From 51fdf17ef9703692b1de4cec67cc64e84ba1accc Mon Sep 17 00:00:00 2001
From: Lukas Larsson <lukas@erlang.org>
Date: Fri, 18 Jan 2019 14:19:16 +0100
Subject: erts: Fix cleanup of the inet MultiTimer

---
 erts/emulator/drivers/common/inet_drv.c | 40 +++++++++++++++++----------------
 lib/kernel/test/gen_tcp_misc_SUITE.erl  | 33 +++++++++++++++++++++++++--
 2 files changed, 52 insertions(+), 21 deletions(-)

diff --git a/erts/emulator/drivers/common/inet_drv.c b/erts/emulator/drivers/common/inet_drv.c
index 47eb5df7dd..31c9ce2d0b 100644
--- a/erts/emulator/drivers/common/inet_drv.c
+++ b/erts/emulator/drivers/common/inet_drv.c
@@ -12956,38 +12956,40 @@ make_noninheritable_handle(SOCKET s)
 static void fire_multi_timers(tcp_descriptor *desc, ErlDrvPort port,
 			      ErlDrvData data)
 {
-    ErlDrvTime next_timeout;
-    MultiTimerData *curr = desc->mtd;
-    if (!curr) {
-	ASSERT(0);
-	return;
+    ErlDrvTime next_timeout = 0;
+    if (!desc->mtd) {
+        ASSERT(0);
+        return;
     }
 #ifdef DEBUG
     {
 	ErlDrvTime chk = erl_drv_monotonic_time(ERL_DRV_MSEC);
-	ASSERT(chk >= curr->when);
+	ASSERT(chk >= desc->mtd->when);
     }
 #endif
     do {
-	MultiTimerData *save = curr;
+	MultiTimerData save = *desc->mtd;
 
-	(*(save->timeout_function))(data,save->caller);
+        /* We first remove the timer so that the timeout_functions has
+           can call clean_multi_timers without breaking anything */
+        if (desc->mtd_cache == NULL) {
+            desc->mtd_cache = desc->mtd;
+        } else {
+            FREE(desc->mtd);
+        }
 
-        curr = curr->next;
+        desc->mtd = save.next;
+        if (desc->mtd != NULL)
+            desc->mtd->prev = NULL;
 
-        if (desc->mtd_cache == NULL)
-            desc->mtd_cache = save;
-        else
-            FREE(save);
+	(*(save.timeout_function))(data,save.caller);
 
-	if (curr == NULL) {
-            desc->mtd = NULL;
+        if (desc->mtd == NULL)
 	    return;
-	}
-	curr->prev = NULL;
-	next_timeout = curr->when - erl_drv_monotonic_time(ERL_DRV_MSEC);
+
+	next_timeout = desc->mtd->when - erl_drv_monotonic_time(ERL_DRV_MSEC);
     } while (next_timeout <= 0);
-    desc->mtd = curr;
+
     driver_set_timer(port, (unsigned long) next_timeout);
 }
 
diff --git a/lib/kernel/test/gen_tcp_misc_SUITE.erl b/lib/kernel/test/gen_tcp_misc_SUITE.erl
index 244bd7e2a0..52edfaee29 100644
--- a/lib/kernel/test/gen_tcp_misc_SUITE.erl
+++ b/lib/kernel/test/gen_tcp_misc_SUITE.erl
@@ -53,7 +53,7 @@
 	 active_once_closed/1, send_timeout/1, send_timeout_active/1,
          otp_7731/1, zombie_sockets/1, otp_7816/1, otp_8102/1,
          wrapping_oct/0, wrapping_oct/1, otp_9389/1, otp_13939/1,
-         otp_12242/1]).
+         otp_12242/1, delay_send_error/1]).
 
 %% Internal exports.
 -export([sender/3, not_owner/1, passive_sockets_server/2, priority_server/1, 
@@ -97,7 +97,7 @@ all() ->
      active_once_closed, send_timeout, send_timeout_active, otp_7731,
      wrapping_oct,
      zombie_sockets, otp_7816, otp_8102, otp_9389,
-     otp_12242].
+     otp_12242, delay_send_error].
 
 groups() -> 
     [].
@@ -3427,3 +3427,32 @@ otp_12242(Addr) when tuple_size(Addr) =:= 4 ->
 
 wait(Mref) ->
     receive {'DOWN',Mref,_,_,Reason} -> Reason end.
+
+%% OTP-15536
+%% Test that send error works correctly for delay_send
+delay_send_error(Config) ->
+    {ok, LS} = gen_tcp:listen(0, [{reuseaddr, true}, {packet, 1}, {active, false}]),
+    {ok,{{0,0,0,0},PortNum}}=inet:sockname(LS),
+    P = spawn_link(
+          fun() ->
+                  {ok, S} = gen_tcp:accept(LS),
+                  receive die -> gen_tcp:close(S) end
+          end),
+    erlang:monitor(process, P),
+    {ok, S} = gen_tcp:connect("localhost", PortNum,
+                              [{packet, 1}, {active, false}, {delay_send, true}]),
+
+    %% Do a couple of sends first to see that it works
+    ok = gen_tcp:send(S, "hello"),
+    ok = gen_tcp:send(S, "hello"),
+    ok = gen_tcp:send(S, "hello"),
+
+    %% Make the receiver close
+    P ! die,
+    receive _Down -> ok end,
+
+    ok = gen_tcp:send(S, "hello"),
+    timer:sleep(500), %% Sleep in order for delay_send to have time to trigger
+
+    %% This used to result in a double free
+    {error, closed} = gen_tcp:send(S, "hello").
-- 
cgit v1.2.3