Bug 237683

Summary: glibc detected free(): invalid next size w/ grep on large directory
Product: Red Hat Enterprise Linux 4 Reporter: kent lamb <klamb>
Component: glibcAssignee: Jakub Jelinek <jakub>
Status: CLOSED DUPLICATE QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 4.0CC: tao
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-04-26 15:49:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description kent lamb 2007-04-24 18:54:25 UTC
Description of problem:

grep -ri nztmpwatch * on
a large directory returns:

[root@nps21090 src]# grep -ri nztmpwatch *
build/hostSetup.cfg:NEED_NZTMPWATCH=1
build/hostSetupHA.cfg:NEED_NZTMPWATCH=1
build/setup.sh:    nztmpwatch="/etc/cron.daily/nztmpwatch"
build/setup.sh:    if [ -z "$NEED_NZTMPWATCH" ]; then
build/setup.sh:        echo "Skipping install of $nztmpwatch for non-root 
install"
build/setup.sh:    if [ -f $nztmpwatch ]; then
build/setup.sh:        mv $nztmpwatch ${nztmpwatch}~
build/setup.sh:    cat >$nztmpwatch <<EOF
build/setup.sh:    chmod 755 $nztmpwatch
Binary file core.1173837235.492 matches
Binary file core.1173896878.27260 matches
Binary file core.1173896996.29567 matches
Binary file core.1173899385.6939 matches
*** glibc detected *** free(): invalid next size (fast): 0x09bccdc0 ***
Aborted (core dumped)

Version-Release number of selected component (if applicable):

RHEL4.0 with glibc version 2.3.4-2.25

How reproducible:

consistent

Steps to Reproduce:
grep on large directory
  
Actual results:


Expected results:


Additional info:

This was initally added to bz 161731, but as that dealt w/ glibc and thunderbird
on fc, it is being reopened for RHEL4.  The following is info taken from bz
161731 for the RHEL4, glibc version 2.3.4-2.25:


We just encountered a problem similar to this doing a grep -ri nztmpwatch * on
a large directory.  This is RHEL4.0 with glibc version 2.3.4-2.25.  We really
weren't doing anything exotic.  Both versions get to re_search before the 
symbols stop.

Here's the output:

[root@nps21090 src]# grep -ri nztmpwatch *
build/hostSetup.cfg:NEED_NZTMPWATCH=1
build/hostSetupHA.cfg:NEED_NZTMPWATCH=1
build/setup.sh:    nztmpwatch="/etc/cron.daily/nztmpwatch"
build/setup.sh:    if [ -z "$NEED_NZTMPWATCH" ]; then
build/setup.sh:        echo "Skipping install of $nztmpwatch for non-root 
install"
build/setup.sh:    if [ -f $nztmpwatch ]; then
build/setup.sh:        mv $nztmpwatch ${nztmpwatch}~
build/setup.sh:    cat >$nztmpwatch <<EOF
build/setup.sh:    chmod 755 $nztmpwatch
Binary file core.1173837235.492 matches
Binary file core.1173896878.27260 matches
Binary file core.1173896996.29567 matches
Binary file core.1173899385.6939 matches
*** glibc detected *** free(): invalid next size (fast): 0x09bccdc0 ***
Aborted (core dumped)
[root@nps21090 src]#


== Backtrace ==

GNU gdb Red Hat Linux (6.3.0.0-0.31rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...
(no debugging symbols found)
Using host libthread_db library "/lib/tls/libthread_db.so.1".

Core was generated by `grep -ri nztmpwatch amake arch ati blast bnr bootpd 
build chk clientapp.amk com'.
Program terminated with signal 6, Aborted.
Reading symbols from /lib/libpcre.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpcre.so.0
Reading symbols from /lib/tls/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/tls/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/ld-linux.so.2...
(no debugging symbols found)...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x0038d7a2 in _dl_sysinfo_int80 ()
   from /lib/ld-linux.so.2
(gdb) bt
#0  0x0038d7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x003f57a5 in raise () from /lib/tls/libc.so.6
#2  0x003f7209 in abort () from /lib/tls/libc.so.6
#3  0x0042971a in __libc_message () from /lib/tls/libc.so.6
#4  0x0042ffbf in _int_free () from /lib/tls/libc.so.6
#5  0x0043033a in free () from /lib/tls/libc.so.6
#6  0x00477ce0 in re_search_internal () from /lib/tls/libc.so.6
#7  0x0047a1b3 in re_search_stub () from /lib/tls/libc.so.6
#8  0x0047a623 in re_search () from /lib/tls/libc.so.6
#9  0x080546df in ?? ()
#10 0x09bbe970 in ?? ()
#11 0xb7cfa3ce in ?? ()
#12 0x0000005d in ?? ()
#13 0x00000000 in ?? ()
(gdb)

I have another slightly different scenario using grep -ri nztmpwatch . that
gives a backtrace to realloc:

The command output:

[root@nps21090 src]# grep -ri nztmpwatch .
Binary file ./core.1173974428.1963 matches
Segmentation fault (core dumped)

== Backtrace ==

GNU gdb Red Hat Linux (6.3.0.0-0.31rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...
(no debugging symbols found)
Using host libthread_db library "/lib/tls/libthread_db.so.1".

