RFR: 8371918: aarch64: Incorrect pointer dereference in TemplateInterpreterGenerator::generate_native_entry
Kurt Miller
kurt at openjdk.org
Fri Nov 14 17:53:21 UTC 2025
…rGenerator::generate_native_entry
I believe there's a incorrect pointer deference in `TemplateInterpreterGenerator::generate_native_entry()` in this part of the code:
// get native function entry point in r10
{
Label L;
__ ldr(r10, Address(rmethod, Method::native_function_offset()));
ExternalAddress unsatisfied(SharedRuntime::native_method_throw_unsatisfied_link_error_entry());
__ lea(rscratch2, unsatisfied);
__ ldr(rscratch2, rscratch2);
__ cmp(r10, rscratch2);
__ br(Assembler::NE, L);
__ call_VM(noreg,
CAST_FROM_FN_PTR(address,
InterpreterRuntime::prepare_native_call),
rmethod);
__ get_method(rmethod);
__ ldr(r10, Address(rmethod, Method::native_function_offset()));
__ bind(L);
}
If I understand this correctly, the entry point for unsatisfied link error is loaded into `rscratch2`. The next instruction, `ldr(rscratch2, rscratch2)`, dereferences that pointer and reads from the text segment the initial instructions at the entry point into `rscratch2`. It then compares the native method entry point in `r10` with the initial instructions loaded into `rscratch2` which will never match. I believe the intent here was to compare the native method entry point with the unsatisfied link error entry point and the `ldr(rscratch2, rscratch2)` instruction should be removed.
This was found on OpenBSD/aarch64. OpenBSD has a security feature where the text segments are marked execute only and do not allow reads independent of execution. the` ldr(rscratch2, rscratch2)` instruction causes a segfault because it is reading the text segment. While this bug was found on OpenBSD I believe it applies to all OS on aaarch64.
This change removes the errant aarch64 hotspot assembly instruction that was reading from libjvm.so .text segment.
Updated comment with markdown for code.
-------------
Commit messages:
- 8371918: aarch64: Incorrect pointer dereference in TemplateInterpreterGenerator::generate_native_entry
Changes: https://git.openjdk.org/jdk/pull/28327/files
Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=28327&range=00
Issue: https://bugs.openjdk.org/browse/JDK-8371918
Stats: 1 line in 1 file changed: 0 ins; 1 del; 0 mod
Patch: https://git.openjdk.org/jdk/pull/28327.diff
Fetch: git fetch https://git.openjdk.org/jdk.git pull/28327/head:pull/28327
PR: https://git.openjdk.org/jdk/pull/28327
More information about the hotspot-dev
mailing list