Memory leak with ArrayRetainableByteBufferPool?

[jiscfoo]

• Jetty version: 10.0.7
• Amazon Corretto 11.0.9.1
• Windows Server

Description

After a few days of use of the Shibboleth Identity Provider under moderate load, service stops working. Sometimes with high-CPU or sometimes with idle CPU. It appears that Jetty just "stops". I think that some JVM threads may still be working as some background tasks sometimes produce lines in the log after the web service has stopped.

Stack trace is available here: stack.txt

Looking at a heap dump from an instance in the broken state using Eclipse MAT, the "Leak Suspects" report shows two suspects:

• One instance of org.eclipse.jetty.io.ArrayRetainableByteBufferPool$Bucket loaded by org.eclipse.jetty.start.Classpath$Loader @ 0x807fafb0 occupies 1,036,941,960 (48.84%) bytes. The memory is accumulated in one instance of java.lang.Object[], loaded by <system class loader>, which occupies 1,036,941,768 (48.84%) bytes.
• One instance of org.eclipse.jetty.io.ArrayRetainableByteBufferPool$Bucket loaded by org.eclipse.jetty.start.Classpath$Loader @ 0x807fafb0 occupies 1,036,853,888 (48.83%) bytes. The memory is accumulated in one instance of java.lang.Object[], loaded by <system class loader>, which occupies 1,036,853,696 (48.83%) bytes

The "Histogram" shows a lot of byte[] objects which appears to be many instances similar to:

Class Name                                                                                      | Shallow Heap | Retained Heap
------------------------------------------------------------------------------------------------------------------------------
byte[17408] @ 0x80000000  GET /.................................................................|       17,424 |        17,424
'- hb java.nio.HeapByteBuffer @ 0x87119ff8                                                      |           48 |        17,472
   '- buffer org.eclipse.jetty.io.RetainableByteBuffer @ 0x87119fd8                             |           32 |        17,560
      '- pooled org.eclipse.jetty.util.Pool$MonoEntry @ 0x87119fb8                              |           32 |        17,608
         '- arg$1 org.eclipse.jetty.io.ArrayRetainableByteBufferPool$$Lambda$623 @ 0x8711a038   |           16 |            16
            '- releaser org.eclipse.jetty.io.RetainableByteBuffer @ 0x87119fd8                  |           32 |        17,560
------------------------------------------------------------------------------------------------------------------------------

We think this is MonoEntries not being released from the pool but do not know where.

How to reproduce?

Currently unknown

[joakime]

Upgrade.

Use Jetty 10.0.11, as it has specific fixes for this that were done in PR #8165

[jiscfoo]

Upgrade.

Use Jetty 10.0.11, as it has specific fixes for this that were done in PR #8165

Thanks for the quick response! If a quick upgrade is not available, is there a workaround?

[joakime]

@jiscfoo see the security advisory about this class ...

GHSA-8mpp-f3f7-xc28

[jiscfoo]

Thanks for the details