RFR: 8356643: Switching focus causes Segmentation Fault on zLinux
Amit Kumar
amitkumar at openjdk.org
Fri May 16 11:35:29 UTC 2025
In OpenJKD code, for big endian architecture, `XIMPreeditState` is considered `unsigned int` whereas in `xlib` code it is `unsigned long` [source](https://github.com/mirror/libX11/blob/ff8706a5eae25b8bafce300527079f68a201d27f/include/X11/Xlib.h#L1267).
Now, openjdk compiled code pushes a frame and allots the address, just 4 bytes away, because it considers state to be a int, from the store `callers_sp` :
2: /x $r15 = 0x3ff8137da20
3: x/2xg 0x3ff8137da20
0x3ff8137da20: 0x000003ff8137daf0 0x000003fffa2a9a86
`0x000003ff8137daf0` is callers sp for s390x. And this is address for `state` :
(gdb) p &state
$9 = (unsigned int *) 0x3ff8137da1c
which is just 4 byte away from the callers sp:
(gdb) p/x 0x3ff8137da20 - 4
$10 = 0x3ff8137da1c
Now while executing `_XimDecodePreeditState` method from xlib library where `state` is of type `unsigned long` we are going to emit a 8-byte instruction.:
(gdb) disassemble _XimDecodePreeditState
Dump of assembler code for function _XimDecodePreeditState:
=> 0x000003ff989f3360 <+0>: llgf %r1,8(%r2)
0x000003ff989f3366 <+6>: lghi %r2,1
0x000003ff989f336a <+10>: lg %r1,0(%r3,%r1)
0x000003ff989f3370 <+16>: stg %r1,0(%r4)
0x000003ff989f3376 <+22>: br %r14
End of assembler dump.
`0x000003ff989f3370 <+16>: stg %r1,0(%r4) ` here `r4` is pointing the `state` variable. And the moment this write happens we will corrupt the first 4 byte of callers_sp, which will cause issue while the stack-unwinding. And at the end JVM will crash with segmentation fault. This is always reproducible with the test case provided in the JBS. And test only failed with compiler (c1 & c2) but passed always with interpreter.
-------------
Commit messages:
- fix datatype mismatch
Changes: https://git.openjdk.org/jdk/pull/25266/files
Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=25266&range=00
Issue: https://bugs.openjdk.org/browse/JDK-8356643
Stats: 5 lines in 1 file changed: 0 ins; 5 del; 0 mod
Patch: https://git.openjdk.org/jdk/pull/25266.diff
Fetch: git fetch https://git.openjdk.org/jdk.git pull/25266/head:pull/25266
PR: https://git.openjdk.org/jdk/pull/25266
More information about the client-libs-dev
mailing list