Loading...

XML

Word

Printable

Type: Bug
Resolution: Done
Priority: Major
Fix Version/s: 1.4.12.Final
Affects Version/s: 1.4.10.Final
Component/s: JBoss Serialization
Labels:
None

Steps to Reproduce:

Hide

I don't have specific steps since it's a race condition, but it looks like the following is the problem.

There doesn't appear to be synchronization in SerializableClassRegistry or UnlockedHashMap, which means that multiple threads trying to call UnlockedHashMap.doPut at the time when a table resize is necessary would result in an infinite loop on line 201.

https://github.com/jboss-remoting/jboss-marshalling/blob/1.4.10.Final/api/src/main/java/org/jboss/marshalling/reflect/UnlockedHashMap.java#L201

Show
I don't have specific steps since it's a race condition, but it looks like the following is the problem. There doesn't appear to be synchronization in SerializableClassRegistry or UnlockedHashMap, which means that multiple threads trying to call UnlockedHashMap.doPut at the time when a table resize is necessary would result in an infinite loop on line 201. https://github.com/jboss-remoting/jboss-marshalling/blob/1.4.10.Final/api/src/main/java/org/jboss/marshalling/reflect/UnlockedHashMap.java#L201
Git Pull Request:
https://github.com/jboss-remoting/jboss-marshalling/commit/5317b359900bbc75fe7eebeb015aadb46d01eaa8
Bugzilla References:
https://bugzilla.redhat.com/show_bug.cgi?id=1452408

There appears to be a race condition in the caching of the SerializableClass in org.jboss.marshalling.reflect.SerializableClassRegistry.lookup() such that an infinite loop in UnlockedHashMap.doPut() is triggered.

The stacktrace is as follows:

"http-executor-threads - 200" #426 prio=5 os_prio=0 tid=0x00007eff14cc1800 nid=0x6d43 runnable [0x00007efef4559000]
   java.lang.Thread.State: RUNNABLE
        at org.jboss.marshalling.reflect.UnlockedHashMap.doPut(UnlockedHashMap.java:201)
        at org.jboss.marshalling.reflect.UnlockedHashMap.putIfAbsent(UnlockedHashMap.java:300)
        at org.jboss.marshalling.reflect.SerializableClassRegistry.lookup(SerializableClassRegistry.java:92)
        at org.jboss.marshalling.river.RiverUnmarshaller.doReadClassDescriptor(RiverUnmarshaller.java:985)
        at org.jboss.marshalling.river.RiverUnmarshaller.doReadArray(RiverUnmarshaller.java:1591)
        at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:329)
        at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:224)
        at org.jboss.marshalling.river.RiverUnmarshaller.readFields(RiverUnmarshaller.java:1745)
        at org.jboss.marshalling.river.RiverUnmarshaller.doInitSerializable(RiverUnmarshaller.java:1658)
        at org.jboss.marshalling.river.RiverUnmarshaller.doReadNewObject(RiverUnmarshaller.java:1285)
        at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:276)
        at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
        at org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
        at org.jboss.ejb.client.remoting.MethodInvocationResponseHandler$MethodInvocationResultProducer.getResult(MethodInvocationResponseHandler.java:108)
        at org.jboss.ejb.client.EJBClientInvocationContext.getResult(EJBClientInvocationContext.java:276)

is cloned by

JBEAP-11031 (7.0.z) Race condition in SerializableClassRegistry.lookup

Closed

Assignee:: David Lloyd

Reporter:: Daniel Atallah (Inactive)

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Created:: 2016/08/08 2:43 PM

Updated:: 2017/06/19 1:21 AM

Resolved:: 2017/05/18 6:17 PM

Details

Description

Attachments

Issue Links

Activity

People

Dates

Hide