JDK-8346866 : [ASAN] memoryReserver.cpp reported applying non-zero offset to non-null pointer produced null pointer
  • Type: Bug
  • Component: hotspot
  • Sub-Component: runtime
  • Affected Version: 25
  • Priority: P4
  • Status: New
  • Resolution: Unresolved
  • OS: linux,os_x
  • CPU: x86_64,aarch64
  • Submitted: 2024-12-27
  • Updated: 2024-12-31
Description
Fcuntion HeapReserver::Instance::try_reserve_range reported src/hotspot/share/memory/memoryReserver.cpp:441:21: runtime error: applying non-zero offset to non-null pointer 0x000080000000 produced null pointer.

The UndefinedBehaviorSanitizer output:
src/hotspot/share/memory/memoryReserver.cpp:441:21: runtime error: applying non-zero offset to non-null pointer 0x000080000000 produced null pointer
    #0 0x7fffef5288a0 in HeapReserver::Instance::try_reserve_range(char*, char*, unsigned long, char*, char*, unsigned long, unsigned long, unsigned long) /home/yansendao/git/jdk-asan-clang/src/hotspot/share/memory/memoryReserver.cpp:441:21
    #1 0x7fffef52955d in HeapReserver::Instance::reserve_compressed_oops_heap(unsigned long, unsigned long, unsigned long) /home/yansendao/git/jdk-asan-clang/src/hotspot/share/memory/memoryReserver.cpp:589:18
    #2 0x7fffef52ad9e in HeapReserver::Instance::reserve_heap(unsigned long, unsigned long, unsigned long) /home/yansendao/git/jdk-asan-clang/src/hotspot/share/memory/memoryReserver.cpp:677:12
    #3 0x7fffef52b0b7 in HeapReserver::reserve(unsigned long, unsigned long, unsigned long, char const*) /home/yansendao/git/jdk-asan-clang/src/hotspot/share/memory/memoryReserver.cpp:692:19
    #4 0x7ffff0786979 in Universe::reserve_heap(unsigned long, unsigned long) /home/yansendao/git/jdk-asan-clang/src/hotspot/share/memory/universe.cpp:960:27
    #5 0x7fffee03c7af in G1CollectedHeap::initialize() /home/yansendao/git/jdk-asan-clang/src/hotspot/share/gc/g1/g1CollectedHeap.cpp:1299:31
    #6 0x7ffff0785697 in Universe::initialize_heap() /home/yansendao/git/jdk-asan-clang/src/hotspot/share/memory/universe.cpp:929:26
    #7 0x7ffff07851e7 in universe_init() /home/yansendao/git/jdk-asan-clang/src/hotspot/share/memory/universe.cpp:881:17
    #8 0x7fffee5292db in init_globals() /home/yansendao/git/jdk-asan-clang/src/hotspot/share/runtime/init.cpp:133:17
    #9 0x7ffff06f1af8 in Threads::create_vm(JavaVMInitArgs*, bool*) /home/yansendao/git/jdk-asan-clang/src/hotspot/share/runtime/threads.cpp:574:17
    #10 0x7fffee935d7c in JNI_CreateJavaVM_inner(JavaVM_**, void**, void*) /home/yansendao/git/jdk-asan-clang/src/hotspot/share/prims/jni.cpp:3589:12
    #11 0x7fffee935a83 in JNI_CreateJavaVM /home/yansendao/git/jdk-asan-clang/src/hotspot/share/prims/jni.cpp:3680:14
    #12 0x7ffff7f8883b in InitializeJVM /home/yansendao/git/jdk-asan-clang/src/java.base/share/native/libjli/java.c:1495:9
    #13 0x7ffff7f7fbca in JavaMain /home/yansendao/git/jdk-asan-clang/src/java.base/share/native/libjli/java.c:494:10
    #14 0x7ffff7f9714c in ThreadJavaMain /home/yansendao/git/jdk-asan-clang/src/java.base/unix/native/libjli/java_md.c:649:29
    #15 0x7ffff7536a0a  (/home/yansendao/software/acc/x86_64/lib64/clang/17/lib/linux/libclang_rt.asan-x86_64.so+0x136a0a)
    #16 0x7ffff73c83fa in start_thread pthread_create.c
    #17 0x7ffff7220e82 in clone (/lib64/libc.so.6+0x3de82) (BuildId: 3308b7b1df603240fd3f43dd895bcb2ad87e7eb9)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/hotspot/share/memory/memoryReserver.cpp:441:21 in 

