[Bug nptl/14562] New: threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[Bug nptl/14562] New: threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[vapier at gentoo dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

             Bug #: 14562
           Summary: threaded programs with x32 abi randomly crash with
                    arena.c:661: heap_trim: Assertion `p->size == (0|0x1)'
                    failed
           Product: glibc
           Version: 2.16
               URL: https://bugs.gentoo.org/show_bug.cgi?id=394175
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nptl
        AssignedTo: unassigned@sourceware.org
        ReportedBy: vapier@gentoo.org
                CC: drepper.fsp@gmail.com
    Classification: Unclassified


test case:
- use glibc-2.16 with x32 abi
- get a bunch of files (like ~150; perl man pages are a sample input)
- run `bzip2 -k <files>`
- run `pbzip2 -k -f <files> -p4`

see crash:
pbzip2: arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed.

this has happened with a other threaded programs (git & squashfs); see gentoo
bug for some more details

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nptl/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hjl.tools at gmail dot com

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> 2012-09-08 00:42:46 UTC ---
hjl/x32/release/2.15 branch is OK.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nptl/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

--- Comment #2 from H.J. Lu <hjl.tools at gmail dot com> 2012-09-08 01:03:14 UTC ---
Copy malloc from hjl/x32/release/2.15 branch makes the
problem goes away.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nptl/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

--- Comment #3 from H.J. Lu <hjl.tools at gmail dot com> 2012-09-08 04:03:06 UTC ---
The bug is triggered by MALLOC_ALIGNMENT=16.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|nptl                        |malloc
   Target Milestone|---                         |2.16

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

--- Comment #4 from H.J. Lu <hjl.tools at gmail dot com> 2012-09-08 14:52:34 UTC ---
663        assert(p->size == (0|PREV_INUSE)); /* must be fencepost */
(gdb) p p
$34 = (mchunkptr) 0xf55feff8
(gdb) 

p isn't 16-byte aligned.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

--- Comment #5 from H.J. Lu <hjl.tools at gmail dot com> 2012-09-08 15:30:13 UTC ---
The size of top chunk must be a multiple of MALLOC_ALIGNMENT.
But _int_new_arena has

  /* Set up the top chunk, with proper alignment. */
  ptr = (char *)(a + 1);
  misalign = (unsigned long)chunk2mem(ptr) & MALLOC_ALIGN_MASK;
  if (misalign > 0)
    ptr += MALLOC_ALIGNMENT - misalign;
  top(a) = (mchunkptr)ptr;
  set_head(top(a), (((char*)h + h->size) - ptr) | PREV_INUSE);

It doesn't check size requirement.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

--- Comment #6 from H.J. Lu <hjl.tools at gmail dot com> 2012-09-08 20:43:47 UTC ---
I am testing this patch:

diff --git a/malloc/arena.c b/malloc/arena.c
index f88b41d..ac5afc4 100644
--- a/malloc/arena.c
+++ b/malloc/arena.c
@@ -655,14 +655,22 @@ heap_trim(heap_info *heap, size_t pad)
   mchunkptr top_chunk = top(ar_ptr), p, bck, fwd;
   heap_info *prev_heap;
   long new_size, top_size, extra;
+  unsigned long misalign;

   /* Can this heap go away completely? */
   while(top_chunk == chunk_at_offset(heap, sizeof(*heap))) {
     prev_heap = heap->prev;
     p = chunk_at_offset(prev_heap, prev_heap->size - (MINSIZE-2*SIZE_SZ));
+    /* fencepost must be properly aligned.  */
+    misalign = ((unsigned long) p) & MALLOC_ALIGN_MASK;
+    if (misalign > 0)
+      {
+    p = (mchunkptr)(((unsigned long) p) & ~MALLOC_ALIGN_MASK);
+    misalign = MALLOC_ALIGNMENT - misalign;
+      }
     assert(p->size == (0|PREV_INUSE)); /* must be fencepost */
     p = prev_chunk(p);
-    new_size = chunksize(p) + (MINSIZE-2*SIZE_SZ);
+    new_size = chunksize(p) + (MINSIZE-2*SIZE_SZ) + misalign;
     assert(new_size>0 && new_size<(long)(2*MINSIZE));
     if(!prev_inuse(p))
       new_size += p->prev_size;

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

--- Comment #7 from H.J. Lu <hjl.tools at gmail dot com> 2012-09-08 20:48:37 UTC ---
This is the right one:

diff --git a/malloc/arena.c b/malloc/arena.c
index f88b41d..8d52109 100644
--- a/malloc/arena.c
+++ b/malloc/arena.c
@@ -655,14 +655,18 @@ heap_trim(heap_info *heap, size_t pad)
   mchunkptr top_chunk = top(ar_ptr), p, bck, fwd;
   heap_info *prev_heap;
   long new_size, top_size, extra;
+  unsigned long misalign;

