Re: Reproducible, corrupt packfile after fresh git-svn checkout message

From: Thomas Rast <trast@inf.ethz.ch>
Date: Aug 14, 2013, 09:09 UTC
Message-ID: <877gfok59m.fsf@linux-k42r.v.cablecom.net>
In-Reply-To: <5204E018.4000808@gmail.com>

Ben Tebulin <tebulin@googlemail.com> writes:

Show 24 quoted lines

> Hello everybody!
>
> I have some _very interesting_ news regarding this issue!
> Here is the deal:
>
>   1. I was able to *reproduce the error on a machine of a coworker!*
>
>   2. I was able to rule out
>       - HDD: It's reproducible from /dev/shm
>       - Memory: Memory tests works fine
>
> now the interesting part:
>
>   3. Occurs on Linux kernels 3.7.10, 3.8.x, 3.9.11, 3.10.5
>      _but not on:_ 3.6.11, 3.5.7 and 2.6.32
>
> Both machines showing this problem are »Dell Latitude E6330« with an
> »i5-3340M @ 2.70GHz« CPU. Mine running stock kernels, coworker using
> plain Ubuntu 13.04.
>
> Furthermore I need to stress, that we never had any issues with our
> devices during daily _at all_.
>
> So what to do best now?

If you're still interested...

What did memcheck86 say about these machines?

My best theory so far:

malloc()/free() actually use mmap()/munmap() for large allocations. mallopt(3) tells me that "large" here means a dynamic limit on modern glibc, but with an upper limit of 32MB on 64-bit. So your 39MB blob would always result in an mmap() type allocation.

And it should be easy for glibc to check mmap() type allocations against double free(), at least if the address has not been mapped again in the same process. So it probably does that, which aborts the program.

You could try to gather some data on this by looking at

  strace -o fsck.trace -f git fsck

for a crash case. If the theory is correct, you should see an munmap() for an address similar to the one pointed out by the glibc error message, as follows: if you get

  *** glibc detected *** <unknown>: free(): invalid pointer: 0x00007fe129669010 ***

check for the address 0x7fe129669000 (the start of the page that the address is in).

Note that this is a pretty weak theory, because double free() detection is squarely up valgrind's alley. So valgrind's lack of complaints is a strong argument against it. But it's the best I've got so far.

-- 
Thomas Rast
trast@{inf,student}.ethz.ch