Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8338500

CgroupV1Controller constructor crash and CgroupV2Controller memory leak

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: P4 P4
    • tbd
    • 24
    • hotspot

      CgroupV1Controller does not crash in the current OpenJDK code but it is easy to write code which does crash.

      CgroupV2Controller constructor just leaks memory.

      [ RUN ] cgroupTest.cgroupv1_ctor_shallow
      =================================================================
      ==621011==ERROR: AddressSanitizer: heap-use-after-free on address 0x50400000ddd8 at pc 0x7fd104f6901d bp 0x7fff0b16d630 sp 0x7fff0b16d628
      READ of size 8 at 0x50400000ddd8 thread T0
          #0 0x7fd104f6901c in CgroupV1Controller::set_subsystem_path(char*) openjdk-git/src/hotspot/os/linux/cgroupV1Subsystem_linux.cpp:43
          #1 0x7fd1090dba34 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) googletest-git/googletest/src/gtest.cc:2671
          #2 0x7fd1090dba34 in testing::Test::Run() googletest-git/googletest/src/gtest.cc:2688
          #3 0x7fd1090dba34 in testing::Test::Run() googletest-git/googletest/src/gtest.cc:2678
          #4 0x7fd1090dc1c4 in testing::TestInfo::Run() googletest-git/googletest/src/gtest.cc:2837
          #5 0x7fd1091018ce in testing::TestSuite::Run() googletest-git/googletest/src/gtest.cc:3016
          #6 0x7fd1091018ce in testing::TestSuite::Run() googletest-git/googletest/src/gtest.cc:2969
          #7 0x7fd10911597e in testing::internal::UnitTestImpl::RunAllTests() googletest-git/googletest/src/gtest.cc:5922
          #8 0x7fd1091166e7 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) googletest-git/googletest/src/gtest.cc:2671
          #9 0x7fd1091166e7 in testing::UnitTest::Run() googletest-git/googletest/src/gtest.cc:5486
          #10 0x7fd102dc3ce4 in RUN_ALL_TESTS() googletest-git/googletest/include/gtest/gtest.h:2317
          #11 0x7fd102dc3ce4 in runUnitTestsInner openjdk-git/test/hotspot/gtest/gtestMain.cpp:290
          #12 0x7fd102dc4489 in runUnitTests openjdk-git/test/hotspot/gtest/gtestMain.cpp:371
          #13 0x564b5ea1a1e3 in main openjdk-git/test/hotspot/gtest/gtestLauncher.cpp:40
          #14 0x7fd101a39087 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
          #15 0x7fd101a3914a in __libc_start_main_impl ../csu/libc-start.c:360
          #16 0x564b5ea1a0b4 in _start (openjdk-git/build/linux-x86_64-server-fastdebug/images/test/hotspot/gtest/server/gtestLauncher+0x10b4) (BuildId: 969a8b34c6a6b698d2ac61361d12ec005cc359a8)

      0x50400000ddd8 is located 8 bytes inside of 40-byte region [0x50400000ddd0,0x50400000ddf8)
      freed by thread T0 here:
          #0 0x7fd10b8f6638 in free.part.0 (/lib64/libasan.so.8+0xf6638) (BuildId: 79824421bd82bb3ef4addf048e1265e2a93cfc64)
          #1 0x7fd1076dfd5a in raw_free openjdk-git/src/hotspot/share/nmt/nmtPreInit.cpp:38
          #2 0x7fd1076dfd5a in NMTPreInitAllocation::do_free(NMTPreInitAllocation*) openjdk-git/src/hotspot/share/nmt/nmtPreInit.cpp:86
          #3 0x7fd10786135c in NMTPreInit::handle_free(void*) openjdk-git/src/hotspot/share/nmt/nmtPreInit.hpp:348
          #4 0x7fd10786135c in os::free(void*) openjdk-git/src/hotspot/share/runtime/os.cpp:775
          #5 0x7fd10304da47 in CHeapObjBase::operator delete(void*) openjdk-git/src/hotspot/share/memory/allocation.hpp:172
          #6 0x7fd10304da47 in CHeapObj<(MEMFLAGS)9>::operator delete(void*) openjdk-git/src/hotspot/share/memory/allocation.hpp:217
          #7 0x7fd10304da47 in cgroupTest_cgroupv1_ctor_shallow_Test::TestBody() openjdk-git/test/hotspot/gtest/runtime/test_cgroupSubsystem_linux.cpp:484
          #8 0x7fd1090dba34 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) googletest-git/googletest/src/gtest.cc:2671
          #9 0x7fd1090dba34 in testing::Test::Run() googletest-git/googletest/src/gtest.cc:2688
          #10 0x7fd1090dba34 in testing::Test::Run() googletest-git/googletest/src/gtest.cc:2678
          #11 0x7fd1090dc1c4 in testing::TestInfo::Run() googletest-git/googletest/src/gtest.cc:2837
          #12 0x7fd1091018ce in testing::TestSuite::Run() googletest-git/googletest/src/gtest.cc:3016
          #13 0x7fd1091018ce in testing::TestSuite::Run() googletest-git/googletest/src/gtest.cc:2969
          #14 0x7fd10911597e in testing::internal::UnitTestImpl::RunAllTests() googletest-git/googletest/src/gtest.cc:5922
          #15 0x7fd1091166e7 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) googletest-git/googletest/src/gtest.cc:2671
          #16 0x7fd1091166e7 in testing::UnitTest::Run() googletest-git/googletest/src/gtest.cc:5486
          #17 0x7fd102dc3ce4 in RUN_ALL_TESTS() googletest-git/googletest/include/gtest/gtest.h:2317
          #18 0x7fd102dc3ce4 in runUnitTestsInner openjdk-git/test/hotspot/gtest/gtestMain.cpp:290
          #19 0x7fd102dc4489 in runUnitTests openjdk-git/test/hotspot/gtest/gtestMain.cpp:371
          #20 0x564b5ea1a1e3 in main openjdk-git/test/hotspot/gtest/gtestLauncher.cpp:40
          #21 0x7fd101a39087 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
          #22 0x7fd101a3914a in __libc_start_main_impl ../csu/libc-start.c:360
          #23 0x564b5ea1a0b4 in _start (openjdk-git/build/linux-x86_64-server-fastdebug/images/test/hotspot/gtest/server/gtestLauncher+0x10b4) (BuildId: 969a8b34c6a6b698d2ac61361d12ec005cc359a8)

      previously allocated by thread T0 here:
          #0 0x7fd10b8f7997 in malloc (/lib64/libasan.so.8+0xf7997) (BuildId: 79824421bd82bb3ef4addf048e1265e2a93cfc64)
          #1 0x7fd1076dfa3e in raw_malloc openjdk-git/src/hotspot/share/nmt/nmtPreInit.cpp:36
          #2 0x7fd1076dfa3e in raw_checked_malloc openjdk-git/src/hotspot/share/nmt/nmtPreInit.cpp:45
          #3 0x7fd1076dfa3e in NMTPreInitAllocation::do_alloc(unsigned long) openjdk-git/src/hotspot/share/nmt/nmtPreInit.cpp:71
          #4 0x7fd107861d57 in NMTPreInit::handle_malloc(void**, unsigned long) openjdk-git/src/hotspot/share/nmt/nmtPreInit.hpp:274
          #5 0x7fd107861d57 in os::malloc(unsigned long, MEMFLAGS, NativeCallStack const&) openjdk-git/src/hotspot/share/runtime/os.cpp:640
          #6 0x7fd1044dac03 in AllocateHeap(unsigned long, MEMFLAGS, NativeCallStack const&, AllocFailStrategy::AllocFailEnum) openjdk-git/src/hotspot/share/memory/allocation.cpp:42
          #7 0x7fd1044dac03 in AllocateHeap(unsigned long, MEMFLAGS, AllocFailStrategy::AllocFailEnum) openjdk-git/src/hotspot/share/memory/allocation.cpp:52
          #8 0x7fd10304d871 in CHeapObjBase::operator new(unsigned long, MEMFLAGS) openjdk-git/src/hotspot/share/memory/allocation.hpp:127
          #9 0x7fd10304d871 in CHeapObj<(MEMFLAGS)9>::operator new(unsigned long) openjdk-git/src/hotspot/share/memory/allocation.hpp:181
          #10 0x7fd10304d871 in cgroupTest_cgroupv1_ctor_shallow_Test::TestBody() openjdk-git/test/hotspot/gtest/runtime/test_cgroupSubsystem_linux.cpp:482
          #11 0x7fd1090dba34 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) googletest-git/googletest/src/gtest.cc:2671
          #12 0x7fd1090dba34 in testing::Test::Run() googletest-git/googletest/src/gtest.cc:2688
          #13 0x7fd1090dba34 in testing::Test::Run() googletest-git/googletest/src/gtest.cc:2678
          #14 0x7fd1090dc1c4 in testing::TestInfo::Run() googletest-git/googletest/src/gtest.cc:2837
          #15 0x7fd1091018ce in testing::TestSuite::Run() googletest-git/googletest/src/gtest.cc:3016
          #16 0x7fd1091018ce in testing::TestSuite::Run() googletest-git/googletest/src/gtest.cc:2969
          #17 0x7fd10911597e in testing::internal::UnitTestImpl::RunAllTests() googletest-git/googletest/src/gtest.cc:5922
          #18 0x7fd1091166e7 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) googletest-git/googletest/src/gtest.cc:2671
          #19 0x7fd1091166e7 in testing::UnitTest::Run() googletest-git/googletest/src/gtest.cc:5486
          #20 0x7fd102dc3ce4 in RUN_ALL_TESTS() googletest-git/googletest/include/gtest/gtest.h:2317
          #21 0x7fd102dc3ce4 in runUnitTestsInner openjdk-git/test/hotspot/gtest/gtestMain.cpp:290
          #22 0x7fd102dc4489 in runUnitTests openjdk-git/test/hotspot/gtest/gtestMain.cpp:371
          #23 0x564b5ea1a1e3 in main openjdk-git/test/hotspot/gtest/gtestLauncher.cpp:40
          #24 0x7fd101a39087 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
          #25 0x7fd101a3914a in __libc_start_main_impl ../csu/libc-start.c:360
          #26 0x564b5ea1a0b4 in _start (openjdk-git/build/linux-x86_64-server-fastdebug/images/test/hotspot/gtest/server/gtestLauncher+0x10b4) (BuildId: 969a8b34c6a6b698d2ac61361d12ec005cc359a8)

      SUMMARY: AddressSanitizer: heap-use-after-free openjdk-git/src/hotspot/os/linux/cgroupV1Subsystem_linux.cpp:43 in CgroupV1Controller::set_subsystem_path(char*)
      Shadow bytes around the buggy address:
        0x50400000db00: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
        0x50400000db80: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
        0x50400000dc00: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
        0x50400000dc80: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
        0x50400000dd00: fa fa 00 00 00 00 00 06 fa fa 00 00 00 00 00 fa
      =>0x50400000dd80: fa fa 00 00 00 00 00 fa fa fa fd[fd]fd fd fd fa
        0x50400000de00: fa fa 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
        0x50400000de80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x50400000df00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x50400000df80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x50400000e000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable: 00
        Partially addressable: 01 02 03 04 05 06 07
        Heap left redzone: fa
        Freed heap region: fd
        Stack left redzone: f1
        Stack mid redzone: f2
        Stack right redzone: f3
        Stack after return: f5
        Stack use after scope: f8
        Global redzone: f9
        Global init order: f6
        Poisoned by user: f7
        Container overflow: fc
        Array cookie: ac
        Intra object redzone: bb
        ASan internal: fe
        Left alloca redzone: ca
        Right alloca redzone: cb
      ==621011==ABORTING

            syan Sendao Yan
            jkratochvil Jan Kratochvil
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: