8318599: HttpURLConnection cache issues leading to crashes in JGSS w/ native GSS introduced by 8303809

[Michael-Mc-Mahon]

Hi,

This fix resolves a VM crash issue caused by a memory use after free in JGSS native code. The cause is the java.net.HttpURLConnection implementation which is incorrectly caching GSS context objects which end up being used and reused by multiple threads in parallel, and in fact should only be used once, with separate instances for separate requests (requiring authentication). The fix is very simple and is just that the NegotiateAuthentication class needs to be marked as non-cacheable. A test is not included here as it requires testing against real servers that aren't publicly accessible.

Thanks,
Michael

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue

Issue

• JDK-8318599: HttpURLConnection cache issues leading to crashes in JGSS w/ native GSS introduced by 8303809 (Bug - P3)

Reviewers

• Daniel Fuchs (@dfuch - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/16347/head:pull/16347
$ git checkout pull/16347

Update a local copy of the PR:
$ git checkout pull/16347
$ git pull https://git.openjdk.org/jdk.git pull/16347/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 16347

View PR using the GUI difftool:
$ git pr show -t 16347

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/16347.diff

Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back michaelm! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@Michael-Mc-Mahon The following label will be automatically applied to this pull request:

• net

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

[mlbridge]

Webrevs

• 00: Full (eb69bbde)

[dfuch]

LGTM

[openjdk]

@Michael-Mc-Mahon This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8318599: HttpURLConnection cache issues leading to crashes in JGSS w/ native GSS introduced by 8303809

Reviewed-by: dfuchs

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been no new commits pushed to the master branch. If another commit should be pushed before you perform the /integrate command, your PR will be automatically rebased. If you prefer to avoid any potential automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[Michael-Mc-Mahon]

/integrate

[nicowilliams]

Hi @nicowilliams, thanks for making a comment in an OpenJDK project!

All comments and discussions in the OpenJDK Community must be made available under the OpenJDK Terms of Use. If you already are an OpenJDK Author, Committer or Reviewer, please click here to open a new issue so that we can record that fact. Please Use "Add GitHub user nicowilliams for the summary.

If you are not an OpenJDK Author, Committer or Reviewer, simply check the box below to accept the OpenJDK Terms of Use for your comments.

• I agree to the OpenJDK Terms of Use for all comments I make in a project in the OpenJDK GitHub organization.

Your comment will be automatically restored once you have accepted the OpenJDK Terms of Use.

[openjdk]

Going to push as commit f1a24f6.
Since your change was applied there have been 19 commits pushed to the master branch:

• 7848ed7: 8301856: Generated .spec file for RPM installers uninstalls desktop launcher on update
• 726f854: 8320706: RuntimePackageTest.testUsrInstallDir test fails on Linux
• 1bb250c: 8261837: SIGSEGV in ciVirtualCallTypeData::translate_from
• 5f7f2c4: 8320249: tools/jpackage/share/AddLauncherTest.java#id1 fails intermittently on Windows in verifyDescription
• 6871a2f: 8320803: Update SourceVersion.RELEASE_22 description for language changes
• 82967f4: 8310159: Bulk copy with Unsafe::arrayCopy is slower compared to memcpy
• f0a12c5: 8320763: Fix spacing arround assignment in spec.gmk.in
• 12e983a: 8194743: Compiler implementation for Statements before super()
• 5e24aaf: 8320001: javac crashes while adding type annotations to the return type of a constructor
• f9e9131: 8319703: Serial: Remove generationSpec
• ... and 9 more: https://git.openjdk.org/jdk/compare/4d50df63b6ea76fd6a6c387593c3d6bc9429007b...master

Your commit was automatically rebased without conflicts.

[openjdk]

@Michael-Mc-Mahon Pushed as commit f1a24f6.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

[JacobHenner]

Is this fix expected to be backported to the LTS versions that were affected when https://bugs.openjdk.org/browse/JDK-8303809 was backported?