Fix: ensure that linux binaries have 8mb stack size (musl) by dimitris-m · Pull Request #563 · opengrep/opengrep

dimitris-m · 2026-02-02T19:26:00Z

Opengrep Core Segfault (-11) - Root Cause and Fix

Opengrep Version: 1.15.1

Summary

The opengrep-core exited with -11 (SIGSEGV) crash on Linux with multiple domains (-j > 1) was caused by musl libc's 128KB default pthread stack size, which is insufficient for PCRE's recursive pattern matching used by aliengrep rules.

Root Cause

musl libc defaults to 128KB pthread stack size, compared to glibc's 8MB. When opengrep runs complex aliengrep patterns with PCRE's recursive matching across multiple domains, the 128KB stack overflows.

From musl libc documentation:

"Thread stack size is not determined by RLIMIT_STACK on musl; the default is approximately 128KB."

The crash manifests as:

SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7fffeb378ee8}

SEGV_ACCERR with a stack-region address indicates hitting the stack guard page (stack overflow).

Fix

Added -Wl,-z,stack-size=8388608 linker flag to set 8MB default pthread stack size in src/main/flags.sh:

# In the Alpine Linux case (lines 62-76):
linux)
    if [[ -e /etc/alpine-release ]]; then
        # -Wl,-z,stack-size=8388608: Set default pthread stack size to 8MB.
        # musl libc defaults to only 128KB which causes stack overflow in
        # PCRE's recursive pattern matching (used by aliengrep).
        # See: https://wiki.musl-libc.org/functional-differences-from-glibc.html
        FLAGS=()
        CCLIB=("-lidn2" "-lunistring" "-lpsl" "-lssl" "-lcrypto" "-lz")
        CCOPT=("-static" "-no-pie" "-Wl,-z,stack-size=8388608")

This linker flag sets the PT_GNU_STACK program header in the ELF binary, which musl reads to determine the default pthread stack size.

Verification

Proprietary rules were used.

Raspberry Pi 4 (aarch64, native Linux)

Binary	Stack Size	Result
OLD	128KB (default)	100% crash rate
FIXED	8MB	50/50 success (0% crash)

Docker on Mac (x86_64, AWS Lambda-like)

Binary	Stack Size	Aliengrep Rules	Full Rules
OLD	128KB (default)	1/10 success (90% crash)	-
FIXED	8MB	10/10 success (0% crash)	10/10 success (0% crash)

Binary Verification

# OLD binary - no stack size set (uses 128KB default)
$ readelf -l opengrep-cli | grep -A1 GNU_STACK
  GNU_STACK      0x0 0x0 0x0
                 0x0 0x0  RW     0x10

# FIXED binary - 8MB stack size
$ readelf -l opengrep-cli-fixed | grep -A1 GNU_STACK
  GNU_STACK      0x0 0x0 0x0
                 0x0 0x800000  RW     0x10
                     ^^^^^^^^ = 8,388,608 bytes = 8MB

Affected Environments

All our Linux binaries are affected and these are commonly used in:

AWS Lambda
Docker containers
Kubernetes pods

This may explain issues like #204.

Not affected:

macOS
Windows
Single-threaded execution (-j 1)

Why Aliengrep Specifically?

Aliengrep uses complex PCRE patterns with:

(?(DEFINE)...) blocks for named subroutines
Recursive pattern references (?&name)
Deep backtracking

These features cause PCRE to use significant stack space during matching. The 128KB musl default is insufficient, while 8MB provides adequate headroom.

