Bug 470529

Trying to strace virt-manager, I was repeatedly seeing:

select(6, [5], NULL, NULL, NULL)        = 1 (in [5])
read(5, "\377\377\377\0\377\377\377\0\377\377\377\0\377\377\377\0\377\377\377\0\377\377\377\0\377\377\377\0\377\377\377\0\377"..., 15404) = 15404
read(5, 0xbf16f4, 4096)                 = -1 EAGAIN (Resource temporarily unavailable)
select(6, [5], [5], NULL, NULL)         = 1 (out [5])
writev(5, [{"8\2\4\0w\0\200\4\0\0\10\0\0\0\0\0H\2\311\36\221\374\200\4w\0\200\4;\1\31\0s"..., 40}, {"\222\222\222\377\222\222\222\377\222\222\222\377\222\222\222\377\222\222\222\377\222\222\222\377\222\222\222\377\222\222\222\377\222"..., 31500}], 2*** glibc detected *** strace: malloc(): memory corruption (fast): 0x0000000000d8b610 ***
======= Backtrace: =========
/lib64/libc.so.6[0x8bfbb8]
/lib64/libc.so.6[0x8c3251]
/lib64/libc.so.6(__libc_malloc+0x98)[0x8c4728]
strace[0x408728]
strace[0x40598e]
strace[0x404696]
/lib64/libc.so.6(__libc_start_main+0xe6)[0x866546]
strace[0x401e69]
======= Memory map: ========
00110000-00130000 r-xp 00000000 fd:00 15548473                           /lib64/ld-2.8.90.so
0032f000-00330000 r--p 0001f000 fd:00 15548473                           /lib64/ld-2.8.90.so
00330000-00331000 rw-p 00020000 fd:00 15548473                           /lib64/ld-2.8.90.so
00400000-00447000 r-xp 00000000 fd:00 7868720                            /usr/bin/strace
00647000-00648000 rw-p 00047000 fd:00 7868720                            /usr/bin/strace
00648000-00656000 rw-p 00648000 00:00 0 
00847000-00848000 rw-p 00047000 fd:00 7868720                            /usr/bin/strace
00848000-009b1000 r-xp 00000000 fd:00 15548427                           /lib64/libc-2.8.90.so
009b1000-00bb0000 ---p 00169000 fd:00 15548427                           /lib64/libc-2.8.90.so
00bb0000-00bb4000 r--p 00168000 fd:00 15548427                           /lib64/libc-2.8.90.so
00bb4000-00bb5000 rw-p 0016c000 fd:00 15548427                           /lib64/libc-2.8.90.so
00bb5000-00bba000 rw-p 00bb5000 00:00 0 
00d8b000-00dac000 rw-p 00d8b000 00:00 0                                  [heap]
7f9ab0000000-7f9ab0021000 rw-p 7f9ab0000000 00:00 0 
7f9ab0021000-7f9ab4000000 ---p 7f9ab0021000 00:00 0 
7f9ab53df000-7f9ab53f5000 r-xp 00000000 fd:00 15548466                   /lib64/libgcc_s-4.3.2-20081105.so.1
7f9ab53f5000-7f9ab55f5000 ---p 00016000 fd:00 15548466                   /lib64/libgcc_s-4.3.2-20081105.so.1
7f9ab55f5000-7f9ab55f6000 rw-p 00016000 fd:00 15548466                   /lib64/libgcc_s-4.3.2-20081105.so.1
7f9ab55f6000-7f9ab55f8000 rw-p 7f9ab55f6000 00:00 0 
7f9ab560e000-7f9ab5610000 rw-p 7f9ab560e000 00:00 0 
7fffbd5fb000-7fffbd610000 rw-p 7ffffffea000 00:00 0                      [stack]
7fffbd7ff000-7fffbd800000 r-xp 7fffbd7ff000 00:00 0                      [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
) = 31540

I installed glibc-debuginfo and the problem went away. I uninstalled glibc-debuginfo again and the problem was back.

Then I ran strace in gdb eventually got:

#0  0x00007ffff7ca7075 in raise () from /lib64/libc.so.6
No symbol table info available.
#1  0x00007ffff7ca8be3 in abort () from /lib64/libc.so.6
No symbol table info available.
#2  0x00007ffff7ce6128 in __libc_message () from /lib64/libc.so.6
No symbol table info available.
#3  0x00007ffff7cebbb8 in malloc_printerr () from /lib64/libc.so.6
No symbol table info available.
#4  0x00007ffff7cef251 in _int_malloc () from /lib64/libc.so.6
No symbol table info available.
#5  0x00007ffff7cf0728 in malloc () from /lib64/libc.so.6
No symbol table info available.
#6  0x0000000000408728 in decode_select (tcp=0x848030, args=0xefd, bitness=BITNESS_CURRENT) at desc.c:428
        i = <value optimized out>
        j = <value optimized out>
        nfds = <value optimized out>
        fdsize = 3837
        sep = <value optimized out>
        arg = <value optimized out>
        outstr = "out [5]", '\0' <repeats 1016 times>
#7  0x000000000040598e in trace_syscall (tcp=0x848030) at syscall.c:2549
        sys_res = <value optimized out>
        tv = {tv_sec = 1073741824, tv_usec = 3821}
        res = <value optimized out>
#8  0x0000000000404696 in trace () at strace.c:2475
No locals.
#9  main (argc=<value optimized out>, argv=0x7fffffffe468) at strace.c:879
        tcp = <value optimized out>
        c = <value optimized out>
        pid = <value optimized out>
        optF = <value optimized out>
        sa = {__sigaction_handler = {sa_handler = 0, sa_sigaction = 0}, sa_mask = {__val = {0 <repeats 16 times>}}, 
  sa_flags = 0, sa_restorer = 0x7fffffffe3e0}
        buf = "select(40\n[{\"8\\2\\4\\0w\\0\\340\\0\\0\\0\\10\\0\\0\\0\\0\\0H\\2\\311\\36T\\24\\340\\0w\\0\\340\\0;\\1\\31\\0s\"..., 40}, {\"\\222\\222\\222\\377\\222\\222\\222\\377\\222\\222\\222\\377\\222\\222\\222\\377\\222\\222\\222\\377\\222\\222\\222\\377\\222\\22"...