JNA: apps built with native-image cannot write into local Unix sockets

[pshirshov]

docker-java a popular library, fails to communicate with local docker instances when built by native-image but the same code works perfectly under JVM. It seems to be some kind of a weird problem with JNA built by NI or NI itself, at least docker-java developers think that.

Here is a simple repro: https://github.com/7mind/graalvm-native-image-jna-bad-address-bug-demo

Could you investigate please?

UPD:

1. Doesn't cannot connect to unix://localhost:80 when compiled with GraalVM docker-java/docker-java#1820 (open)
2. java.net.Socket fails on local Unix addresses when compiled with GraalVM native image, works well under JVM java-native-access/jna#1412 (closed, not a JNA issue according to the developer, the advice is to call the relevant APIs directly under NI, there are some additional details and diagnostics)
3. Native builds (GraalVM) run into UnsatisfiedLinkError libjnidispatch.so docker-java/docker-java#1714 (closed, ignored)

[pshirshov]

I've made a smaller example with a shorter stacktrace: https://github.com/7mind/graalvm-native-image-jna-bad-address-bug-demo/tree/ca7d3578e9081b64fcd0eede6a20d43ada2892ed

Exception in thread "main" java.io.IOException: com.sun.jna.LastErrorException: [14] Bad address
        at com.github.dockerjava.transport.DomainSocket.write(DomainSocket.java:92)
        at com.github.dockerjava.transport.Demo.main(Demo.java:10)
Caused by: com.sun.jna.LastErrorException: [14] Bad address
        at com.oracle.svm.jni.JNIJavaCallWrappers.jniInvoke_ARRAY_LastErrorException_constructor_d7fda9711fddff58a2e10e04b8efcf48373bdcf5(JNIJavaCallWrappers.java:0)
        at com.oracle.svm.jni.functions.JNIFunctions$NewObjectWithObjectArrayArgFunctionPointer.invoke(JNIFunctions.java)
        at com.oracle.svm.jni.functions.JNIFunctions.ThrowNew(JNIFunctions.java:818)
        at com.github.dockerjava.transport.DomainSocket.write(DomainSocket.java)
        at com.github.dockerjava.transport.DomainSocket.write(DomainSocket.java:90)
        ... 1 more

[pshirshov]

It's interesting that I can read from the socket w/o any problems, private native int read(int fd, ByteBuffer buffer, int count) throws LastErrorException; works. Though private native int write(int fd, ByteBuffer buffer, int count) throws LastErrorException; fails. The signatures are the same.

[pshirshov]

Here is an excerpt from the strace of the native-image:

socketpair(AF_UNIX, SOCK_STREAM, 0, [7, 8]) = 0
shutdown(7, SHUT_RDWR)                  = 0
close(8)                                = 0
socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 8
setsockopt(8, SOL_SOCKET, SO_PRIORITY, [1], 4) = 0
close(8)                                = 0
socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 8
setsockopt(8, SOL_TCP, TCP_KEEPIDLE, [1], 4) = 0
close(8)                                = 0
socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 8
setsockopt(8, SOL_TCP, TCP_KEEPCNT, [1], 4) = 0
close(8)                                = 0
socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 8
setsockopt(8, SOL_TCP, TCP_KEEPINTVL, [1], 4) = 0
close(8)                                = 0
socket(AF_UNIX, SOCK_STREAM, 0)         = 8
connect(8, {sa_family=AF_UNIX, sun_path="/var/run/docker.sock"}, 110) = 0
write(8, 0x10, 6)                       = -1 EFAULT (Bad address)

[pshirshov]

Another observation: in case I use ByteBuffer.allocateDirect instead of ByteBuffer.wrap write returns an error code and there is no exception being thrown.

The allocation looks like:

        ByteBuffer b = ByteBuffer.allocateDirect(6);
        b.put("GET /\n".getBytes());
        b.position(0);

The corresponding strace:

socketpair(AF_UNIX, SOCK_STREAM, 0, [7, 8]) = 0
shutdown(7, SHUT_RDWR)                  = 0
close(8)                                = 0
socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 8
setsockopt(8, SOL_SOCKET, SO_PRIORITY, [1], 4) = 0
close(8)                                = 0
socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 8
setsockopt(8, SOL_TCP, TCP_KEEPIDLE, [1], 4) = 0
close(8)                                = 0
socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 8
setsockopt(8, SOL_TCP, TCP_KEEPCNT, [1], 4) = 0
close(8)                                = 0
socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 8
setsockopt(8, SOL_TCP, TCP_KEEPINTVL, [1], 4) = 0
close(8)                                = 0
socket(AF_UNIX, SOCK_STREAM, 0)         = 8
connect(8, {sa_family=AF_UNIX, sun_path="/var/run/docker.sock"}, 110) = 0
write(1, "FD: 8", 5FD: 8)                    = 5

Same code works fine under JVM.

[pshirshov]

Seems to be relevant: #2152

That minimal test passes as it is and passes when I modify it to write into /var/run/docker.sock.

[oubidar-Abderrahim]

Thank you for reporting this, we will take a look into it and get back to you.

[oubidar-Abderrahim]

Tracked internally at GR--36862

[peterschmidt85]

I wonder if this issue is relevant too docker-java/docker-java#1820

[pshirshov]

Yes, it is.

[pshirshov]

@oubidar-Abderrahim @aabbou @loicottet @peter-hofer sorry about pinging you, but was there any progress on this?.. this blocks a lot of possible usecases

[pshirshov]

Seems like it works on 22.3. Also, oddly, it works on ol8-java17-22.1.0 but not ol8-java11-22.1.0 which I used before.

I'm using https://github.com/oracle/graalvm-reachability-metadata with automatically generated configs.