Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8264827

Large mapped buffer/segment crash the VM when calling isLoaded

    XMLWordPrintable

Details

    • Bug
    • Status: Resolved
    • P3
    • Resolution: Fixed
    • 16
    • 17
    • core-libs
    • None
    • b18

    Description

      From panama-dev:

      I've found a bug when calling `MappedMemorySegments::isLoaded`. With a large segment size this causes malloc in the native isLoaded0 method being called with an invalid size, crashing the JVM.

      It's caused by a miss-scoped cast in java.nio.Bits::pageCount:

          static int pageCount(long size) {
              return (int)(size + (long)pageSize() - 1L) / pageSize();
          }

      There should be parentheses around the whole statement before the (int) cast.


      To reproduce:

          import jdk.incubator.foreign.MappedMemorySegments;
          import jdk.incubator.foreign.MemorySegment;

          import java.io.File;
          import java.io.IOException;
          import java.nio.channels.FileChannel;

          public class Main {

              public static final long SIZE_OK = 1024L * 1024 * 1024 * 2 - 4096;
              public static final long SIZE_OOM = SIZE_OK + 1;
              public static final long SIZE_CRASH = SIZE_OK * 2;

              public static void main(String[] args) throws IOException {
                  File f = new File("/tmp/is_loaded_test_file");
                  f.createNewFile();
                  MemorySegment memorySegment = MemorySegment.mapFile(f.toPath(), 0,
                          SIZE_CRASH, FileChannel.MapMode.READ_WRITE);
      System.out.println(MappedMemorySegments.isLoaded(memorySegment));
              }
          }


      This problem occurs for both memory segments AND byte buffers, since the issue is in common code used by both. Of course, since buffers can only range over int positions, you need a buffer between 2G and 4G to reproduce.

      Attachments

        Issue Links

          Activity

            People

              chegar Chris Hegarty
              mcimadamore Maurizio Cimadamore
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: