Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8359222

[asan] jvmti/vthread/ToggleNotifyJvmtiTest/ToggleNotifyJvmtiTest triggers stack-buffer-overflow error

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: P4 P4
    • tbd
    • 26
    • hotspot
    • aarch64
    • linux

      On Linux aarch64, the following error is reported when running :tier1 HS jtreg tests with asan-enabled binaries .

      Test jvmti/vthread/ToggleNotifyJvmtiTest/ToggleNotifyJvmtiTest.java gives this report


      ----------System.err:(185/12367)----------
      =================================================================
      ==732614==ERROR: AddressSanitizer: stack-buffer-overflow on address 0xffff6a617200 at pc 0xffffa735b794 bp 0xffff6a615660 sp 0xffff6a615670
      READ of size 8 at 0xffff6a617200 thread T39
          #0 0xffffa735b790 in frame FreezeBase::new_heap_frame<ContinuationHelper::StubFrame>(frame&, frame&) src/hotspot/cpu/aarch64/continuationFreezeThaw_aarch64.inline.hpp:106
          #1 0xffffa735b790 in FreezeBase::recurse_freeze_stub_frame(frame&, frame&) src/hotspot/share/runtime/continuationFreezeThaw.cpp:1318
          #2 0xffffa7359bcc in FreezeBase::recurse_freeze(frame&, frame&, int, bool, bool) src/hotspot/share/runtime/continuationFreezeThaw.cpp:934
          #3 0xffffa735abac in FreezeBase::freeze_slow() src/hotspot/share/runtime/continuationFreezeThaw.cpp:881
          #4 0xffffa73730a0 in freeze_internal<Config<(oop_kind)0, G1BarrierSet>, true> src/hotspot/share/runtime/continuationFreezeThaw.cpp:1777
          #5 0xffffa734a108 in Continuation::try_preempt(JavaThread*, oopDesc*) src/hotspot/share/runtime/continuation.cpp:159
          #6 0xffffa86fd8fc in ObjectMonitor::enter_with_contention_mark(JavaThread*, ObjectMonitorContentionMark&) src/hotspot/share/runtime/objectMonitor.cpp:551
          #7 0xffffa86feff0 in ObjectMonitor::enter(JavaThread*) src/hotspot/share/runtime/objectMonitor.cpp:507
          #8 0xffffa82ed698 in LightweightSynchronizer::inflate_and_enter(oopDesc*, BasicLock*, ObjectSynchronizer::InflateCause, JavaThread*, JavaThread*) src/hotspot/share/runtime/lightweightSynchronizer.cpp:1017
          #9 0xffffa82ef148 in LightweightSynchronizer::enter(Handle, BasicLock*, JavaThread*) src/hotspot/share/runtime/lightweightSynchronizer.cpp:706
          #10 0xffffa89d7dec in ObjectSynchronizer::enter(Handle, BasicLock*, JavaThread*) src/hotspot/share/runtime/synchronizer.inline.hpp:49
          #11 0xffffa89d7dec in SharedRuntime::monitor_enter_helper(oopDesc*, BasicLock*, JavaThread*) src/hotspot/share/runtime/sharedRuntime.cpp:1955
          #12 0xffffa6fd5cc4 in Runtime1::monitorenter(JavaThread*, oopDesc*, BasicObjectLock*) src/hotspot/share/c1/c1_Runtime1.cpp:786
          #13 0xffff934e0ab8 (<unknown module>)

      Address 0xffff6a617200 is located in stack of thread T39 at offset 48 in frame
          #0 0xffffa6fd5c10 in Runtime1::monitorenter(JavaThread*, oopDesc*, BasicObjectLock*) src/hotspot/share/c1/c1_Runtime1.cpp:776

