runtime: SIGSEGV in runtime.pageIndexOf when loading plugin on riscv64 #73283
Comments
gopherbot
added
the
compiler/runtime
|
cc @golang/riscv64 |
dmitshur
added
the
NeedsInvestigation
|
Thank you for reporting this, can you reproduce this issue on master? |
|
In triage, what stands out to us is that the SIGSEGV is reporting a different address than what's in the register. Is the pointer tagged in some way? Also, we assume the address space is 48 bits on most platforms, so at first we thought maybe your system was handing out addresses outside of that space, but this is failing on the arena pointer itself, not on looking up the arena pointer. We're also a little concerned about the patches 371ee14 and cdc9560. It's possible those commits depend on something else in Go 1.25. Can you reproduce with the toolchain at tip-of-tree? |
|
Sorry for delayed response
Over the past week, I've been caught up in the challenge of crafting a minimal reproducible example. I attempted to create some minimal examples in Go 1.24, allocating heap memory of varying sizes to try and trigger this error at the boundary of the arena. However, I have been unable to reproduce the issue so far. |
Thanks for the heads-up. I tried building with the main branch 05ed8a0, and the issue disappeared. I believe it was indeed caused by the code you were concerned about. The problem seems to be resolved at this point, but out of curiosity, I'd still like to understand exactly which parts of the code were involved. |
github-project-automation
bot
moved this from In Progress
to Done
in Go Compiler / Runtime
It appears that in certain conditions on riscv64, the runtime’s memory allocator miscomputes the arena pointer for new spans, causing
pageIndexOfto return an invalid pointer that is later used ininitSpan. This leads to a segmentation fault. I believe this is a bug in the runtime memory allocation logic onriscv64.I have observed a segmentation fault when loading a plugin on a riscv64 system using Go 1.24.1. The crash occurs in the memory allocator, specifically within the
runtime.pageIndexOffunction, which is called fromruntime.(*mheap).initSpan.The error indicates that the arena pointer computed by
pageIndexOfis invalid. In our case, the register t1 (which holds the arena pointer) is set to0x1112b008c0404440, which does not appear to be a canonical, properly mapped address. The backtrace is as follows:The plugin loads and begins to allocate memory (in our case during the plugin initialization I allocate a significant memory block). When a new span is allocated, its base address (in our case, approximately
273469956096) is passed toruntime.pageIndexOf. The computed arena pointer in registert1then turns out to be0x1112b008c0404440, an address that does not fall within a proper arena mapping. This leads to a segmentation fault when the runtime attempts to update the arena’s data structures.I have tried varying the memory allocation size in the plugin’s initialization (e.g., allocating 65MB), and the crash consistently appears when the allocation pushes the span’s base into an uninitialized arena slot. I suspect that this bug manifests under high memory pressure or when spans are allocated across arena boundaries.
Environment
riscv64Detailed infomation
I'm new to Go and have only captured some basic information. If more details are needed, feel free to ping me, I'm more than happy to provide them.
The text was updated successfully, but these errors were encountered: