RFR: 8369393: NMT: poison the canaries of malloc header under ASAN build [v11]

Johan Sjölen jsjolen at openjdk.org
Wed Oct 15 07:49:03 UTC 2025


On Wed, 15 Oct 2025 07:31:58 GMT, Afshin Zafari <azafari at openjdk.org> wrote:

>> NMT can detect malloc'd memory corruption using canary tests at header and footer of every memory region. This can only be done at free time of the memory where NNT checks the canaries and report error if they are not as expected.
>> In this PR, the canary parts also are poisoned using ASAN API to get notified whenever a read/write op is done. on the canary parts. `_size` member of the malloc header is also poisoned, since it is used for finding the footer address.
>
> Afshin Zafari has updated the pull request incrementally with one additional commit since the last revision:
> 
>   another NOT_LP64

Changes requested by jsjolen (Reviewer).

src/hotspot/share/nmt/mallocHeader.hpp line 96:

> 94:  public:
> 95:   AsanPoisoningHelper() = delete;
> 96:   AsanPoisoningHelper(U* addr) : _memory_region(addr) {

This is what I meant, then you don't need any casting when passing along the args.

```c++
template<typename T>
class AsanPoisoningHelper {

public:
  AsanPoisoningHelper(T* addr) : _memory_region(addr) {
    #if INCLUDE_ASAN
      ASAN_UNPOISON_MEMORY_REGION(reinterpret_cast<char*>(_memory_region), sizeof(T));
    #endif
  }
};

test/hotspot/gtest/nmt/test_nmt_buffer_overflow_detection.cpp line 330:

> 328:   a = 3;
> 329:   EXPECT_EQ(a, 3);
> 330: }

If the intent of this test is to test ASAN when it's disabled, then move the test to before the ASAN-inclusion test, and delete the `APH<void>` template specialization.

-------------

PR Review: https://git.openjdk.org/jdk/pull/27685#pullrequestreview-3338843340
PR Review Comment: https://git.openjdk.org/jdk/pull/27685#discussion_r2431468499
PR Review Comment: https://git.openjdk.org/jdk/pull/27685#discussion_r2431452168


More information about the hotspot-runtime-dev mailing list