          0,
+                                          NULL,
+                                          port_sig_exit);
 }
 
 static ErtsPortOpResult
@@ -4932,10 +4912,9 @@ erts_port_control(Process* c_p,
 					 0,
 					 NULL,
 					 port_sig_control);
-    if (res != ERTS_PORT_OP_SCHEDULED) {
-	cleanup_scheduled_control(binp, bufp);
+    if (res != ERTS_PORT_OP_SCHEDULED)
 	return ERTS_PORT_OP_BADARG;
-    }
+
     return res;
 }
 
@@ -5225,10 +5204,9 @@ erts_port_call(Process* c_p,
 					 0,
 					 NULL,
 					 port_sig_call);
-    if (res != ERTS_PORT_OP_SCHEDULED) {
-	cleanup_scheduled_call(bufp);
+    if (res != ERTS_PORT_OP_SCHEDULED)
 	return ERTS_PORT_OP_BADARG;
-    }
+
     return res;
 }
 
-- 
cgit v1.2.3