git assert failure: munmap_chunk(): invalid pointer

[Anders Kaseorg]

This seems to be reproducible with

git clone https://github.com/zulip/zulip.git
cd zulip
git grep -i 'redirect.*login'

Valgrind log attached.

ProblemType: Crash
DistroRelease: Ubuntu 18.10
Package: git 1:2.19.1-1ubuntu1.1
ProcVersionSignature: Ubuntu 4.18.0-11.12-generic 4.18.12
Uname: Linux 4.18.0-11-generic x86_64
NonfreeKernelModules: openafs
ApportVersion: 2.20.10-0ubuntu13.1
Architecture: amd64
AssertionMessage: munmap_chunk(): invalid pointer
CurrentDesktop: GNOME
Date: Thu Nov 29 16:02:46 2018
EcryptfsInUse: Yes
ExecutablePath: /usr/bin/git
InstallationDate: Installed on 2016-02-19 (1014 days ago)
InstallationMedia: Ubuntu-GNOME 16.04 LTS "Xenial Xerus" - Alpha amd64 (20160218)
ProcCmdline: git grep -i redirect.*login
Signal: 6
SourcePackage: git
StacktraceTop:
 __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f3162540c00 "%s\n") at ../sysdeps/posix/libc_fatal.c:181
 malloc_printerr (str=str@entry=0x7f3162542848 "munmap_chunk(): invalid pointer") at malloc.c:5336
 munmap_chunk (p=<optimized out>) at malloc.c:2830
 grep_source_clear (gs=gs@entry=0x55757aa67a38 <todo+2200>) at grep.c:2087
 work_done (w=<optimized out>) at builtin/grep.c:160
Title: git assert failure: munmap_chunk(): invalid pointer
UpgradeStatus: Upgraded to cosmic on 2018-08-17 (104 days ago)
UserGroups: adm audio bumblebee cdrom dip docker libvirt libvirtd lpadmin lxd mock plugdev sambashare sbuild sudo wireshark
modified.conffile..etc.apport.crashdb.conf: [modified]
mtime.conffile..etc.apport.crashdb.conf: 2018-07-03T15:41:08.765813

[Apport retracing service (apport)]

StacktraceTop:
 __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f3162540c00 "%s\n") at ../sysdeps/posix/libc_fatal.c:181
 malloc_printerr (str=str@entry=0x7f3162542848 "munmap_chunk(): invalid pointer") at malloc.c:5336
 munmap_chunk (p=<optimized out>) at malloc.c:2830
 grep_source_clear (gs=gs@entry=0x55757aa67a38 <todo+2200>) at grep.c:2087
 work_done (w=<optimized out>) at builtin/grep.c:160

[Anders Kaseorg (andersk)]

Reproduced on different hardware. It’s not entirely deterministic, and seems to disappear entirely with --threads=1, so it must be some kind of race condition.

[Anders Kaseorg (andersk)]

Bisecting git.git shows v1.9-rc0~63^2 as the first bad commit:

https://github.com/git/git/commit/9c0495d23e6999375976ca44e3812fc65b73626e

That commit merely removes a setlocale(LC_CTYPE, "C") call on sufficiently new glibc, so the real bug is elsewhere.

[Anders Kaseorg (andersk)]

The crash occurs with glibc 2.28 and not with glibc 2.27. Bisecting glibc.git shows glibc-2.28~122 as the first bad commit:

https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=eb04c21373e2a2885f3d52ff192b0499afe3c672
“posix: Sync gnulib regex implementation”

I verified that it was fixed in glibc master (post-2.28) with:

https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=bc680b336971305cb39896b30d72dc7101b62242
“regex: fix uninitialized memory access”

which was backported to the 2.28 stable branch (two commits after the snapshot in cosmic/disco!):

https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=58559f14437d2aa71753a29fed435efa06aa4576

Please add this patch.

[Adam Conrad (adconrad)]

Closing as fixed, since glibc 2.29 shipped in disco, and cosmic is EOL.