Skip to content
This repository has been archived by the owner on Sep 2, 2022. It is now read-only.

8267652: c2 loop unrolling by 8 results in reading memory past array #108

Closed
wants to merge 1 commit into from

Conversation

neliasso
Copy link

@neliasso neliasso commented Jun 21, 2021

I moved this PR to be on top of JDK-17. (The old one can be found here: openjdk/jdk#4527)

Currently there are a bunch of AVX instructions on x86 that operate on memory that read a full 16-bytes even though only 8 are used. This means we can read out of bounds. This can be reproduced by using -XX:MaxLoopUnrollFactor=8 or -XX:MaxVectorLength=8.

I've tried creating test cases where a complete unroll results in a 8 byte vector. Then we will choose none-AVX instructions.

I've tried to patch x86.ad, looking for all uses of LoadVector on instructions that require AVX. I add a predicate that the vector length must be more than 8 bytes. This forces the use the reg-reg variants when the vector length is 8.

What I am missing is some kind of verification that the fix covers all cases.

Another additional complexity is that we are using the same instructions in assembler_x86.cpp. I've seen no obvious out-of-bounds reads, but they might be there.

Best regards,
Nils Eliasson


Progress

  • Change must not contain extraneous whitespace
  • Commit message must refer to an issue
  • Change must be properly reviewed

Issue

  • JDK-8267652: c2 loop unrolling by 8 results in reading memory past array

Reviewers

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.java.net/jdk17 pull/108/head:pull/108
$ git checkout pull/108

Update a local copy of the PR:
$ git checkout pull/108
$ git pull https://git.openjdk.java.net/jdk17 pull/108/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 108

View PR using the GUI difftool:
$ git pr show -t 108

Using diff file

Download this PR as a diff file:
https://git.openjdk.java.net/jdk17/pull/108.diff

@bridgekeeper
Copy link

bridgekeeper bot commented Jun 21, 2021

👋 Welcome back neliasso! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

@openjdk
Copy link

openjdk bot commented Jun 21, 2021

@neliasso The following label will be automatically applied to this pull request:

  • hotspot-compiler

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

@openjdk openjdk bot added the hotspot-compiler hotspot-compiler-dev@openjdk.java.net label Jun 21, 2021
@neliasso neliasso marked this pull request as ready for review June 21, 2021 08:57
@openjdk openjdk bot added the rfr Pull request is ready for review label Jun 21, 2021
@neliasso
Copy link
Author

@sviswa7 I added cases for vfmaF_mem, vfmaD_mem, and vpternlog_mem, as you suggested. vroundD_mem is predicated that the length must be less than 8 (that is must be 4). There is another round that is predicated on being exactly 8. Is there any other instruction I missed?

@mlbridge
Copy link

mlbridge bot commented Jun 21, 2021

Webrevs

@neliasso neliasso changed the title JDK-8267652: c2 loop unrolling by 8 results in reading memory past array 8267652: c2 loop unrolling by 8 results in reading memory past array Jun 21, 2021
@sviswa7
Copy link
Contributor

sviswa7 commented Jun 21, 2021

@neliasso Looks good to me.

@openjdk
Copy link

openjdk bot commented Jun 21, 2021

@neliasso This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8267652: c2 loop unrolling by 8 results in reading memory past array

Reviewed-by: sviswanathan, kvn, vlivanov

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 6 new commits pushed to the master branch:

  • d3ad8cd: 8268672: C2: assert(!loop->is_member(u_loop)) failed: can be in outer loop or out of both loops only
  • f25e719: 8268717: Upstream: 8268673: Stack walk across optimized entry frame on fresh native thread fails
  • 22ebd19: 8268362: [REDO] C2 crash when compile negative Arrays.copyOf length after loop
  • f8df953: 8268702: JFR diagnostic commands lack argument descriptors when viewed using Platform MBean Server
  • c294ae4: 8267042: bug in monitor locking/unlocking on ARM32 C1 due to uninitialized BasicObjectLock::_displaced_header
  • b358b54: 8269063: Build failure due to VerifyReceiverTypes was not declared after JDK-8268405

Please see this link for an up-to-date comparison between the source branch of this pull request and the master branch.
As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

@openjdk openjdk bot added the ready Pull request is ready to be integrated label Jun 21, 2021
Copy link
Contributor

@vnkozlov vnkozlov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

okay

Copy link

@iwanowww iwanowww left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good.

@neliasso
Copy link
Author

@sviswa7 @vnkozlov @iwanowww - Thanks for the review!

/integrate

@openjdk
Copy link

openjdk bot commented Jun 22, 2021

Going to push as commit dc12cb7.
Since your change was applied there have been 14 commits pushed to the master branch:

  • 578c55b: 8267399: C2: java/text/Normalizer/ConformanceTest.java test failed with assertion
  • 8fa2520: 8268888: Upstream 8268230: Foreign Linker API & Windows user32/kernel32: String conversion seems broken
  • 9ec7180: 8268524: nmethod::post_compiled_method_load_event racingly called on zombie
  • 01f12fb: 8266631: StandardJavaFileManager: getJavaFileObjects() impl violates the spec
  • 6b14c8a: 8267421: j.l.constant.DirectMethodHandleDesc.Kind.valueOf(int) implementation doesn't conform to the spec regarding REF_invokeInterface handling
  • ef4ba22: 8268349: Provide clear run-time warnings about Security Manager deprecation
  • 4099810: 8268293: VectorAPI cast operation on mask and shuffle is broken
  • e2d7ec3: 8267100: [BACKOUT] JDK-8196415 Disable SHA-1 Signed JARs
  • d3ad8cd: 8268672: C2: assert(!loop->is_member(u_loop)) failed: can be in outer loop or out of both loops only
  • f25e719: 8268717: Upstream: 8268673: Stack walk across optimized entry frame on fresh native thread fails
  • ... and 4 more: https://git.openjdk.java.net/jdk17/compare/b8f073be84b6bf2f83e2a65d20b7eb8c03120dce...master

Your commit was automatically rebased without conflicts.

@openjdk openjdk bot closed this Jun 22, 2021
@openjdk openjdk bot added integrated Pull request has been integrated and removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Jun 22, 2021
@openjdk
Copy link

openjdk bot commented Jun 22, 2021

@neliasso Pushed as commit dc12cb7.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
hotspot-compiler hotspot-compiler-dev@openjdk.java.net integrated Pull request has been integrated
4 participants