References

musl libc functional differences
Issue #204 - related crashes on Kubernetes

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [opengrep/opengrep](https://github.com/opengrep/opengrep) | minor | `v1.15.1` → `v1.16.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>opengrep/opengrep (opengrep/opengrep)</summary> ### [`v1.16.0`](https://github.com/opengrep/opengrep/releases/tag/v1.16.0): Opengrep 1.16.0 [Compare Source](opengrep/opengrep@v1.15.1...v1.16.0) #### Improvements - Dart: Add typed metavariabless by [@maciejpirog](https://github.com/maciejpirog) in [#551](opengrep/opengrep#551) - Dart: Use case of identifier to guess call vs new by [@maciejpirog](https://github.com/maciejpirog) in [#555](opengrep/opengrep#555) - Go: Enable goroutines in taint tracking by [@maciejpirog](https://github.com/maciejpirog) in [#559](opengrep/opengrep#559) - Add taint propagation via "for" comprehensions by [@maciejpirog](https://github.com/maciejpirog) in [#564](opengrep/opengrep#564) #### Bug Fixes - Rust: Missing Rust type alias translation by [@smith-xyz](https://github.com/smith-xyz) in [#549](opengrep/opengrep#549) - Fix: Ensure that linux binaries have 8mb stack size (musl) by [@dimitris-m](https://github.com/dimitris-m) in [#563](opengrep/opengrep#563) - Fixed a perf regression by removing system calls and improving the reachability graph and the callee lookup by [@corneliuhoffman](https://github.com/corneliuhoffman) in [#556](opengrep/opengrep#556) - Fixed intrafile bug introduced by a superfluous fallback by [@corneliuhoffman](https://github.com/corneliuhoffman) in [#567](opengrep/opengrep#567) - Ruby: Always translate `or` and `and` to expression by [@maciejpirog](https://github.com/maciejpirog) in [#562](opengrep/opengrep#562) - Bash: Allow redirects before command arguments by [@maciejpirog](https://github.com/maciejpirog) in [#548](opengrep/opengrep#548) #### Internal Improvements - Add `show dump-intrafile-graph` and `show dump-taint-signatures` commands by [@corneliuhoffman](https://github.com/corneliuhoffman) in [#552](opengrep/opengrep#552) - Improve tainting code by [@maciejpirog](https://github.com/maciejpirog) in [#546](opengrep/opengrep#546) - Graph refactoring by [@corneliuhoffman](https://github.com/corneliuhoffman) in [#553](opengrep/opengrep#553) #### New Contributors - [@smith-xyz](https://github.com/smith-xyz) made their first contribution in [#549](opengrep/opengrep#549) **Full Changelog**: <opengrep/opengrep@v1.15.1...v1.16.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

dimitris-m requested review from corneliuhoffman, maciejpirog and willem-delbare as code owners February 2, 2026 19:26

dimitris-m force-pushed the dm/better-print-thread-safety branch from 81633f0 to 7a691f4 Compare February 3, 2026 21:32

dimitris-m changed the title ~~WIP: Ensure that console printing is thread safe~~ Fix: ensure that linux binaries have 8mb stack size (musl) Feb 3, 2026

maciejpirog approved these changes Feb 3, 2026

View reviewed changes

dimitris-m added 2 commits February 4, 2026 00:16

remove unused function

aa5542b

increase musl stack size to 8mb

55ac586

dimitris-m force-pushed the dm/better-print-thread-safety branch from 7a691f4 to 55ac586 Compare February 4, 2026 00:16

dimitris-m merged commit bb32e0b into main Feb 4, 2026
1 check passed

dimitris-m deleted the dm/better-print-thread-safety branch February 4, 2026 00:17

maciejpirog mentioned this pull request Feb 4, 2026

Release v1.16.0 #568

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: ensure that linux binaries have 8mb stack size (musl)#563

Fix: ensure that linux binaries have 8mb stack size (musl)#563
dimitris-m merged 2 commits intomainfrom
dm/better-print-thread-safety

dimitris-m commented Feb 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dimitris-m commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Opengrep Core Segfault (-11) - Root Cause and Fix

Summary

Root Cause

Fix

Verification

Raspberry Pi 4 (aarch64, native Linux)

Docker on Mac (x86_64, AWS Lambda-like)

Binary Verification

Affected Environments

Why Aliengrep Specifically?

References

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dimitris-m commented Feb 2, 2026 •

edited

Loading