Java 8 - pkcs11 threads hanging

[Martin Balao]

Hello Andra,

I've moved this discussion from discuss at ... to jdk8u-dev at ...

As Aleksey pointed out, the change in behavior you noticed in 8u is due
to the backport of JDK-6913047 [1] and the followup-fixes. There is a
release note here [2].

This issue has been around for a while, and we finally got it fixed in
8u232.

Regards,
Martin.-

--
[1] - https://bugs.openjdk.java.net/browse/JDK-6913047
[2] - https://bugs.openjdk.java.net/browse/JDK-8215018


On 2/26/20 1:12 PM, Aleksey Shipilev wrote:
> On 2/26/20 4:51 PM, Andra Bennett wrote:
>> Our application has upgraded from Open JDK 8 191 to JDK 8 232 and one of
>> the issues we were previously seeing - namely threads locking up in our
>> application when creating message signatures in a multithreaded environment
>> using Sun PKCS11 provider - has been mitigated.
>>
>> We know javax.crypto.Mac is no thread safe so we always created a new
>> instance. However, at a certain thread count our application would just
>> freeze (easily reproducible in a more focused unit test).
> 
> Have you posted that reproducer somewhere?
> 
>> We would like to see if there was a set of changes that would have targeted
>> pkcs11 threads hanging on PKCS11 create/destroy object threads, e.g.
>>
>> sun.security.pkcs11.wrapper.PKCS11.C_DestroyObject(Native Method)
>>     sun.security.pkcs11.SessionKeyRef.dispose(P11Key.java:1138)
>>     sun.security.pkcs11.SessionKeyRef.drainRefQueueBounded(P11Key.java:1114)
>>     sun.security.pkcs11.SessionKeyRef.<init>(P11Key.java:1129)
>>     sun.security.pkcs11.P11Key.<init>(P11Key.java:119)
>>     sun.security.pkcs11.P11Key$P11SecretKey.<init>(P11Key.java:405)
>>     sun.security.pkcs11.P11Key.secretKey(P11Key.java:292)
>>     sun.security.pkcs11.P11SecretKeyFactory.createKey(P11SecretKeyFactory.java:267)
>>     sun.security.pkcs11.P11SecretKeyFactory.convertKey(P11SecretKeyFactory.java:175)
>>     sun.security.pkcs11.P11SecretKeyFactory.convertKey(P11SecretKeyFactory.java:111)
>>     sun.security.pkcs11.P11Mac.engineInit(P11Mac.java:206)
>>     javax.crypto.Mac.chooseProvider(Mac.java:350)
> 
> These are PKCS11-related fixes in OpenJDK 8u:
>   https://bugs.openjdk.java.net/browse/JDK-8220513
>   https://bugs.openjdk.java.net/browse/JDK-8216597
>   https://bugs.openjdk.java.net/browse/JDK-6913047
>