Re: Reproducible, corrupt packfile after fresh git-svn checkout message

[Thomas Rast <trast@inf.ethz.ch>]

Ben Tebulin <tebulin@googlemail.com> writes:

> Hello everybody!
>
> I have some _very interesting_ news regarding this issue!
> Here is the deal:
>
>   1. I was able to *reproduce the error on a machine of a coworker!*
>
>   2. I was able to rule out
>       - HDD: It's reproducible from /dev/shm
>       - Memory: Memory tests works fine
>
> now the interesting part:
>
>   3. Occurs on Linux kernels 3.7.10, 3.8.x, 3.9.11, 3.10.5
>      _but not on:_ 3.6.11, 3.5.7 and 2.6.32
>
> Both machines showing this problem are »Dell Latitude E6330« with an
> »i5-3340M @ 2.70GHz« CPU. Mine running stock kernels, coworker using
> plain Ubuntu 13.04.
>
> Furthermore I need to stress, that we never had any issues with our
> devices during daily _at all_.
>
> So what to do best now?

If you're still interested...

What did memcheck86 say about these machines?


My best theory so far:

malloc()/free() actually use mmap()/munmap() for large allocations.
mallopt(3) tells me that "large" here means a dynamic limit on modern
glibc, but with an upper limit of 32MB on 64-bit.  So your 39MB blob
would always result in an mmap() type allocation.

And it should be easy for glibc to check mmap() type allocations against
double free(), at least if the address has not been mapped again in the
same process.  So it probably does that, which aborts the program.

You could try to gather some data on this by looking at

  strace -o fsck.trace -f git fsck

for a crash case.  If the theory is correct, you should see an munmap()
for an address similar to the one pointed out by the glibc error
message, as follows: if you get

  *** glibc detected *** <unknown>: free(): invalid pointer: 0x00007fe129669010 ***

check for the address 0x7fe129669000 (the start of the page that the
address is in).

Note that this is a pretty weak theory, because double free() detection
is squarely up valgrind's alley.  So valgrind's lack of complaints is a
strong argument against it.  But it's the best I've got so far.

-- 
Thomas Rast
trast@{inf,student}.ethz.ch