Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

JDK-8263557: Possible NULL dereference in Arena::destruct_contents() #2994

Conversation

tstuefe
Copy link
Member

@tstuefe tstuefe commented Mar 14, 2021

Sonarcloud reports a possible access to a NULL C++ object in Arena::destruct_contents():

_first->chop();

I have found no code path where this could happen but _first could conceivably be NULL after a call to Arena::reset(). Lets fix that.

GA test error on windows seems unrelated.


Progress

  • Change must not contain extraneous whitespace
  • Commit message must refer to an issue
  • Change must be properly reviewed

Issue

  • JDK-8263557: Possible NULL dereference in Arena::destruct_contents()

Reviewers

Download

$ git fetch https://git.openjdk.java.net/jdk pull/2994/head:pull/2994
$ git checkout pull/2994

@bridgekeeper
Copy link

bridgekeeper bot commented Mar 14, 2021

👋 Welcome back stuefe! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

@openjdk
Copy link

openjdk bot commented Mar 14, 2021

@tstuefe The following label will be automatically applied to this pull request:

  • hotspot-runtime

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

@openjdk openjdk bot added the hotspot-runtime hotspot-runtime-dev@openjdk.org label Mar 14, 2021
@tstuefe tstuefe marked this pull request as ready for review March 14, 2021 08:47
@openjdk openjdk bot added the rfr Pull request is ready for review label Mar 14, 2021
@mlbridge
Copy link

mlbridge bot commented Mar 14, 2021

Webrevs

Copy link

@kimbarrett kimbarrett left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arena::move_contents leaves _first == nullptr. ~Arena calls destruct_contents. Calling ~Arena on a moved-from arena would hit this. So change looks good, though I'm not so sure about "trivial".

I'm not sure why we don't hit this. C2 (in Matcher::match) calls move_contents, but I couldn't figure out what it did with the old (moved-from) arena after that.

@openjdk
Copy link

openjdk bot commented Mar 14, 2021

@tstuefe This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8263557: Possible NULL dereference in Arena::destruct_contents()

Reviewed-by: kbarrett, coleenp

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 20 new commits pushed to the master branch:

  • 0c718ab: 8262277: URLClassLoader.getResource throws undocumented IllegalArgumentException
  • 4f1cda4: 8263387: G1GarbageCollection JFR event gets gc phase, not gc type
  • 5ab5244: 8263514: Minor issue in JavacFileManager.SortFiles.REVERSE
  • 771b146: 8245025: MoveAndUpdateClosure::do_addr calls function with side-effects in an assert
  • 46d78f0: 6539707: (fc) MappedByteBuffer.force() method throws an IOException in a very simple test
  • 189289d: 8262326: MaxMetaspaceSize does not have to be aligned to metaspace commit alignment
  • d825198: 8263556: remove @modules java.base from tests
  • d6b5e18: 8263191: Consolidate ThreadInVMfromJavaNoAsyncException and ThreadBlockInVMWithDeadlockCheck with existing wrappers
  • 80cdf78: 8263544: Unused argument in ConstantPoolCacheEntry::set_field()
  • c0176c4: 8263552: Use String.valueOf() for char-to-String conversions
  • ... and 10 more: https://git.openjdk.java.net/jdk/compare/9c84899da4689b395d0089e6cb777cb50cd3e547...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

@openjdk openjdk bot added the ready Pull request is ready to be integrated label Mar 14, 2021
@tstuefe
Copy link
Member Author

tstuefe commented Mar 15, 2021

Thanks Kim, this is not trivial, I'll remove the marker.

Arena::move_contents leaves _first == nullptr. ~Arena calls destruct_contents. Calling ~Arena on a moved-from arena would hit this. So change looks good, though I'm not so sure about "trivial".

I'm not sure why we don't hit this. C2 (in Matcher::match) calls move_contents, but I couldn't figure out what it did with the old (moved-from) arena after that.

Yes, the only code moving arena content around is Matcher::match():

in matcher.cpp:330, we evacuate Compile::node_arena to Compile::old_node_arena, now Compile::node_arena::_first = NULL;

But further down in that function we proceed doing things which cause allocation of new nodes, eg. matcher.cpp:353 Matcher::xform()->Node::clone() which allocates the new node from the node arena. So I think that the node arena gets re-filled immediately.

I am not sure if that happens always. No, it probably does not, at least not in the case of a native OOM. But destroying an Arena which just had been evacuated would at least be very rare.

The other uses of Arena (HandleArena and ResourceArea) are straightforward and content never gets moved around, so they never run into this.

Cheers, Thomas

Copy link
Contributor

@coleenp coleenp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok.

@tstuefe
Copy link
Member Author

tstuefe commented Mar 16, 2021

Thanks Coleen & Kim.

/integrate

@openjdk openjdk bot closed this Mar 16, 2021
@openjdk openjdk bot added integrated Pull request has been integrated and removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Mar 16, 2021
@openjdk
Copy link

openjdk bot commented Mar 16, 2021

@tstuefe Since your change was applied there have been 26 commits pushed to the master branch:

  • ba35193: 8263559: Add missing initializers to VM_PopulateDumpSharedSpace
  • e03a594: 8262504: Some CLHSDB command cannot know they run on remote debugger
  • d896246: 8263420: Incorrect function name in NSAccessibilityStaticText native peer implementation
  • 8c1112a: 8261916: gtest/GTestWrapper.java vmErrorTest.unimplemented1_vm_assert failed
  • 1e57087: 8263392: Allow current thread to be specified in ExceptionMark
  • 4d1c08c: 8263616: 'Deprecatd' typo in src/hotspot/share/classfile/classFileParser.cpp
  • 0c718ab: 8262277: URLClassLoader.getResource throws undocumented IllegalArgumentException
  • 4f1cda4: 8263387: G1GarbageCollection JFR event gets gc phase, not gc type
  • 5ab5244: 8263514: Minor issue in JavacFileManager.SortFiles.REVERSE
  • 771b146: 8245025: MoveAndUpdateClosure::do_addr calls function with side-effects in an assert
  • ... and 16 more: https://git.openjdk.java.net/jdk/compare/9c84899da4689b395d0089e6cb777cb50cd3e547...master

Your commit was automatically rebased without conflicts.

Pushed as commit c484d89.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

@tstuefe tstuefe deleted the JDK-8263557-Arena-destruct-contents-null-ref branch March 19, 2021 16:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
hotspot-runtime hotspot-runtime-dev@openjdk.org integrated Pull request has been integrated
3 participants