[jira] [Created] (CASSANDRA-19912) SIGSEGV crash when FastByteOperations.copy is given a read-only ByteBuffer

["David Capwell (Jira)" <ji...@apache.org>]

David Capwell created CASSANDRA-19912:
-----------------------------------------

             Summary: SIGSEGV crash when FastByteOperations.copy is given a read-only ByteBuffer
                 Key: CASSANDRA-19912
                 URL: https://issues.apache.org/jira/browse/CASSANDRA-19912
             Project: Cassandra
          Issue Type: Bug
          Components: Legacy/Core
            Reporter: David Capwell


{code}
@Test
public void jvmCrash()
{
    ByteBuffer src = ByteBufferUtil.bytes(42).asReadOnlyBuffer();
    ByteBuffer buffer = ByteBuffer.allocate(4);
    FastByteOperations.copy(src, src.position(),
                            buffer, buffer.position(),
                            src.remaining());
}
{code}

This crashes the JVM with the following

{code}
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00000001015c6810, pid=30607, tid=5379
#
# JRE version: OpenJDK Runtime Environment JDK-11.0.15.10.2 (build 11.0.15+10-LTS)
# Java VM: OpenJDK 64-Bit Server VM JDK-11.0.15.10.2 (11.0.15+10-LTS, mixed mode, compressed oops, concurrent mark sweep gc, bsd-aarch64)
# Problematic frame:
# V  [libjvm.dylib+0x6f6810]  Unsafe_GetByte(JNIEnv_*, _jobject*, _jobject*, long)+0xb8
#
# No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /Users/dcapwell/src/github/apache/cassandra/cep-15-accord/hs_err_pid30607.log
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#

Process finished with exit code 134 (interrupted by signal 6: SIGABRT)
{code}

And the stack trace is

{code}
Stack: [0x000000016fc68000,0x000000016fccb000],  sp=0x000000016fcc95b0,  free space=389k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.dylib+0x6f6810]  Unsafe_GetByte(JNIEnv_*, _jobject*, _jobject*, long)+0xb8
j  jdk.internal.misc.Unsafe.getByte(Ljava/lang/Object;J)B+0 java.base@11.0.15
j  sun.misc.Unsafe.getByte(Ljava/lang/Object;J)B+5 jdk.unsupported@11.0.15
j  org.apache.cassandra.utils.FastByteOperations$UnsafeOperations.copy(Ljava/lang/Object;J[BII)V+35
j  org.apache.cassandra.utils.FastByteOperations$UnsafeOperations.copy(Ljava/lang/Object;JLjava/nio/ByteBuffer;II)V+22
j  org.apache.cassandra.utils.FastByteOperations$UnsafeOperations.copy(Ljava/nio/ByteBuffer;ILjava/nio/ByteBuffer;II)V+54
j  org.apache.cassandra.utils.FastByteOperations.copy(Ljava/nio/ByteBuffer;ILjava/nio/ByteBuffer;II)V+9
j  org.apache.cassandra.utils.FastByteOperationsTest.jvmCrashV2()V+28
{code}

The issue is that we think the read only BB doesn’t have an array even though its a heap buffer, so we try to do direct memory access and crash.

This was found in testing and I don’t see the code call “asReadOnlyBuffer” at all, so this looks localized to testing and not a production environment.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org