[Bug malloc/31498] New: malloc/tst-free-errno-malloc-hugetlb1 test fails on arm64

[Bug malloc/31498] New: malloc/tst-free-errno-malloc-hugetlb1 test fails on arm64

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=31498

            Bug ID: 31498
           Summary: malloc/tst-free-errno-malloc-hugetlb1 test fails on
                    arm64
           Product: glibc
           Version: 2.37
            Status: NEW
          Severity: normal
          Priority: P2
         Component: malloc
          Assignee: unassigned at sourceware dot org
          Reporter: sam at gentoo dot org
                CC: adhemerval.zanella at linaro dot org
  Target Milestone: ---

Created attachment 15407
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15407&action=edit
lscpu

Proxying a bug report from leio@g.o.

```
$ uname -a
Linux mac-gentoo 6.6.0-asahi+ #19 SMP PREEMPT_DYNAMIC Sat Feb  3 14:46:34 EET
2024 aarch64 GNU/Linux
```

He gets one test failure with glibc-2.38:
```
$ cat tst-free-errno-malloc-hugetlb1.test-result 
FAIL: malloc/tst-free-errno-malloc-hugetlb1
original exit status 1
```

```
$ cat tst-free-errno-malloc-hugetlb1.out
Didn't expect signal from child: got `Aborted'
```

Backtrace isn't very informative:
```
(gdb) set args --library-path
/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/math:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/elf:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/dlfcn:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/nss:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/nis:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/rt:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/resolv:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/mathvec:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/support:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/nptl
/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/malloc/tst-free-errno-malloc-hugetlb1
(gdb) run
Starting program:
/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/elf/ld-linux-aarch64.so.1
--library-path
/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/math:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/elf:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/dlfcn:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/nss:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/nis:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/rt:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/resolv:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/mathvec:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/support:/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/nptl
/tmp/portage/sys-libs/glibc-2.38-r11/work/build-arm64-aarch64-unknown-linux-gnu-nptl/malloc/tst-free-errno-malloc-hugetlb1
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib64/libthread_db.so.1".
[Attaching after Thread 0xfffff7fe4020 (LWP 1606774) fork to child process
1606775]
[New inferior 3 (process 1606775)]
[Detaching after fork from parent process 1606774]
[Inferior 2 (process 1606774) detached]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib64/libthread_db.so.1".
double free or corruption (out)

Thread 3.1 "ld-linux-aarch6" received signal SIGABRT, Aborted.
[Switching to Thread 0xfffff7fe4020 (LWP 1606775)]
__pthread_kill_implementation (threadid=281474842378272, signo=signo@entry=6,
no_tid=no_tid@entry=0) at pthread_kill.c:44
44            return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO
(ret) : 0;
(gdb) t a a bt full

Thread 3.1 (Thread 0xfffff7fe4020 (LWP 1606775) "ld-linux-aarch6"):
#0  __pthread_kill_implementation (threadid=281474842378272,
signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
        tid = 1606775
        ret = 0
        pd = 0xfffff7fe4020
        old_mask = {__val = {281474842489360}}
        ret = <optimized out>
#1  0x0000fffff7e5a100 in __pthread_kill_internal (threadid=<optimized out>,
signo=6) at pthread_kill.c:78
No locals.
#2  0x0000fffff7e0b3bc in __GI_raise (sig=sig@entry=6) at
../sysdeps/posix/raise.c:26
        ret = <optimized out>
#3  0x0000fffff7df6b68 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x20, sa_sigaction = 0x20},
sa_mask = {__val = {0, 281474842165248, 281474842380128, 281474859286528,
281474842038288, 281474842378272, 18446744073709535232, 0, 16777216,
281474976702880, 281474976702800, 0, 281474842482608, 281474976703072,
281474842476544, 4}}, sa_flags = 1, sa_restorer = 0x18}
#4  0x0000fffff7e4dbc4 in __libc_message (fmt=fmt@entry=0xfffff7f2f930 "%s\n")
at ../sysdeps/posix/libc_fatal.c:150
        ap = {__stack = 0xffffffffe260, __gr_top = 0xffffffffe260, __vr_top =
0xffffffffe220, __gr_offs = -48, __vr_offs = 0}
        fd = 2
        list = <optimized out>
        nlist = <optimized out>
        cp = <optimized out>
#5  0x0000fffff7e64698 in malloc_printerr (str=str@entry=0xfffff7f2af00 "double
free or corruption (out)") at malloc.c:5765
No locals.
#6  0x0000fffff7e664f8 in _int_free_merge_chunk (av=0xfffff7f80970
<main_arena>, p=0xfffff8008330, size=16776976) at malloc.c:4669
        nextchunk = 0xfffff9008240
        nextsize = <optimized out>
#7  0x0000fffff7e6677c in _int_free (av=<optimized out>, p=<optimized out>,
have_lock=<optimized out>, have_lock@entry=0) at malloc.c:4639
        size = <optimized out>
        fb = <optimized out>
#8  0x0000fffff7e68cb0 in __GI___libc_free (mem=<optimized out>) at
malloc.c:3391
        ar_ptr = <optimized out>
        p = <optimized out>
        err = 1789
#9  0x0000fffff7f91ed4 in ?? ()
No symbol table info available.
#10 0x0000ffffffffe5c8 in ?? ()
No symbol table info available.
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/31498] malloc/tst-free-errno-malloc-hugetlb1 test fails on arm64

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=31498

--- Comment #1 from Sam James <sam at gentoo dot org> ---
Created attachment 15408
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15408&action=edit
/proc/cpuinfo

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/31498] malloc/tst-free-errno-malloc-hugetlb1 test fails on arm64

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=31498

--- Comment #2 from Sam James <sam at gentoo dot org> ---
huge pages & malloc internals are beyond me, so I've no idea what else to
request, but can obtain other things as requested

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/31498] malloc/tst-free-errno-malloc-hugetlb1 test fails on arm64

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=31498

--- Comment #3 from Andreas Schwab <schwab@linux-m68k.org> ---
Memory corruption

#5  0x0000fffff7e64698 in malloc_printerr (str=str@entry=0xfffff7f2af00 "double
free or corruption (out)") at malloc.c:5765

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/31498] malloc/tst-free-errno-malloc-hugetlb1 test fails on arm64

[adhemerval.zanella at linaro dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=31498

--- Comment #4 from Adhemerval Zanella <adhemerval.zanella at linaro dot org> ---
(In reply to Sam James from comment #2)
> huge pages & malloc internals are beyond me, so I've no idea what else to
> request, but can obtain other things as requested

The hugetlb1 tests should be similar to default malloc ones, the difference is
essentially an extra madvise with either the arena or the brk pointer aligned
to hugetlb size (so I would not expect memory corruptions). I haven't see any
failure on aarch64, but the test-free-errno uses some mmap tricks to trigger
memory exhaustion so I am not sure if this might be related.

-- 
You are receiving this mail because:
You are on the CC list for the bug.