JDK-8009547 : Network interface ifindex over 255 on Linux causes JVM heap corruption
  • Type: Bug
  • Component: core-libs
  • Sub-Component: java.net
  • Affected Version: 7u13
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • Submitted: 2013-03-04
  • Updated: 2013-05-11
  • Resolved: 2013-03-06
Related Reports
Duplicate :  
JDK-7078386 - NetworkInterface.getNetworkInterfaces() may return corrupted results on linux
Description
FULL PRODUCT VERSION :
Java(TM) SE Runtime Environment (build 1.7.0_13-b20)
Java HotSpot(TM) Server VM (build 23.7-b01, mixed mode)


ADDITIONAL OS VERSION INFORMATION :
Seen at least on:

Linux minas-c1 2.6.32-71.el6.x86_64 #1 SMP Wed Sep 1 01:33:01 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux
Linux dev 2.6.35.14-106.fc14.i686.PAE #1 SMP Wed Nov 23 13:39:51 UTC 2011 i686 i686 i386 GNU/Linux

The first is RHEL6.0 64-bit
The second is Fedora 14 32-bit


EXTRA RELEVANT SYSTEM CONFIGURATION :
Seems to occur with any hardware.  Only seems to occur with some combinations of ifindexes and interface names, probably because it's random heap corruption and some patterns crash it and some do not.

A DESCRIPTION OF THE PROBLEM :
On a system with network interfaces with ifindexes above 255 that are up, the use of the various NetworkInterface methods  causes heap corruption and a JVM crash.  This only occurs if IPV6 is enabled.

This bug seems to be the similar to 7075227 and 7078386, however those are both marked as Fixed, and this bug is still present.



STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
1) Make sure IPv6 is enabled on your test machine, if it is disabled, the bug will not reproduce.

# echo 0 > /proc/sys/net/ipv6/conf/all/disable_ipv6


2) Create a bunch of interfaces and delete them, then create two (one doesn't seem to trigger it) with longish names (short ones don't seem to trigger it).  The following script works for me in a VM with two interfaces after a fresh boot:


#!/bin/sh
for x in {1..300}; do (ip link add link eth0 name testifname1 type vlan id 5; ip link delete testifname1); done
ip link add link eth0 name testifname1 type vlan id 5
ip link add link eth0 name testifname2 type vlan id 6
ifconfig testifname1 up
ifconfig testifname2 up

3) Run any Java program that uses NetworkInterfaces.  A very simple one is attached.



EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
The JVM to not crash.
ACTUAL -
The JVM crashing.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00584514, pid=14012, tid=3079084912
#
# JRE version: 7.0_13-b20
# Java VM: Java HotSpot(TM) Server VM (23.7-b01 mixed mode linux-x86 )
# Problematic frame:
# C  [libnet.so+0x3514]  _init+0x620
#
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try  " ulimit -c unlimited "  before starting Java again
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.sun.com/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

---------------  T H R E A D  ---------------

Current thread (0xb7705800):  JavaThread  " main "  [_thread_in_native, id=14013, stack(0xb7821000,0xb7872000)]

siginfo:si_signo=SIGSEGV: si_errno=0, si_code=1 (SEGV_MAPERR), si_addr=0x363631b4

Registers:
EAX=0xb7870f08, EBX=0x36363030, ECX=0xb7870f0d, EDX=0x00593d84
ESP=0xb7870e5c, EBP=0xb7870fb8, ESI=0xb7870f00, EDI=0x8e309cc8
EIP=0x00584514, EFLAGS=0x00010246, CR2=0x363631b4

  Top of Stack: (sp=0xb7870e5c)
0xb7870e5c:   00586651 8e309cc8 00593d84 b7870f08
0xb7870e6c:   b7870f0d b7870f12 b7870f17 b7870f1c
0xb7870e7c:   b7870f21 b7870f26 b7870f2b b7870f9c
0xb7870e8c:   b7870fa8 b7870fa4 b7870fa0 b7870f77
0xb7870e9c:   00000000 00000000 00000000 00593d6b
0xb7870eac:   b7870f8c b7870f77 b7870fa8 b7870fa4
0xb7870ebc:   b7870fa0 00593d84 b7870f9c b7870f08
0xb7870ecc:   8e309be8 b7705928 8e309fd0 00000004

