4 ms·
Will sending `kill -11` to Java process raises a NullPointerException?
- tedunangst 2y agoHuh. I was going to say, no, of course not, it checks that you're actually accessing a null pointer, but where there's a will there's a way.
- DougBTX 2y agoThat was a pretty interesting twist in the story. There is a check, but due to a confusion in semantics it checks that the user is root (uid == 0) instead of the pointer!
- deleted 2y ago[deleted]
- o11c 2y agoNote that the question of "what layout does `siginfo_t` have here? (in particular, when to check the signal number vs the signal code)" is quite nontrivial. For the full answer, see the kernel's `siginfo_layout`. Note that there's an abominable case of the USB asyncio accessing the wrong member. [1]: https://elixir.bootlin.com/linux/v6.9.7/source/kernel/signal.c#L3332 https://elixir.bootlin.com/linux/v6.9.7/source/kernel/signal...
- a-dub 2y agomore interesting explanation and benchmarks: https://shipilev.net/jvm/anatomy-quarks/25-implicit-null-checks/ https://shipilev.net/jvm/anatomy-quarks/25-implicit-null-che... hotspot's always-on runtime profiling (and corresponding runtime dynamic optimization) is pretty neat.
- exabrial 2y agoThis was fascinating. Do you have to be the same user or group to send the signal? I'm absolutely positive the JVM is not the only thing using this trick, seems like it could be an attack vector.
- pcwalton 2y agoI don't think it would let you do anything interesting you can't already do, as it's fairly easy to trigger exceptions in Java programs (OOM, for example).
- PhilipRoman 2y agoI mean this in the nicest way possible, but how do you expect multi user security to work if you could kill/suspend/coredump anyone's processes?
- exabrial 2y agomy thought process was kill -11 wasn't a kill/suspend/coredump