RFR: 8350201: Out of bounds access on Linux aarch64 in os::print_register_info

Kim Barrett kbarrett at openjdk.org
Tue Feb 18 06:52:08 UTC 2025


On Mon, 17 Feb 2025 15:16:22 GMT, Matthias Baesken <mbaesken at openjdk.org> wrote:

> When running jtreg test VendorInfoPluginsTest we noticed the following issue (ubsanized binaries were used)
> 
> 
> jdk/src/hotspot/os_cpu/linux_aarch64/os_linux_aarch64.cpp:369:46: runtime error: index 31 out of bounds for type 'long long unsigned int [31]'
>     #0 0xffff84380470 in os::print_register_info(outputStream*, void const*, int&) (/jtreg_jdk_tier2_work/JTwork/scratch/10/images/vendorinfo.image/lib/server/libjvm.so+0x4d80470)
>     #1 0xffff84bf566c in VMError::report(outputStream*, bool) (/jtreg_jdk_tier2_work/JTwork/scratch/10/images/vendorinfo.image/lib/server/libjvm.so+0x55f566c)
>     #2 0xffff84bf812c in VMError::report_and_die(int, char const*, char const*, std::__va_list, Thread*, unsigned char*, void const*, void const*, char const*, int, unsigned long) (/jtreg_jdk_tier2_work/JTwork/scratch/10/images/vendorinfo.image/lib/server/libjvm.so+0x55f812c)
>     #3 0xffff84bf90b4 in VMError::report_and_die(Thread*, unsigned int, unsigned char*, void const*, void const*, char const*, ...) (/jtreg_jdk_tier2_work/JTwork/scratch/10/images/vendorinfo.image/lib/server/libjvm.so+0x55f90b4)
>     #4 0xffff84bf9138 in VMError::report_and_die(Thread*, unsigned int, unsigned char*, void const*, void const*) (/jtreg_jdk_tier2_work/JTwork/scratch/10/images/vendorinfo.image/lib/server/libjvm.so+0x55f9138)
>     #5 0xffff8489ede8 in JVM_handle_linux_signal (/jtreg_jdk_tier2_work/JTwork/scratch/10/images/vendorinfo.image/lib/server/libjvm.so+0x529ede8)
> 
> 
> Looks like we have registers 0 - 30 according to sys/ucontext.h on Linux aarch64
> 
> 
> typedef struct
>   {
>     unsigned long long int __ctx(fault_address);
>     unsigned long long int __ctx(regs)[31];
>     ....
>   } mcontext_t;
> 
> 
> and according to the arm developer documentation
> 
> https://developer.arm.com/documentation/100069/0606/Overview-of-AArch64-state/Registers-in-AArch64-state#:~:text=In%20AArch64%20state%2C%20the%20following,are%20accessible%20as%20W0%2DW30.
> 
> "Thirty-one 64-bit general-purpose registers X0-X30, the bottom halves of which are accessible as W0-W30."

aarch64.ad has a comment that probably ought to be fixed:
https://github.com/openjdk/jdk/blame/8df804005ed772936fd77a4c0335a5620f909570/src/hotspot/cpu/aarch64/aarch64.ad#L71

It also has SP as R31, but I guess that's okay.

Over in register_aarch64.hpp we have `number_of_registers = 32`, including
r31_sp.  And `zr` and `sp` are 32 and 33, respectively.  So that all seems a
little bit confusing.  But it all seems to work...

I mostly bring that up because I would have thought print_register_info could
get the number of registers from some common definition rather than using a
hard-coded value.  Oh well...

-------------

Changes requested by kbarrett (Reviewer).

PR Review: https://git.openjdk.org/jdk/pull/23667#pullrequestreview-2622593038


More information about the hotspot-runtime-dev mailing list