Core was generated by `grep -ri nztmpwatch .'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libpcre.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpcre.so.0
Reading symbols from /lib/tls/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/ld-linux.so.2...
(no debugging symbols found)...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x00431993 in _int_realloc ()
   from /lib/tls/libc.so.6
(gdb) bt
#0  0x00431993 in _int_realloc () from /lib/tls/libc.so.6
#1  0x00432ad6 in realloc () from /lib/tls/libc.so.6
#2  0x0046f9f5 in extend_buffers () from /lib/tls/libc.so.6
#3  0x00478da7 in re_search_internal () from /lib/tls/libc.so.6
#4  0x0047a1b3 in re_search_stub () from /lib/tls/libc.so.6
#5  0x0047a623 in re_search () from /lib/tls/libc.so.6
#6  0x080546df in ?? ()
#7  0x08125970 in ?? ()
#8  0xb7d6a67b in ?? ()
#9  0x000000e1 in ?? ()
#10 0x00000000 in ?? ()



Forgot to attach memory map for the two examples:

grep -ri nztmpwatch *

0038d000-003a2000 r-xp 00000000 68:02 1628932    /lib/ld-2.3.4.so
003a2000-003a3000 r--p 00015000 68:02 1628932    /lib/ld-2.3.4.so
003a3000-003a4000 rw-p 00016000 68:02 1628932    /lib/ld-2.3.4.so
003a6000-003b5000 r-xp 00000000 68:02 1628884    /lib/libpcre.so.0.0.1
003b5000-003b6000 rw-p 0000f000 68:02 1628884    /lib/libpcre.so.0.0.1
003ce000-004f3000 r-xp 00000000 68:02 1631579    /lib/tls/libc-2.3.4.so
004f3000-004f4000 r--p 00124000 68:02 1631579    /lib/tls/libc-2.3.4.so
004f4000-004f7000 rw-p 00125000 68:02 1631579    /lib/tls/libc-2.3.4.so
004f7000-004f9000 rw-p 004f7000 00:00 0
08048000-0805a000 r-xp 00000000 68:02 1221656    /bin/grep
0805a000-0805b000 rw-p 00012000 68:02 1221656    /bin/grep
0811a000-0815e000 rw-p 0811a000 00:00 0
b7d33000-b7d34000 rw-p b7d33000 00:00 0
b7d34000-b7d3a000 r--s 00000000 68:07 789103     /usr/lib/gconv/gconv-
modules.cache
b7d3a000-b7f3a000 r--p 00000000 68:07 788883     /usr/lib/locale/locale-archive
b7f3a000-b7f3c000 rw-p b7f3a000 00:00 0
bfe1f000-c0000000 rw-p bfe1f000 00:00 0
ffffe000-fffff000 ---p 00000000 00:00 0

grep -ri nztmpwatch .

0038d000-003a2000 r-xp 00000000 68:02 1628932    /lib/ld-2.3.4.so
003a2000-003a3000 r--p 00015000 68:02 1628932    /lib/ld-2.3.4.so
003a3000-003a4000 rw-p 00016000 68:02 1628932    /lib/ld-2.3.4.so
003a6000-003b5000 r-xp 00000000 68:02 1628884    /lib/libpcre.so.0.0.1
003b5000-003b6000 rw-p 0000f000 68:02 1628884    /lib/libpcre.so.0.0.1
003ce000-004f3000 r-xp 00000000 68:02 1631579    /lib/tls/libc-2.3.4.so
004f3000-004f4000 r--p 00124000 68:02 1631579    /lib/tls/libc-2.3.4.so
004f4000-004f7000 rw-p 00125000 68:02 1631579    /lib/tls/libc-2.3.4.so
004f7000-004f9000 rw-p 004f7000 00:00 0
08048000-0805a000 r-xp 00000000 68:02 1221656    /bin/grep
0805a000-0805b000 rw-p 00012000 68:02 1221656    /bin/grep
09129000-09157000 rw-p 09129000 00:00 0
b7c87000-b7cd9000 rw-p b7c87000 00:00 0
b7d02000-b7d03000 rw-p b7d02000 00:00 0
b7d25000-b7d2b000 r--s 00000000 68:07 789103     /usr/lib/gconv/gconv-
modules.cache
b7d2b000-b7f2b000 r--p 00000000 68:07 788883     /usr/lib/locale/locale-archive
b7f2b000-b7f2d000 rw-p b7f2b000 00:00 0
bfe3f000-c0000000 rw-p bfe3f000 00:00 0
ffffe000-fffff000 ---p 00000000 00:00 0

Comment 1 Jakub Jelinek 2007-04-24 21:57:33 UTC
Likely dup of #202991, please retry with RHEL4.5 glibc (2.3.4-2.36).

Comment 3 Jakub Jelinek 2007-04-26 15:49:32 UTC

*** This bug has been marked as a duplicate of 202991 ***