RipGrep musl binaries occasionally segfault during very-large searches

Aug 01, 2026 07:34 PM - 1 hour ago 3

Please tick this container to corroborate you person reviewed the above.

I person a different issue.

What type of ripgrep are you using?

ripgrep 15.2.0 (rev e89fff8)

features:+pcre2
simd(compile):+SSE2,-SSSE3,-AVX2
simd(runtime):+SSE2,+SSSE3,+AVX2

PCRE2 10.45 is disposable (JIT is available)

How did you instal ripgrep?

I primitively encountered this bug successful the rg bundled pinch OpenAI Codex. That binary is byte-for-byte identical pinch the 1 successful https://github.com/BurntSushi/ripgrep/releases/download/15.2.0/ripgrep-15.2.0-x86_64-unknown-linux-musl.tar.gz and I've reproduced the bug from that independently of immoderate Codex dependency. For the study below, I built rg-15.2 pinch debug symbols included by measurement of CROSS_CONTAINER_ENGINE=podman CARGO_PROFILE_RELEASE_DEBUG=true ~/.cargo/bin/cross build --release --target x86_64-unknown-linux-musl.

What operating strategy are you utilizing ripgrep on?

OpenSUSE Tumbleweed Linux x86_64

Describe your bug.

Ripgrep built for x86_64-unknown-linux-musl occasionally crashes pinch a SIGSEGV erstwhile searching very-large trees astatine a precocious grade of concurrency. The crashing statement is an integrity assertion regarding heap metadata wrong MUSL's mallocng, successful a calloc telephone made from opendir. The complete backtrace is below.

What are the steps to reproduce the behavior?

Having a sufficiently ample hunt character seems to beryllium basal for reproduction. Run the attached generate_repro_tree.py. This is an LLM-written programme which produces a character afloat of random files which mimic the statistic of the repo successful which I primitively encountered the bug. It will nutrient a character containing astir 20GiB of information crossed 1.8M files.

Then from the guidelines of that tree, tally rg successful a loop, searching for immoderate arbitrary literal drawstring that isn't coming successful the tree: while true; do rg tnoheueunotshisnthukoethnsueothnsiuothonesuioseuinth; done. On my 24-core system, having capable free RAM for the hunt character to fresh successful the kernel's artifact cache, it typically takes astir a infinitesimal for the SIGSEGV to appear.

What is the existent behavior?

I get a coredump pinch the pursuing backtrace:

#0 get_meta () astatine ../src_musl/src/malloc/mallocng/meta.h:141 #1 __malloc_allzerop () astatine ../src_musl/src/malloc/mallocng/malloc.c:384 #2 0x00007f71f8381b2d successful calloc () astatine ../src_musl/src/malloc/calloc.c:41 #3 0x00007f71f83810f4 successful opendir () astatine ../src_musl/src/dirent/opendir.c:15 #4 0x00007f71f835c133 successful std::sys::fs::unix::readdir::{closure#0} () astatine library/std/src/sys/fs/unix.rs:2081 #5 std::sys::helpers::small_c_string::run_with_cstr_stack<*mut libc::unix::DIR> () astatine library/std/src/sys/helpers/small_c_string.rs:48 #6 std::sys::helpers::small_c_string::run_with_cstr<*mut libc::unix::DIR> () astatine library/std/src/sys/helpers/small_c_string.rs:28 #7 std::sys::helpers::small_c_string::run_path_with_cstr<*mut libc::unix::DIR> () astatine library/std/src/sys/helpers/small_c_string.rs:18 #8 std::sys::fs::unix::readdir () astatine library/std/src/sys/fs/unix.rs:2081 #9 std::sys::fs::read_dir () astatine library/std/src/sys/fs/mod.rs:68 #10 0x00007f71f8206b5c successful std::fs::read_dir<&std::path::Path> (path=...) astatine /home/dfranke/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/fs.rs:3265 #11 ignore::walk::Work::read_dir (self=0x7f71f5bfeb20) astatine crates/ignore/src/walk.rs:1551 #12 ignore::walk::Worker::run_one (self=0x7f71f5bfef08, work=...) astatine crates/ignore/src/walk.rs:1749 #13 ignore::walk::Worker::run (self=...) astatine crates/ignore/src/walk.rs:1697 #14 0x00007f71f821c866 successful ignore::walk::{impl#15}::visit::{closure#0}::{closure#1}::{closure#0} () astatine crates/ignore/src/walk.rs:1463 #15 std::sys::backtrace::__rust_begin_short_backtrace<ignore::walk::{impl#15}::visit::{closure#0}::{closure#1}::{closure_env#0}, ()> (f=...) astatine /home/dfranke/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/sys/backtrace.rs:166 #16 0x00007f71f8224596 successful std::thread::lifecycle::spawn_unchecked::{closure#1}::{closure#0}<ignore::walk::{impl#15}::visit::{closure#0}::{closure#1}::{closure_env#0}, ()> () astatine /home/dfranke/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/lifecycle.rs:70 #17 core::panic::unwind_safe::{impl#23}::call_once<(), std::thread::lifecycle::spawn_unchecked::{closure#1}::{closure_env#0}<ignore::walk::{impl#15}::visit::{closure#0}::{closure#1}::{closure_env#0}, ()>> (self=...) astatine /home/dfranke/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/panic/unwind_safe.rs:275 #18 std::panicking::catch_unwind::do_call<core::panic::unwind_safe::AssertUnwindSafe<std::thread::lifecycle::spawn_unchecked::{closure#1}::{closure_env#0}<ignore::walk::{impl#15}::visit::{closure#0}::{closure#1}::{closure_env#0}, ()>>, ()> (data=<error reference variable: Cannot entree representation astatine reside 0x0>) astatine /home/dfranke/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:581 #19 std::panicking::catch_unwind<(), core::panic::unwind_safe::AssertUnwindSafe<std::thread::lifecycle::spawn_unchecked::{closure#1}::{closure_env#0}<ignore::walk::{impl#15}::visit::{closure#0}::{closure#1}::{closure_env#0}, ()>>> (f=...) astatine /home/dfranke/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:544 #20 std::panic::catch_unwind<core::panic::unwind_safe::AssertUnwindSafe<std::thread::lifecycle::spawn_unchecked::{closure#1}::{closure_env#0}<ignore::walk::{impl#15}::visit::{closure#0}::{closure#1}::{closure_env#0}, ()>>, ()> (f=...) astatine /home/dfranke/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:359 #21 std::thread::lifecycle::spawn_unchecked::{closure#1}<ignore::walk::{impl#15}::visit::{closure#0}::{closure#1}::{closure_env#0}, ()> () astatine /home/dfranke/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/lifecycle.rs:68 #22 core::ops::function::FnOnce::call_once<std::thread::lifecycle::spawn_unchecked::{closure_env#1}<ignore::walk::{impl#15}::visit::{closure#0}::{closure#1}::{closure_env#0}, ()>, ()> () astatine /home/dfranke/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:250 #23 0x00007f71f8361fcf successful alloc::boxed::{impl#31}::call_once<(), (dyn core::ops::function::FnOnce<(), Output=()> + core::marker::Send), alloc::alloc::Global> () astatine library/alloc/src/boxed.rs:2275 #24 std::sys::thread::unix::{impl#2}::new::thread_start () astatine library/std/src/sys/thread/unix.rs:118 #25 0x00007f71f8388788 successful commencement () astatine ../src_musl/src/thread/pthread_create.c:207 #26 0x00007f71f8389e6c successful __clone () astatine ../src_musl/src/thread/x86_64/clone.s:22

Here is the core dump and the corresponding rg binary which produced it.