Segmentation fault in 3.3.0 under heavy CPU and memory load on Debian Trixie (testing, rolling release)

[jasonhernandez]

htop version: 3.3.0
OS / kernel uname: 6.7.12-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.7.12-1 (2024-04-24) x86_64 GNU/Linux
libc Debian package version: 2.38-11
Distribution / release: Debian GNU/Linux trixie/sid

Issue description:
htop crashed and produced a segmentation fault when running on a Debian Trixie / testing laptop (a T14s Gen4 AMD with an 8 core Ryzen 7 CPU) that was under very high CPU and memory load. The system was computing and storing a large number of hashes in memory by running a very simple Python script with multiple processes. Desktop applications including Firefox and parts of the Gnome desktop did not respond. Eventually the Python script crashed, and I noticed that htop had also crashed. This is an edge case, but I'm sharing my logs in case they might be useful.

htop dissassembly:
htop.objdump.txt

error output:

FATAL PROGRAM ERROR DETECTED
============================
Please check at https://htop.dev/issues whether this issue has already been reported.
If no similar issue has been reported before, please create a new issue with the following information:
  - Your htop version: '3.3.0'
  - Your OS and kernel version (uname -a)
  - Your distribution and release (lsb_release -a)
  - Likely steps to reproduce (How did it happen?)
  - Backtrace of the issue (see below)

Error information:
------------------
A signal 11 (Segmentation fault) was received.

Setting information:
--------------------
htop_version=3.3.0;config_reader_min_version=3;fields=0 48 17 18 38 39 40 2 46 47 49 1;hide_kernel_threads=1;hide_userland_threads=0;hide_running_in_container=0;shadow_other_users=0;show_thread_names=0;show_program_path=1;highlight_base_name=0;highlight_deleted_exe=1;shadow_distribution_path_prefix=0;highlight_megabytes=1;highlight_threads=1;highlight_changes=0;highlight_changes_delay_secs=5;find_comm_in_cmdline=1;strip_exe_from_cmdline=1;show_merged_command=0;header_margin=1;screen_tabs=1;detailed_cpu_time=0;cpu_count_from_one=0;show_cpu_usage=1;show_cpu_frequency=0;show_cpu_temperature=0;degree_fahrenheit=0;update_process_names=0;account_guest_in_cpu_meter=0;color_scheme=0;enable_mouse=1;delay=15;hide_function_bar=0;header_layout=two_50_50;column_meters_0=LeftCPUs2 Memory Swap;column_meter_modes_0=1 1 1;column_meters_1=RightCPUs2 Tasks LoadAverage Uptime;column_meter_modes_1=1 2 2 2;tree_view=0;sort_key=46;tree_sort_key=0;sort_direction=-1;tree_sort_direction=1;tree_view_always_by_pid=0;all_branches_collapsed=0;screen:Main=PID USER PRIORITY NICE M_VIRT M_RESIDENT M_SHARE STATE PERCENT_CPU PERCENT_MEM TIME Command;.sort_key=PERCENT_CPU;.tree_sort_key=PID;.tree_view_always_by_pid=0;.tree_view=0;.sort_direction=-1;.tree_sort_direction=1;.all_branches_collapsed=0;screen:I/O=PID USER IO_PRIORITY IO_RATE IO_READ_RATE IO_WRITE_RATE PERCENT_SWAP_DELAY PERCENT_IO_DELAY Command;.sort_key=IO_RATE;.tree_sort_key=PID;.tree_view_always_by_pid=0;.tree_view=0;.sort_direction=-1;.tree_sort_direction=1;.all_branches_collapsed=0;

Backtrace information:
----------------------
htop(+0x1912b)[0x56530a86c12b]
htop(CRT_handleSIGSEGV+0xf6)[0x56530a86c426]
/lib/x86_64-linux-gnu/libc.so.6(+0x3d580)[0x7ff37b503580]
htop(+0x379d3)[0x56530a88a9d3]
htop(Machine_scanTables+0x4b)[0x56530a8713cb]
htop(ScreenManager_run+0x648)[0x56530a87c7f8]
htop(CommandLine_run+0x7d5)[0x56530a86aa45]
/lib/x86_64-linux-gnu/libc.so.6(+0x27c8a)[0x7ff37b4edc8a]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x85)[0x7ff37b4edd45]
htop(_start+0x21)[0x56530a865c41]

To make the above information more practical to work with, please also provide a disassembly of your htop binary. This can usually be done by running the following command:

   objdump -d -S -w `which htop` > ~/htop.objdump

Please include the generated file in your report.
Running this program with debug symbols or inside a debugger may provide further insights.

