Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an...
-
date post
22-Dec-2015 -
Category
Documents
-
view
219 -
download
0
Transcript of Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an...
![Page 1: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/1.jpg)
Quarantine: A Framework to Mitigate Memory Errors in JNI Applications
Du Li , Witawas Srisa-an
University of Nebraska-Lincoln
![Page 2: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/2.jpg)
JNI(Java Native Interface)
• Integrating legacy code, making use of existing libraries, components.• Developing applications in multiple languages
– Java UI + C backend
Java Code JNI Native Code
Application
2
![Page 3: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/3.jpg)
When Java meets C, C++ …
• Issues in JNI • Type mismatching• Access mechanism mismatching
• Memory leaking• Memory safety• …
3
![Page 4: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/4.jpg)
Example of JNI App
Get()Put()…
Java C
Interface Table
JNI Hashtable
4
![Page 5: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/5.jpg)
Example of JNI App
int addr
Get()Put()…
Java C
Interface Table
32-bit
JNI Hashtable
5
![Page 6: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/6.jpg)
Example of JNI App
int addr
Get()Put()…
Java C
Interface Table
64-bit
JNI Hashtable
6
![Page 7: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/7.jpg)
Example of JNI App
int addr
Get()Put()…
Java C
Interface Table
64-bit
JNI Hashtable
7
![Page 8: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/8.jpg)
And Even Worse …
8
![Page 9: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/9.jpg)
Motivation
• JNI can cause nasty memory bugs
• Lack of mechanism to address or mitigate memory faults in JNI applications
9
![Page 10: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/10.jpg)
Empirical Study on JNI Bugs
• 126 JNI related bugs are identified in OpenJDK 1.6
• 59 out of 126 bugs are security critical
• “A time bomb”
An Empirical Security Study of the Native Code in the JDK. G. Tan and J. Croft. In USENIX Security 2008
10
![Page 11: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/11.jpg)
Bug Patterns
• C pointers as Java integers
• Memory Management Flaws
• Buffer Overflows
• Mishandling JNI exceptions
• Race conditions in file accesses
• Insufficient error checkingAn Empirical Security Study of the Native Code in the JDK. G. Tan and J. Croft. In USENIX Security 2008
11
![Page 12: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/12.jpg)
Bug Patterns
• C pointers as Java integers
• Memory Management Flaws
• Buffer Overflows
• Mishandling JNI exceptions
• Race conditions in file accesses
• Insufficient error checking
Related to memory faults Caused by mismatching of heap management mechanism
An Empirical Security Study of the Native Code in the JDK. G. Tan and J. Croft. In USENIX Security 2008
12
![Page 13: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/13.jpg)
C pointers as Java Integers
• As we showed in JNI hashtable example– Store C pointers as Java integers– Pass back to C and cast to pointers when
needed– Native code will update the Java Interger– It can corrupt Java heap by writing arbitrary
data
13
![Page 14: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/14.jpg)
Memory Management Flaws
• Automatic memory management in Java
• Manual memory management for Java heap in JNI– e.g. Get/ReleaseIntArrayElements,
Get/ReleaseStringUTFChars …
14
![Page 15: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/15.jpg)
Buffer Overflow
• No type safety in some native code– C is not type safe language
• No type checking in JNI read/write – e.g. native code can write a float value to a
byte type variable in Java
15
![Page 16: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/16.jpg)
Challenge
• Existing techniques(DieHard, LeakingChaser) can detect and mitigate the above issues– But the overhead is too high to feasibly
apply such techniques to the whole heap
16
Emery D. Berger and Benjamin G. Zorn. 2006. DieHard: probabilistic memory safety for unsafe languages (PLDI '06)
Xu, Bond, Qin, Rountev, LeakChaser: Helping Programmers Narrow Down Causes of Memory Leaks (PLDI'11)
![Page 17: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/17.jpg)
Unsafe objects are few
Unsafe objects: objects accessible by native code
Less than 1% objects are unsafe.
17
Benchmark Allocated Objects Unsafe Objects % of Unsafe Objects
bloat 4359250 9371 0.215
fop 1365166 5225 0.383
hsqldb 1439461 93 0.006
jython 7464199 2329 0.031
luindex 1238977 4251 0.343
lusearch 3631775 321 0.009
pmd 949971 1617 0.170
xalan 2194726 157 0.007
SPECjbb2005 1579906124 1330 0.000
![Page 18: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/18.jpg)
Status
×
×
×
×
×
×
18
![Page 19: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/19.jpg)
Goal
××××
××
19
![Page 20: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/20.jpg)
Approach
• Quarantine– Identify unsafe objects– Segment identified unsafe objects– Apply treatment to segmented objects
20
![Page 21: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/21.jpg)
Identify Unsafe Objects
• Instrument “native” methods to find– Objects created by native code– Objects created by Java code and exposed
to native code
21
![Page 22: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/22.jpg)
Segmentation
All unsafe objects will be allocated in or copiedto JNI space
22
![Page 23: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/23.jpg)
Implementation
• Based on Jikes RVM 3.1.0– Build object migration mechanism– Change object header to record forwarding
address– Leverage the read/write barriers
23
![Page 24: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/24.jpg)
Runtime Overhead
24
![Page 25: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/25.jpg)
Breaking Down Overhead
25
![Page 26: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/26.jpg)
Experiment: Applying Padding
• Inspired by a mechanism in DieHard– Creating object x-times larger than the
actual size• Do this for every object• Do this for only quarantined objects
a b a b
26
![Page 27: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/27.jpg)
Experiment: Applying Padding
Performance of RVM with Quarantine with 2x Padding
27
Benchmark RVMpad Quarantinepad Speed-Up (%)
bloat 831 706 17.70
fop 198 146 35.61
hsqldb 344 347 -0.87
jython 337 325 3.69
luindex 225 215 4.65
lusearch 751 562 33.63
pmd 20 19 5.25
xalan 595 356 67.13
SPECjbb2005 3865 5249 35.80
Arithmetic mean 22.50
![Page 28: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/28.jpg)
Experiment: Applying Padding
GC Performance of RVM with Quarantine with 2x Padding
28
Benchmark RVMpad Quarantinepad
bloat 12 6
fop 5 2
hsqldb 7 6
jython 16 9
luindex 4 2
lusearch 22 11
pmd 3 2
xalan 12 6
SPECjbb2005 3865 2532
GC Invocations
![Page 29: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/29.jpg)
Conclusion
• Develop a framework – to identify JNI accessible objects– to segment JNI accessible objects– to facilitate applying protection technique to
mitigate JNI related bugs
29
![Page 30: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/30.jpg)
Acknowledgments
• Partial support for this work is provided by NSF (CNS-0720757) and AFOSR (FA9550-
09-1- 0129)
• We thank Laurence Hellyer for making the primitive barrier code available and spending time to answer our questions
30
![Page 31: Quarantine: A Framework to Mitigate Memory Errors in JNI Applications Du Li , Witawas Srisa-an University of Nebraska-Lincoln.](https://reader035.fdocuments.in/reader035/viewer/2022062421/56649d775503460f94a59d5b/html5/thumbnails/31.jpg)
Question & Answer & Discussion
31