Instructions: (pc=0x00584514)
0x005844f4:   ff a3 7c 01 00 00 68 e0 02 00 00 e9 20 fa ff ff
0x00584504:   ff a3 80 01 00 00 68 e8 02 00 00 e9 10 fa ff ff
0x00584514:   ff a3 84 01 00 00 68 f0 02 00 00 e9 00 fa ff ff
0x00584524:   ff a3 88 01 00 00 68 f8 02 00 00 e9 f0 f9 ff ff

Register to memory mapping:

EAX=0xb7870f08 is pointing into the stack for thread: 0xb7705800
EBX=0x36363030 is an unknown value
ECX=0xb7870f0d is pointing into the stack for thread: 0xb7705800
EDX=0x00593d84: <offset 0x12d84> in /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/libnet.so at 0x00581000
ESP=0xb7870e5c is pointing into the stack for thread: 0xb7705800
EBP=0xb7870fb8 is pointing into the stack for thread: 0xb7705800
ESI=0xb7870f00 is pointing into the stack for thread: 0xb7705800
EDI=0x8e309cc8 is an unknown value


Stack: [0xb7821000,0xb7872000],  sp=0xb7870e5c,  free space=319k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  [libnet.so+0x3514]  _init+0x620
C  [libnet.so+0x5880]  Java_java_net_NetworkInterface_getAll+0x10
j  java.net.NetworkInterface.getAll()[Ljava/net/NetworkInterface;+0
j  java.net.NetworkInterface.getNetworkInterfaces()Ljava/util/Enumeration;+0
j  Network.main([Ljava/lang/String;)V+0
v  ~StubRoutines::call_stub
V  [libjvm.so+0x412845]  JavaCalls::call_helper(JavaValue*, methodHandle*, JavaCallArguments*, Thread*)+0x315
V  [libjvm.so+0x5d80d9]  os::os_exception_wrapper(void (*)(JavaValue*, methodHandle*, JavaCallArguments*, Thread*), JavaValue*, methodHandle*, JavaCallArguments*, Thread*)+0x19
V  [libjvm.so+0x41165f]  JavaCalls::call(JavaValue*, methodHandle, JavaCallArguments*, Thread*)+0x2f
V  [libjvm.so+0x42510a]  jni_invoke_static(JNIEnv_*, JavaValue*, _jobject*, JNICallType, _jmethodID*, JNI_ArgumentPusher*, Thread*)+0x23a
V  [libjvm.so+0x42f97b]  jni_CallStaticVoidMethod+0xbb
C  [libjli.so+0x2e8d]  JavaMain+0x8bd
C  [libpthread.so.0+0x5e99]  start_thread+0xc9

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j  java.net.NetworkInterface.getAll()[Ljava/net/NetworkInterface;+0
j  java.net.NetworkInterface.getNetworkInterfaces()Ljava/util/Enumeration;+0
j  Network.main([Ljava/lang/String;)V+0
v  ~StubRoutines::call_stub

---------------  P R O C E S S  ---------------

Java Threads: ( => current thread )
  0x8eae8c00 JavaThread  " Service Thread "  daemon [_thread_blocked, id=14024, stack(0x8e4ad000,0x8e4fe000)]
  0x8eae7000 JavaThread  " C2 CompilerThread1 "  daemon [_thread_blocked, id=14023, stack(0x8e4fe000,0x8e57f000)]
  0x8eae5000 JavaThread  " C2 CompilerThread0 "  daemon [_thread_blocked, id=14022, stack(0x8e57f000,0x8e600000)]
  0x8eae3400 JavaThread  " Signal Dispatcher "  daemon [_thread_blocked, id=14021, stack(0x9062e000,0x9067f000)]
  0x8eaa8800 JavaThread  " Finalizer "  daemon [_thread_blocked, id=14020, stack(0x9092e000,0x9097f000)]
  0x8eaa6c00 JavaThread  " Reference Handler "  daemon [_thread_blocked, id=14019, stack(0x90b08000,0x90b59000)]
=>0xb7705800 JavaThread  " main "  [_thread_in_native, id=14013, stack(0xb7821000,0xb7872000)]

Other Threads:
  0x8eaa1400 VMThread [stack: 0x8eb2b000,0x8ebac000] [id=14018]
  0x8eaeac00 WatcherThread [stack: 0x8e42c000,0x8e4ad000] [id=14025]

VM state:not at safepoint (normal execution)