Thank you for helping to improve htop!

Segmentation fault

[grahamperrin]

… Desktop applications including Firefox …

Was there any Widevine content? (Not necessarily playing.)

[sinus-x]

I've managed to unintentionally reproduce it as well.

htop   3.3.0 (htop-3.3.0-3.fc40.src.rpm)
uname  Linux 6.8.10-300.fc40.x86_64 #1 SMP PREEMPT_DYNAMIC Fri May 17 21:20:54 UTC 2024 x86_64 GNU/Linux

Steps are the same: high CPU and memory load caused by Python program crunching many large numbers (LLM stuff). Firefox, Discord, Terminator, ..., GNOME froze as well.

Error information:
------------------
A signal 11 (Segmentation fault) was received.

Setting information:
--------------------
htop_version=3.3.0;config_reader_min_version=3;fields=0 48 38 39 46 47 49 1;hide_kernel_threads=1;hide_userland_threads=1;hide_running_in_container=0;shadow_other_users=0;show_thread_names=0;show_program_path=1;highlight_base_name=1;highlight_deleted_exe=1;shadow_distribution_path_prefix=0;highlight_megabytes=1;highlight_threads=1;highlight_changes=0;highlight_changes_delay_secs=5;find_comm_in_cmdline=1;strip_exe_from_cmdline=1;show_merged_command=0;header_margin=1;screen_tabs=0;detailed_cpu_time=0;cpu_count_from_one=1;show_cpu_usage=1;show_cpu_frequency=0;show_cpu_temperature=0;degree_fahrenheit=0;update_process_names=0;account_guest_in_cpu_meter=0;color_scheme=6;enable_mouse=1;delay=15;hide_function_bar=0;topology_affinity=0;header_layout=two_50_50;column_meters_0=LeftCPUs2 Memory LoadAverage;column_meter_modes_0=1 1 2;column_meters_1=RightCPUs2 Tasks Uptime;column_meter_modes_1=1 2 2;tree_view=0;sort_key=0;tree_sort_key=38;sort_direction=1;tree_sort_direction=-1;tree_view_always_by_pid=0;all_branches_collapsed=0;screen:Main=PID USER M_VIRT M_RESIDENT PERCENT_CPU PERCENT_MEM TIME Command;.sort_key=PID;.tree_sort_key=M_VIRT;.tree_view_always_by_pid=0;.tree_view=0;.sort_direction=1;.tree_sort_direction=-1;.all_branches_collapsed=0;screen:I/O=PID USER IO_PRIORITY IO_RATE IO_READ_RATE IO_WRITE_RATE PERCENT_SWAP_DELAY PERCENT_IO_DELAY Command;.sort_key=IO_RATE;.tree_sort_key=PID;.tree_view_always_by_pid=0;.tree_view=0;.sort_direction=-1;.tree_sort_direction=1;.all_branches_collapsed=0;

Backtrace information:
----------------------
htop(+0xdfdd)[0x55681b3e7fdd]
htop(CRT_handleSIGSEGV+0xfe)[0x55681b3f028e]
/lib64/libc.so.6(+0x40710)[0x7f1530915710]
/lib64/libc.so.6(read+0x11)[0x7f15309dfcc1]
/lib64/libc.so.6(_IO_file_underflow+0x163)[0x7f1530962333]
/lib64/libc.so.6(_IO_default_uflow+0x32)[0x7f1530964752]
/lib64/libc.so.6(_IO_getline_info+0xaa)[0x7f15309570da]
/lib64/libc.so.6(fgets+0xa6)[0x7f1530955e26]
htop(+0x3fff9)[0x55681b419ff9]
htop(Machine_scanTables+0xa6)[0x55681b3f40c6]
htop(ScreenManager_run+0x710)[0x55681b408240]
htop(CommandLine_run+0x898)[0x55681b3f0c08]
/lib64/libc.so.6(+0x2a088)[0x7f15308ff088]
/lib64/libc.so.6(__libc_start_main+0x8b)[0x7f15308ff14b]
htop(_start+0x25)[0x55681b3e5c75]

(built binary should be available through koji)

[jasonhernandez]

… Desktop applications including Firefox …

Was there any Widevine content? (Not necessarily playing.)

I had Spotify running (via Flatpak), and I believe that uses Widevine, so I think it is likely. My Firefox installation has Widevine enabled and I perhaps had my normal complement of 30+ tabs of mostly technical documentation and a few news articles up.

