[Crash-utility] WARNING: malloc/free mismatch

[Dave Wysochanski]

On Thu, 2019-04-18 at 15:02 +0100, Pierguido Lambri wrote:
> Hello,
> 
> Today while I was looking into a vmcore, I got suddenly the message
> in $SUBJECT.
> It started after I did a search into the process stack pages (search
> -t) 
> and for each command I run afterwards I kept getting that message.
> For example:
> 
> $ retrace-server-interact 603967269 crash
> ...
> crash> search -t ffff88040a0d5280
> 
> search: invalid list entry: 0
> 
> search: invalid list entry: 0
> 
> search: invalid list entry: 0
> PID: 606    TASK: ffff88082d226eb0  CPU: 5   COMMAND: "xfsaild/dm-0"
> ffff88083ff5b948: ffff88040a0d5280 
> ffff88083ff5b990: ffff88040a0d5280 
> ffff88083ff5baa8: ffff88040a0d5280 
> ffff88083ff5baf0: ffff88040a0d5280 
> ffff88083ff5bcf0: ffff88040a0d5280 
> ffff88083ff5bd38: ffff88040a0d5280 
> ffff88083ff5bd98: ffff88040a0d5280 
> 
> 
> WARNING: malloc/free mismatch (29/32)
> 
> crash> ps -m | grep UN
> [ 0 00:00:00.146] [UN]  PID: 1811   TASK: ffff880c17bd1fa0  CPU:
> 1   COMMAND: "cp"
> WARNING: malloc/free mismatch (29/32)
> 
> I guess this comes from a possible corrupted vmcore (I just got it
> from this vmcore),
> but I wonder why every new command keeps returning the same message.
> 
> Thanks,
> 
> Pier
> 
> --
> Crash-utility mailing list
> Crash-utility at redhat.com
> https://www.redhat.com/mailman/listinfo/crash-utility

FWIW, I just pulled this up after plambri pinged me.  This is the
backtrace that is being hit though I've not dug in more:

Breakpoint 3, do_list (ld=0x7ffffffea6c0) at tools.c:3820
3820                                    error(INFO, "\ninvalid list entry: 0\n");
(gdb) list
3815                            return -1;
3816                    }
3817
3818                    if (next == 0) {
3819                            if (ld->flags & LIST_HEAD_FORMAT) {
3820                                    error(INFO, "\ninvalid list entry: 0\n");
3821                                    if (close_hq_on_return)
3822                                            hq_close();
3823                                    return -1;
3824                            }
(gdb) bt
#0  do_list (ld=0x7ffffffea6c0) at tools.c:3820
#1  0x000000000047ec82 in dump_vmap_area (vi=0x7ffffffed0d0) at memory.c:8724
#2  dump_vmlist (vi=0x7ffffffed0d0) at memory.c:8590
#3  0x000000000047f3eb in last_vmalloc_address () at memory.c:16792
#4  0x0000000000515e6b in x86_64_get_kvaddr_ranges (vrp=0x7fffffffd340) at x86_64.c:8706
#5  0x000000000049c6ae in cmd_search () at memory.c:13988
#6  0x0000000000465f9c in exec_command () at main.c:879
#7  0x00000000004661ca in main_loop () at main.c:826
#8  0x00000000006b21a3 in captured_command_loop (data=<value optimized out>) at main.c:258
#9  0x00000000006b0a8b in catch_errors (func=0x6b2190 <captured_command_loop>, func_args=0x0, errstring=0x90c106 "", mask=6) at exceptions.c:557
#10 0x00000000006b3076 in captured_main (data=<value optimized out>) at main.c:1064
#11 0x00000000006b0a8b in catch_errors (func=0x6b22b0 <captured_main>, func_args=0x7fffffffe2e0, errstring=0x90c106 "", mask=6) at exceptions.c:557
#12 0x00000000006b1fa4 in gdb_main (args=<value optimized out>) at main.c:1079
#13 0x00000000006b1fde in gdb_main_entry (argc=<value optimized out>, argv=<value optimized out>) at main.c:1099
#14 0x0000000000467030 in main (argc=3, argv=0x7fffffffe458) at main.c:707