        This frame has 1 object(s):
          [32, 40) '__hm' (line 776) <== Memory access at offset 48 overflows this variable
      HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
            (longjmp and C++ exceptions *are* supported)
      Thread T39 created by T28 here:
          #0 0xffffade7c5a8 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
          #1 0xffffa8772df0 in os::create_thread(Thread*, os::ThreadType, unsigned long) src/hotspot/os/linux/os_linux.cpp:1061
          #2 0xffffa7e62c2c in JVM_StartThread src/hotspot/share/prims/jvm.cpp:2811
          #3 0xffff9346782c (<unknown module>)
          #4 0xffff93463a8c (<unknown module>)
          #5 0xffff93463a8c (<unknown module>)
          #6 0xffff9346402c (<unknown module>)
          #7 0xffff93463a8c (<unknown module>)
          #8 0xffff9346390c (<unknown module>)
          #9 0xffff9346390c (<unknown module>)
          #10 0xffff9346396c (<unknown module>)
          #11 0xffff93463f0c (<unknown module>)
          #12 0xffff9346396c (<unknown module>)
          #13 0xffff9346390c (<unknown module>)
          #14 0xffff9346390c (<unknown module>)
          #15 0xffff93463a8c (<unknown module>)
          #16 0xffff93463a8c (<unknown module>)
          #17 0xffff93463a8c (<unknown module>)
          #18 0xffff93463a8c (<unknown module>)
          #19 0xffff93463a8c (<unknown module>)
          #20 0xffff93463a8c (<unknown module>)
          #21 0xffff93463a8c (<unknown module>)
          #22 0xffff93463a8c (<unknown module>)
          #23 0xffff93463a8c (<unknown module>)
          #24 0xffff93463a8c (<unknown module>)
          #25 0xffff9346402c (<unknown module>)
          #26 0xffff93463a8c (<unknown module>)
          #27 0xffff93463a8c (<unknown module>)
          #28 0xffff9346402c (<unknown module>)
          #29 0xffff93463a8c (<unknown module>)
          #30 0xffff93b9f54c (<unknown module>)
          #31 0xffff93463a8c (<unknown module>)
          #32 0xffff93463a8c (<unknown module>)
          #33 0xffff93463a8c (<unknown module>)
          #34 0xffff9346402c (<unknown module>)
          #35 0xffff9346381c (<unknown module>)
          #36 0xffff9346381c (<unknown module>)
          #37 0xffff9346390c (<unknown module>)
          #38 0xffff93463a8c (<unknown module>)
          #39 0xffff93463a8c (<unknown module>)
          #40 0xffff93463a8c (<unknown module>)
          #41 0xffff9345f150 (<unknown module>)
          #42 0xffffa7b91414 in JavaCalls::call_helper(JavaValue*, methodHandle const&, JavaCallArguments*, JavaThread*) src/hotspot/share/runtime/javaCalls.cpp:415
          #43 0xffffa7b975f4 in JavaCalls::call(JavaValue*, methodHandle const&, JavaCallArguments*, JavaThread*) src/hotspot/share/runtime/javaCalls.cpp:323
          #44 0xffffa7b975f4 in JavaCalls::call_virtual(JavaValue*, Klass*, Symbol*, Symbol*, JavaCallArguments*, JavaThread*) src/hotspot/share/runtime/javaCalls.cpp:179
          #45 0xffffa7b975f4 in JavaCalls::call_virtual(JavaValue*, Handle, Klass*, Symbol*, Symbol*, JavaThread*) src/hotspot/share/runtime/javaCalls.cpp:185
          #46 0xffffa7e39574 in thread_entry src/hotspot/share/prims/jvm.cpp:2748
          #47 0xffffa7bd97b8 in JavaThread::thread_main_inner() src/hotspot/share/runtime/javaThread.cpp:772
          #48 0xffffa7bea7f4 in JavaThread::thread_main_inner() src/hotspot/share/runtime/javaThread.cpp:752
          #49 0xffffa7bea7f4 in JavaThread::run() src/hotspot/share/runtime/javaThread.cpp:757
          #50 0xffffa8fcf560 in Thread::call_run() src/hotspot/share/runtime/thread.cpp:243
          #51 0xffffa877068c in thread_native_entry src/hotspot/os/linux/os_linux.cpp:868
          #52 0xffffadcad5b4 (/lib/aarch64-linux-gnu/libc.so.6+0x7d5b4)
          #53 0xffffadd15ed8 (/lib/aarch64-linux-gnu/libc.so.6+0xe5ed8)