I was also running GNOME and it was freezing / struggling as well.

[danielthegray]

Similar case, running on Manjaro LXDE:

Error information:                                         
------------------                                                                                                     
A signal 11 (Segmentation fault) was received.                                                                         
                                                                                                                       
Setting information:                                                                                                   
--------------------                                                                                                   
htop_version=3.3.0;config_reader_min_version=3;fields=0 48 17 18 38 39 40 2 46 47 49 1;hide_kernel_threads=1;hide_userland_threads=0;hide_running_in_container=0;shadow_other_users=0;show_thread_names=0;show_program_path=1;highlight_base_n
ame=0;highlight_deleted_exe=1;shadow_distribution_path_prefix=0;highlight_megabytes=1;highlight_threads=1;highlight_changes=0;highlight_changes_delay_secs=5;find_comm_in_cmdline=1;strip_exe_from_cmdline=1;show_merged_command=0;header_marg
in=1;screen_tabs=1;detailed_cpu_time=0;cpu_count_from_one=0;show_cpu_usage=1;show_cpu_frequency=0;show_cpu_temperature=0;degree_fahrenheit=0;update_process_names=0;account_guest_in_cpu_meter=0;color_scheme=0;enable_mouse=1;delay=15;hide_f
unction_bar=0;header_layout=two_50_50;column_meters_0=LeftCPUs2 Memory Swap;column_meter_modes_0=1 1 1;column_meters_1=RightCPUs2 Tasks LoadAverage Uptime;column_meter_modes_1=1 2 2 2;tree_view=0;sort_key=47;tree_sort_key=39;sort_directio
n=-1;tree_sort_direction=-1;tree_view_always_by_pid=0;all_branches_collapsed=0;screen:Main=PID USER PRIORITY NICE M_VIRT M_RESIDENT M_SHARE STATE PERCENT_CPU PERCENT_MEM TIME Command;.sort_key=PERCENT_MEM;.tree_sort_key=M_RESIDENT;.tree_v
iew_always_by_pid=0;.tree_view=0;.sort_direction=-1;.tree_sort_direction=-1;.all_branches_collapsed=0;screen:I/O=PID USER IO_PRIORITY IO_RATE IO_READ_RATE IO_WRITE_RATE PERCENT_SWAP_DELAY PERCENT_IO_DELAY Command;.sort_key=IO_RATE;.tree_s
ort_key=PID;.tree_view_always_by_pid=0;.tree_view=0;.sort_direction=-1;.tree_sort_direction=1;.all_branches_collapsed=0;
                                                                                                                       
Backtrace information:       
----------------------
htop(+0xd12e)[0x5627e694812e] 
htop(CRT_handleSIGSEGV+0xfe)[0x5627e694fdae]
/usr/lib/libc.so.6(+0x3cae0)[0x7fce12b89ae0]
/usr/lib/libc.so.6(__isoc23_fscanf+0x0)[0x7fce12ba44e0]
htop(+0x3e254)[0x5627e6979254]
htop(+0x3df26)[0x5627e6978f26]
htop(Machine_scanTables+0xa6)[0x5627e6953d96]
htop(ScreenManager_run+0x739)[0x5627e69683d9]
htop(CommandLine_run+0x8f2)[0x5627e6950762]
/usr/lib/libc.so.6(+0x25c88)[0x7fce12b72c88]
/usr/lib/libc.so.6(__libc_start_main+0x8c)[0x7fce12b72d4c]
htop(_start+0x25)[0x5627e6946065]

To make the above information more practical to work with, please also provide a disassembly of your htop binary. This can usually be done by running the following command:

   objdump -d -S -w `which htop` > ~/htop.objdump

htop.objdump.tar.gz

[BenBE]

Okay, going through these crashes, they are distinct:

1. @jasonhernandez : Crash inside call to LinuxProcessTable_recurseProcTree from Machine_scanTables: When the useDeletedLib flag should be updated, assigning lp->last_mlrs_calctime = host->realtimeMs; fails for some strange reason. Neither pointer should be NULL by this point, as both were accessed just a few lines above.
2. @sinus-x : Please attach the objdump directly, as asked for in the error message.
3. @danielthegray : NULL pointer deref while closing the statm file. Likely already fixed by Avoid glibc FILE voodoo #1409.

Given the vastly different error location in the second trace too, this may be even yet another issue; though given the libc references in its backtrace, this looks like another instance already addressed by #1409.