Configure command:
bash configure --with-jobs=128 --prefix=/home/yansendao/git/jdk-asan-clang/install-fastdebug --verbose --with-debug-level=fastdebug --enable-unlimited-crypto --with-vendor-name=yansendao --with-vendor-url=https://github.com/sendaoYan --with-vendor-bug-url=mailto:yansendao.ysd@alibaba-inc.com --with-vendor-vm-bug-url=mailto:yansendao.ysd@alibaba-inc.com --with-jvm-variants=server --with-boot-jdk=/home/yansendao/software/jdk/24/jdk-repo-binary --with-gtest=/home/yansendao/git/googletest-v1.14.x --with-jtreg=/home/yansendao/software/jdk/jtreg-7.4 --with-jmh=build/jmh/jars    --with-version-opt=6c591854 --with-zlib=system --enable-ccache --with-native-debug-symbols=external --with-extra-cflags=-shared-libasan --with-extra-cxxflags=-shared-libasan --with-extra-ldflags=-shared-libasan  --enable-asan --enable-ubsan --enable-lsan --with-toolchain-type=clang --with-toolchain-path=~/software/acc/x86_64/bin

Standalone reproduce command:
/home/yansendao/git/jdk-asan-clang/build/linux-x86_64-server-slowdebug/jdk/bin/java -Xms64M -Xmx2048M -cp /home/yansendao/git/jdk-asan-clang/build/linux-x86_64-server-slowdebug/buildtools/tools_jigsaw_classes --add-exports java.base/jdk.internal.module=ALL-UNNAMED build.tools.jigsaw.AddPackagesAttribute /home/yansendao/git/jdk-asan-clang/build/linux-x86_64-server-slowdebug/jdk

Clang version:
clang version 17.0.6 (Alibaba Cloud Compiler 17.0.6.1-24.05.10.alios7)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/yansendao/software/acc/x86_64/bin
Found candidate GCC installation: /usr/lib/gcc/x86_64-redhat-linux/10
Selected GCC installation: /usr/lib/gcc/x86_64-redhat-linux/10
Candidate multilib: .;@m64
Selected multilib: .;@m64
Comments
A pull request was submitted for review. Branch: master URL: https://git.openjdk.org/jdk/pull/22897 Date: 2024-12-31 04:00:16 +0000
31-12-2024
Looking at the coding // Try attach points from top to bottom. for (char* attach_point = highest_start; attach_point >= lowest_start && attach_point <= highest_start; // Avoid wrap around. attach_point -= stepsize) { ReservedSpace reserved = try_reserve_memory(size, alignment, page_size, attach_point); we subtract stepsize == attach_point from attach_point in this reported case (which leads to the reported warning); this seem not to make sense because attach_point is used later in the try_reserve_memory call as a 'requested address', and requesting nullptr looks not good to me . Should we maybe adjust the for loop and add something like && (uintptr_t)attach_point > stepsize to the checks ? [~stuefe] what do you think ?
30-12-2024
Ubsan on macOS aarch64 reports the same issue (this shows already in the build) : src/hotspot/share/memory/memoryReserver.cpp:441:21: runtime error: applying non-zero offset to non-null pointer 0x000080000000 produced null pointer UndefinedBehaviorSanitizer:DEADLYSIGNAL
30-12-2024
Temporary workaround solution: diff --git a/src/hotspot/share/memory/memoryReserver.cpp b/src/hotspot/share/memory/memoryReserver.cpp index d68736c7f2a..f83ae311991 100644 --- a/src/hotspot/share/memory/memoryReserver.cpp +++ b/src/hotspot/share/memory/memoryReserver.cpp @@ -34,6 +34,7 @@ #include "utilities/formatBuffer.hpp" #include "utilities/globalDefinitions.hpp" #include "utilities/powerOfTwo.hpp" +#include "sanitizers/ub.hpp" static void sanity_check_size_and_alignment(size_t size, size_t alignment) { assert(size > 0, "Precondition"); @@ -395,6 +396,7 @@ void HeapReserver::Instance::release(const ReservedSpace& reserved) { // Does not check whether the reserved memory actually is at requested_address, as the memory returned // might still fulfill the wishes of the caller. // Assures the memory is aligned to 'alignment'. +ATTRIBUTE_NO_UBSAN ReservedSpace HeapReserver::Instance::try_reserve_memory(size_t size, size_t alignment, size_t page_size, @@ -418,6 +420,7 @@ ReservedSpace HeapReserver::Instance::try_reserve_memory(size_t size, return {}; } +ATTRIBUTE_NO_UBSAN ReservedSpace HeapReserver::Instance::try_reserve_range(char *highest_start, char *lowest_start, size_t attach_point_alignment,
30-12-2024