      Thread T28 created by T25 here:
          #0 0xffffade7c5a8 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
          #1 0xffffa8772df0 in os::create_thread(Thread*, os::ThreadType, unsigned long) src/hotspot/os/linux/os_linux.cpp:1061
          #2 0xffffa7e62c2c in JVM_StartThread src/hotspot/share/prims/jvm.cpp:2811
          #3 0xffff9346782c (<unknown module>)
          #4 0xffff93463a8c (<unknown module>)
          #5 0xffff93463a8c (<unknown module>)
          #6 0xffff9346402c (<unknown module>)
          #7 0xffff93463a8c (<unknown module>)
          #8 0xffff9346390c (<unknown module>)
          #9 0xffff93463a8c (<unknown module>)
          #10 0xffff93463a8c (<unknown module>)
          #11 0xffff9346381c (<unknown module>)
          #12 0xffff9346402c (<unknown module>)
          #13 0xffff93463a8c (<unknown module>)
          #14 0xffff93463a8c (<unknown module>)
          #15 0xffff93463a8c (<unknown module>)
          #16 0xffff93463a8c (<unknown module>)
          #17 0xffff93463dbc (<unknown module>)
          #18 0xffff93463a8c (<unknown module>)
          #19 0xffff93463a8c (<unknown module>)
          #20 0xffff93463a8c (<unknown module>)
          #21 0xffff93463a8c (<unknown module>)
          #22 0xffff9346381c (<unknown module>)
          #23 0xffff9346381c (<unknown module>)
          #24 0xffff9346381c (<unknown module>)
          #25 0xffff93463dbc (<unknown module>)
          #26 0xffff9346381c (<unknown module>)
          #27 0xffff9346402c (<unknown module>)
          #28 0xffff93463a8c (<unknown module>)
          #29 0xffff9345f150 (<unknown module>)
          #30 0xffffa7b91414 in JavaCalls::call_helper(JavaValue*, methodHandle const&, JavaCallArguments*, JavaThread*) src/hotspot/share/runtime/javaCalls.cpp:415
          #31 0xffffa7b975f4 in JavaCalls::call(JavaValue*, methodHandle const&, JavaCallArguments*, JavaThread*) src/hotspot/share/runtime/javaCalls.cpp:323
          #32 0xffffa7b975f4 in JavaCalls::call_virtual(JavaValue*, Klass*, Symbol*, Symbol*, JavaCallArguments*, JavaThread*) src/hotspot/share/runtime/javaCalls.cpp:179
          #33 0xffffa7b975f4 in JavaCalls::call_virtual(JavaValue*, Handle, Klass*, Symbol*, Symbol*, JavaThread*) src/hotspot/share/runtime/javaCalls.cpp:185
          #34 0xffffa7e39574 in thread_entry src/hotspot/share/prims/jvm.cpp:2748
          #35 0xffffa7bd97b8 in JavaThread::thread_main_inner() src/hotspot/share/runtime/javaThread.cpp:772
          #36 0xffffa7bea7f4 in JavaThread::thread_main_inner() src/hotspot/share/runtime/javaThread.cpp:752
          #37 0xffffa7bea7f4 in JavaThread::run() src/hotspot/share/runtime/javaThread.cpp:757
          #38 0xffffa8fcf560 in Thread::call_run() src/hotspot/share/runtime/thread.cpp:243
          #39 0xffffa877068c in thread_native_entry src/hotspot/os/linux/os_linux.cpp:868
          #40 0xffffadcad5b4 (/lib/aarch64-linux-gnu/libc.so.6+0x7d5b4)
          #41 0xffffadd15ed8 (/lib/aarch64-linux-gnu/libc.so.6+0xe5ed8)