VM Mutex/Monitor currently owned by a thread: None

Heap
 PSYoungGen      total 9408K, used 322K [0xa9e40000, 0xaa8c0000, 0xb4640000)
  eden space 8064K, 4% used [0xa9e40000,0xa9e90ad0,0xaa620000)
  from space 1344K, 0% used [0xaa770000,0xaa770000,0xaa8c0000)
  to   space 1344K, 0% used [0xaa620000,0xaa620000,0xaa770000)
 ParOldGen       total 21504K, used 0K [0x94e40000, 0x96340000, 0xa9e40000)
  object space 21504K, 0% used [0x94e40000,0x94e40000,0x96340000)
 PSPermGen       total 16384K, used 1633K [0x90e40000, 0x91e40000, 0x94e40000)
  object space 16384K, 9% used [0x90e40000,0x90fd8500,0x91e40000)

Card table byte_map: [0x90d23000,0x90e40000] byte_map_base: 0x9089be00

Polling page: 0xb7879000

Code Cache  [0xb4700000, 0xb4940000, 0xb7700000)
 total_blobs=95 nmethods=0 adapters=63 free_code_cache=48864Kb largest_free_block=50037120

Compilation events (0 events):
No events

GC Heap History (0 events):
No events

Deoptimization events (0 events):
No events

Internal exceptions (2 events):
Event: 1.702 Thread 0xb7705800 Threw 0xa9e46058 at /HUDSON/workspace/jdk7u13-2-build-linux-i586-product/jdk7u13/hotspot/src/share/vm/prims/jni.cpp:3994
Event: 2.436 Thread 0xb7705800 Threw 0xa9e86db0 at /HUDSON/workspace/jdk7u13-2-build-linux-i586-product/jdk7u13/hotspot/src/share/vm/prims/jvm.cpp:1166

Events (10 events):
Event: 2.641 loading class 0x8e307780 done
Event: 2.641 loading class 0x8e3074c0 done
Event: 2.641 loading class 0x8eafd9a0
Event: 2.665 loading class 0x8eafd9a0 done
Event: 2.665 loading class 0x8eafd9d0
Event: 2.685 loading class 0x8eafd9d0 done
Event: 2.685 loading class 0x8eafda00
Event: 2.685 loading class 0x8eafda00 done
Event: 2.685 loading class 0x8eafd970
Event: 2.686 loading class 0x8eafd970 done


Dynamic libraries:
00110000-00117000 r-xp 00000000 fd:00 144915     /lib/librt-2.13.so
00117000-00118000 r--p 00006000 fd:00 144915     /lib/librt-2.13.so
00118000-00119000 rw-p 00007000 fd:00 144915     /lib/librt-2.13.so
00119000-00130000 r-xp 00000000 00:13 127        /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/libzip.so
00130000-00131000 rw-p 00017000 00:13 127        /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/libzip.so
002ce000-002f6000 r-xp 00000000 fd:00 144905     /lib/libm-2.13.so
002f6000-002f7000 r--p 00027000 fd:00 144905     /lib/libm-2.13.so
002f7000-002f8000 rw-p 00028000 fd:00 144905     /lib/libm-2.13.so
00479000-00484000 r-xp 00000000 00:13 124        /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/libverify.so
00484000-00485000 rw-p 0000b000 00:13 124        /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/libverify.so
004c4000-004c5000 r-xp 00000000 00:00 0          [vdso]
004ed000-0050a000 r-xp 00000000 fd:00 134088     /lib/ld-2.13.so
0050a000-0050b000 r--p 0001c000 fd:00 134088     /lib/ld-2.13.so
0050b000-0050c000 rw-p 0001d000 fd:00 134088     /lib/ld-2.13.so
00581000-00595000 r-xp 00000000 00:13 151        /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/libnet.so
00595000-00596000 rw-p 00014000 00:13 151        /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/libnet.so
0064b000-0065e000 r-xp 00000000 00:13 119        /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/jli/libjli.so
0065e000-0065f000 rw-p 00012000 00:13 119        /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/jli/libjli.so
0075a000-0075d000 r-xp 00000000 fd:00 144904     /lib/libdl-2.13.so
0075d000-0075e000 r--p 00002000 fd:00 144904     /lib/libdl-2.13.so
0075e000-0075f000 rw-p 00003000 fd:00 144904     /lib/libdl-2.13.so
00879000-00884000 r-xp 00000000 fd:00 144909     /lib/libnss_files-2.13.so
00884000-00885000 r--p 0000a000 fd:00 144909     /lib/libnss_files-2.13.so
00885000-00886000 rw-p 0000b000 fd:00 144909     /lib/libnss_files-2.13.so
0090a000-00921000 r-xp 00000000 fd:00 144913     /lib/libpthread-2.13.so
00921000-00922000 r--p 00016000 fd:00 144913     /lib/libpthread-2.13.so
00922000-00923000 rw-p 00017000 fd:00 144913     /lib/libpthread-2.13.so
00923000-00925000 rw-p 00000000 00:00 0
00997000-009ba000 r-xp 00000000 00:13 120        /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/libjava.so
009ba000-009bb000 rw-p 00023000 00:13 120        /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/libjava.so
00bad000-00d30000 r-xp 00000000 fd:00 144901     /lib/libc-2.13.so
00d30000-00d31000 ---p 00183000 fd:00 144901     /lib/libc-2.13.so
00d31000-00d33000 r--p 00183000 fd:00 144901     /lib/libc-2.13.so
00d33000-00d34000 rw-p 00185000 fd:00 144901     /lib/libc-2.13.so
00d34000-00d37000 rw-p 00000000 00:00 0
00d37000-014f0000 r-xp 00000000 00:13 123        /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/server/libjvm.so
014f0000-01542000 rw-p 007b9000 00:13 123        /home/egenera/build/java/jdk1.7.0_13/jre/lib/i386/server/libjvm.so
01542000-01964000 rw-p 00000000 00:00 0
08048000-08049000 r-xp 00000000 00:13 113        /home/egenera/build/java/jdk1.7.0_13/bin/java
08049000-0804a000 rw-p 00000000 00:13 113        /home/egenera/build/java/jdk1.7.0_13/bin/java
096ab000-096cc000 rw-p 00000000 00:00 0          [heap]
8e12c000-8e300000 rw-p 00000000 00:00 0
8e300000-8e328000 rw-p 00000000 00:00 0
8e328000-8e400000 ---p 00000000 00:00 0
8e42c000-8e42d000 ---p 00000000 00:00 0
8e42d000-8e4ad000 rw-p 00000000 00:00 0
8e4ad000-8e4b0000 ---p 00000000 00:00 0
8e4b0000-8e4fe000 rw-p 00000000 00:00 0
8e4fe000-8e501000 ---p 00000000 00:00 0
8e501000-8e57f000 rw-p 00000000 00:00 0
8e57f000-8e582000 ---p 00000000 00:00 0
8e582000-8e600000 rw-p 00000000 00:00 0
8e600000-8e800000 r--p 00000000 fd:00 148603     /usr/lib/locale/locale-archive
8e800000-8e821000 rw-p 00000000 00:00 0
8e821000-8e900000 ---p 00000000 00:00 0
8e900000-8e921000 rw-p 00000000 00:00 0
8e921000-8ea00000 ---p 00000000 00:00 0
8ea00000-8eaff000 rw-p 00000000 00:00 0
8eaff000-8eb00000 ---p 00000000 00:00 0
8eb2b000-8eb2c000 ---p 00000000 00:00 0
8eb2c000-8ebf7000 rw-p 00000000 00:00 0
8ebf7000-8edb4000 r--s 039d8000 00:13 129        /home/egenera/build/java/jdk1.7.0_13/jre/lib/rt.jar
8edb4000-90500000 rw-p 00000000 00:00 0
90500000-90521000 rw-p 00000000 00:00 0
90521000-90600000 ---p 00000000 00:00 0
9062e000-90631000 ---p 00000000 00:00 0
90631000-9067f000 rw-p 00000000 00:00 0
9067f000-90680000 ---p 00000000 00:00 0
90680000-90700000 rw-p 00000000 00:00 0
90700000-90721000 rw-p 00000000 00:00 0
90721000-90800000 ---p 00000000 00:00 0
90800000-90821000 rw-p 00000000 00:00 0
90821000-90900000 ---p 00000000 00:00 0
9092e000-90931000 ---p 00000000 00:00 0
90931000-9097f000 rw-p 00000000 00:00 0
9097f000-90980000 ---p 00000000 00:00 0
90980000-90a00000 rw-p 00000000 00:00 0
90a00000-90a21000 rw-p 00000000 00:00 0
90a21000-90b00000 ---p 00000000 00:00 0
90b08000-90b0b000 ---p 00000000 00:00 0
90b0b000-90b59000 rw-p 00000000 00:00 0
90b59000-90b5a000 ---p 00000000 00:00 0
90b5a000-90bda000 rw-p 00000000 00:00 0
90bda000-90bdb000 ---p 00000000 00:00 0
90bdb000-90c63000 rw-p 00000000 00:00 0
90c63000-90c7b000 rw-p 00000000 00:00 0
90c7b000-90c86000 rw-p 00000000 00:00 0
90c86000-90d23000 rw-p 00000000 00:00 0
90d23000-90d2b000 rw-p 00000000 00:00 0
90d2b000-90d43000 rw-p 00000000 00:00 0
90d43000-90d4e000 rw-p 00000000 00:00 0
90d4e000-90deb000 rw-p 00000000 00:00 0
90deb000-90df1000 rw-p 00000000 00:00 0
90df1000-90e3f000 rw-p 00000000 00:00 0
90e3f000-91e40000 rw-p 00000000 00:00 0
91e40000-94e40000 rw-p 00000000 00:00 0
94e40000-96340000 rw-p 00000000 00:00 0
96340000-a9e40000 rw-p 00000000 00:00 0
a9e40000-aa8c0000 rw-p 00000000 00:00 0
aa8c0000-b4640000 rw-p 00000000 00:00 0
b4640000-b4649000 rw-p 00000000 00:00 0
b4649000-b4700000 rw-p 00000000 00:00 0
b4700000-b4940000 rwxp 00000000 00:00 0
b4940000-b77f9000 rw-p 00000000 00:00 0
b77f9000-b7800000 ---p 00000000 00:00 0
b780c000-b7819000 rw-p 00000000 00:00 0
b7819000-b7821000 rw-s 00000000 fd:00 28864      /tmp/hsperfdata_root/14012
b7821000-b7824000 ---p 00000000 00:00 0
b7824000-b7874000 rw-p 00000000 00:00 0
b7877000-b7879000 rw-p 00000000 00:00 0
b7879000-b787a000 r--p 00000000 00:00 0
b787a000-b787b000 rw-p 00000000 00:00 0
bfe20000-bfe41000 rw-p 00000000 00:00 0          [stack]

VM Arguments:
java_command: Network
Launcher Type: SUN_STANDARD

Environment Variables:
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/opt/egenera/bin:/opt/panmgr/bin:/root/bin
SHELL=/bin/bash

Signal Handlers:
SIGSEGV: [libjvm.so+0x720f90], sa_mask[0]=0x7ffbfeff, sa_flags=0x10000004
SIGBUS: [libjvm.so+0x720f90], sa_mask[0]=0x7ffbfeff, sa_flags=0x10000004
SIGFPE: [libjvm.so+0x5d9de0], sa_mask[0]=0x7ffbfeff, sa_flags=0x10000004
SIGPIPE: [libjvm.so+0x5d9de0], sa_mask[0]=0x7ffbfeff, sa_flags=0x10000004
SIGXFSZ: [libjvm.so+0x5d9de0], sa_mask[0]=0x7ffbfeff, sa_flags=0x10000004
SIGILL: [libjvm.so+0x5d9de0], sa_mask[0]=0x7ffbfeff, sa_flags=0x10000004
SIGUSR1: SIG_DFL, sa_mask[0]=0x00000000, sa_flags=0x00000000
SIGUSR2: [libjvm.so+0x5d96c0], sa_mask[0]=0x00000000, sa_flags=0x10000004
SIGHUP: [libjvm.so+0x5dbcb0], sa_mask[0]=0x7ffbfeff, sa_flags=0x10000004
SIGINT: [libjvm.so+0x5dbcb0], sa_mask[0]=0x7ffbfeff, sa_flags=0x10000004
SIGTERM: [libjvm.so+0x5dbcb0], sa_mask[0]=0x7ffbfeff, sa_flags=0x10000004
SIGQUIT: [libjvm.so+0x5dbcb0], sa_mask[0]=0x7ffbfeff, sa_flags=0x10000004


---------------  S Y S T E M  ---------------

OS:Fedora release 14 


( This report has more than 16,000 characters and has been truncated. )
Comments
Closing as a dup of 7078386. Additionally, requested approval to backport 7078386 to 7u-dev.
06-03-2013
7078386 has been fixed in JDK8. This issue is reported against 7u13. No surprise that it still fails in 7u13 then, if it is a dup of 7078386 .
06-03-2013