   /* Can this heap go away completely? */
   while(top_chunk == chunk_at_offset(heap, sizeof(*heap))) {
     prev_heap = heap->prev;
     p = chunk_at_offset(prev_heap, prev_heap->size - (MINSIZE-2*SIZE_SZ));
+    /* fencepost must be properly aligned.  */
+    misalign = ((unsigned long) p) & MALLOC_ALIGN_MASK;
+    p = (mchunkptr)(((unsigned long) p) & ~MALLOC_ALIGN_MASK);
     assert(p->size == (0|PREV_INUSE)); /* must be fencepost */
     p = prev_chunk(p);
-    new_size = chunksize(p) + (MINSIZE-2*SIZE_SZ);
+    new_size = chunksize(p) + (MINSIZE-2*SIZE_SZ) + misalign;
     assert(new_size>0 && new_size<(long)(2*MINSIZE));
     if(!prev_inuse(p))
       new_size += p->prev_size;

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

--- Comment #8 from H.J. Lu <hjl.tools at gmail dot com> 2012-09-08 20:58:39 UTC ---
This one is better:

diff --git a/malloc/arena.c b/malloc/arena.c
index f88b41d..4727d1e 100644
--- a/malloc/arena.c
+++ b/malloc/arena.c
@@ -654,15 +654,18 @@ heap_trim(heap_info *heap, size_t pad)
   unsigned long pagesz = GLRO(dl_pagesize);
   mchunkptr top_chunk = top(ar_ptr), p, bck, fwd;
   heap_info *prev_heap;
-  long new_size, top_size, extra;
+  long new_size, top_size, extra, misalign;

   /* Can this heap go away completely? */
   while(top_chunk == chunk_at_offset(heap, sizeof(*heap))) {
     prev_heap = heap->prev;
     p = chunk_at_offset(prev_heap, prev_heap->size - (MINSIZE-2*SIZE_SZ));
+    /* fencepost must be properly aligned.  */
+    misalign = ((long) p) & MALLOC_ALIGN_MASK;
+    p = (mchunkptr)(((unsigned long) p) & ~MALLOC_ALIGN_MASK);
     assert(p->size == (0|PREV_INUSE)); /* must be fencepost */
     p = prev_chunk(p);
-    new_size = chunksize(p) + (MINSIZE-2*SIZE_SZ);
+    new_size = chunksize(p) + (MINSIZE-2*SIZE_SZ) + misalign;
     assert(new_size>0 && new_size<(long)(2*MINSIZE));
     if(!prev_inuse(p))
       new_size += p->prev_size;

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |WAITING
         AssignedTo|unassigned at sourceware    |hjl.tools at gmail dot com
                   |dot org                     |

--- Comment #9 from H.J. Lu <hjl.tools at gmail dot com> 2012-09-09 18:29:59 UTC ---
Please try hjl/pr14562/2.16 branch.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[vapier at gentoo dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

--- Comment #10 from Mike Frysinger <vapier at gentoo dot org> 2012-09-10 05:42:25 UTC ---
(In reply to comment #9)

seems to be the same fix as in comment #8 which i've been running locally.  it
fixed the known bugs i was hitting, and haven't seen any new ones related to
this.  there are other bugs, but those are porting issues :).

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[dschepler at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

Daniel Schepler <dschepler at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dschepler at gmail dot com

--- Comment #11 from Daniel Schepler <dschepler at gmail dot com> 2012-09-10 17:59:14 UTC ---
(In reply to comment #9)
> Please try hjl/pr14562/2.16 branch.

As I already commented on the x32 list, for me this fixes among other things:
gij running ecj, and the GraphicsMagick, perl and pixman testsuites.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW

--- Comment #12 from H.J. Lu <hjl.tools at gmail dot com> 2012-09-25 00:20:53 UTC ---
Fixed in 2.17 by

http://sourceware.org/git/?p=glibc.git;a=commit;h=ced6f16ee919d12725840d43d007f1cfd67118df

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14562

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #13 from H.J. Lu <hjl.tools at gmail dot com> 2012-09-26 18:33:18 UTC ---
Fixed in 2.16.1 by

http://sourceware.org/git/?p=glibc.git;a=commit;h=bbe53ed2c311b7281837b6f3f24ddeb8f3d65697

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/14562] threaded programs with x32 abi randomly crash with arena.c:661: heap_trim: Assertion `p->size == (0|0x1)' failed

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14562

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.