      Thread T25 created by T1 here:
          #0 0xffffade7c5a8 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
          #1 0xffffa8772df0 in os::create_thread(Thread*, os::ThreadType, unsigned long) src/hotspot/os/linux/os_linux.cpp:1061
          #2 0xffffa7e62c2c in JVM_StartThread src/hotspot/share/prims/jvm.cpp:2811
          #3 0xffff9346782c (<unknown module>)
          #4 0xffff93463a8c (<unknown module>)
          #5 0xffff93463a8c (<unknown module>)
          #6 0xffff9345f150 (<unknown module>)
          #7 0xffffa7b91414 in JavaCalls::call_helper(JavaValue*, methodHandle const&, JavaCallArguments*, JavaThread*) src/hotspot/share/runtime/javaCalls.cpp:415
          #8 0xffffa7dce9a0 in jni_invoke_static src/hotspot/share/prims/jni.cpp:883
          #9 0xffffa7dd4af0 in jni_CallStaticVoidMethod src/hotspot/share/prims/jni.cpp:1712
          #10 0xffffaddebd50 in invokeStaticMainWithArgs src/java.base/share/native/libjli/java.c:392
          #11 0xffffaddee9cc in JavaMain src/java.base/share/native/libjli/java.c:640
          #12 0xffffaddf3288 in ThreadJavaMain src/java.base/unix/native/libjli/java_md.c:646
          #13 0xffffadcad5b4 (/lib/aarch64-linux-gnu/libc.so.6+0x7d5b4)
          #14 0xffffadd15ed8 (/lib/aarch64-linux-gnu/libc.so.6+0xe5ed8)

      Thread T1 created by T0 here:
          #0 0xffffade7c5a8 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
          #1 0xffffaddf4584 in CallJavaMainInNewThread src/java.base/unix/native/libjli/java_md.c:687
          #2 0xffffaddf0df4 in ContinueInNewThread src/java.base/share/native/libjli/java.c:2340
          #3 0xffffaddf1bf4 in JLI_Launch src/java.base/share/native/libjli/java.c:330
          #4 0xaaaad99211a4 in main src/java.base/share/native/launcher/main.c:150
          #5 0xffffadc573f8 (/lib/aarch64-linux-gnu/libc.so.6+0x273f8)
          #6 0xffffadc574c8 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x274c8)
          #7 0xaaaad99212a8 (/open_jdk/jdk/build_asan/images/jdk/bin/java+0x12a8)

      SUMMARY: AddressSanitizer: stack-buffer-overflow src/hotspot/cpu/aarch64/continuationFreezeThaw_aarch64.inline.hpp:106 in frame FreezeBase::new_heap_frame<ContinuationHelper::StubFrame>(frame&, frame&)
      Shadow bytes around the buggy address:
        0x200fed4c2df0: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 f3 f3
        0x200fed4c2e00: f3 f3 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f2
        0x200fed4c2e10: f8 f2 01 f2 01 f2 01 f2 01 f2 01 f2 01 f2 00 f2
        0x200fed4c2e20: f2 f2 f8 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 00
        0x200fed4c2e30: f3 f3 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f3
      =>0x200fed4c2e40:[f3]f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x200fed4c2e50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x200fed4c2e60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x200fed4c2e70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x200fed4c2e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x200fed4c2e90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable: 00
        Partially addressable: 01 02 03 04 05 06 07
        Heap left redzone: fa
        Freed heap region: fd
        Stack left redzone: f1
        Stack mid redzone: f2
        Stack right redzone: f3
        Stack after return: f5
        Stack use after scope: f8
        Global redzone: f9
        Global init order: f6
        Poisoned by user: f7
        Container overflow: fc
        Array cookie: ac
        Intra object redzone: bb
        ASan internal: fe
        Left alloca redzone: ca
        Right alloca redzone: cb
      ==732614==ABORTING

            Unassigned Unassigned
            mbaesken Matthias Baesken
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: