transmission-daemon on solaris 10 crashes frequently with SIGSEGV

[oh_noes]

Program received signal SIGSEGV, Segmentation fault. [Switching to LWP 2] 0xfed359b3 in t_splay () from /lib/libc.so.1

Solaris 10 Update 9 x86 (64bit) Intel platform, with ECC Memory 2x ZFS Mirror

Looking at Google it might have something to do with memory allocation inside libc?

This crashing didn't appear to start happen until I started building up a lot of torrents inside transmission-daemon (500GB+) which are constantly seeding. It appears the more torrents I have the more it crashes. When it first crashed, it caused it to keep crashing.

Anecdotally, one night when it started suddenly happening the only way I managed to get it to stop crashing (I had Solaris auto restarting it, and it could crash every 2 seconds) was to Pause all torrents. Re-check *all* torrents, and then Start them.

---

LDD below.

# ldd /usr/local/transmission/bin/transmission-daemon 
        libevent-1.4.so.2 =>     /usr/local/libevent/lib/libevent-1.4.so.2
        libresolv.so.2 =>        /lib/libresolv.so.2
        libcurl.so.4 =>  /usr/local/lib/libcurl.so.4
        libidn.so.11 =>  /usr/local/lib/libidn.so.11
        libintl.so.8 =>  /usr/local/lib/libintl.so.8
        libsec.so.1 =>   /lib/libsec.so.1
        libc.so.1 =>     /lib/libc.so.1
        libiconv.so.2 =>         /usr/local/lib/libiconv.so.2
        librt.so.1 =>    /lib/librt.so.1
        libssh2.so.1 =>  /usr/local/lib/libssh2.so.1
        libssl.so.1.0.0 =>       /usr/local/ssl/lib/libssl.so.1.0.0
        libcrypto.so.1.0.0 =>    /usr/local/ssl/lib/libcrypto.so.1.0.0
        libdl.so.1 =>    /lib/libdl.so.1
        libz.so =>       /usr/local/lib/libz.so
        libnsl.so.1 =>   /lib/libnsl.so.1
        libsocket.so.1 =>        /lib/libsocket.so.1
        libm.so.2 =>     /lib/libm.so.2
        libpthread.so.1 =>       /lib/libpthread.so.1
        libgcc_s.so.1 =>         /lib/libgcc_s.so.1
        libgcc_s.so.1 =>         /usr/local/lib/libgcc_s.so.1
        libavl.so.1 =>   /lib/libavl.so.1
        libaio.so.1 =>   /lib/libaio.so.1
        libmd.so.1 =>    /lib/libmd.so.1
        libmp.so.2 =>    /lib/libmp.so.2
        libscf.so.1 =>   /lib/libscf.so.1
        libdoor.so.1 =>  /lib/libdoor.so.1
        libuutil.so.1 =>         /lib/libuutil.so.1
        libgen.so.1 =>   /lib/libgen.so.1

---

GDB Below.

I've removed all torrent related lines (rescraping, scape successful etc).

[SERVER:/export/home/username][username]# /usr/local/bin/gdb "/usr/local/transmission/bin/transmission-daemon"
GNU gdb 6.8
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i386-pc-solaris2.10"...
(gdb) handle SIGPIPE nostop noprint nopass
Signal        Stop      Print   Pass to program Description
SIGPIPE       No        No      No              Broken pipe
(gdb) run "--config-dir" "/data/info" "--log-debug" "--foreground"
Starting program: /usr/local/transmission/bin/transmission-daemon "--config-dir" "/data/info" "--log-debug" "--foreground"
warning: Lowest section in /lib/libpthread.so.1 is .dynamic at 00000074
[New LWP 1]
[New LWP 2]
[New LWP 3]
[New LWP 4]
[13:46:09.607] Blocklist "level1.bin" updated with 224914 entries (blocklist.c:373)
[13:46:09.608] Blocklist "level1.bin" contains 224914 entries (blocklist.c:114)
[13:46:09.608] Found 2 blocklists in "/data/info/blocklists" (session.c:2078)
[13:46:09.608] Found 1 new blocklists in "/data/info/blocklists" (session.c:2080)
[13:46:09.608] Transmission 2.13 (11501) started (session.c:624)
[13:46:09.608] Cache Maximum cache size set to 2.00 MiB (128 blocks) (cache.c:253)
[13:46:09.608] RPC Server Adding address to whitelist: 127.0.0.1 (rpc-server.c:789)
[13:46:09.608] RPC Server Adding address to whitelist: 172.16.50.* (rpc-server.c:789)
[13:46:09.608] RPC Server Serving RPC and Web requests on port 9091 (rpc-server.c:962)
[13:46:09.608] RPC Server Whitelist enabled (rpc-server.c:966)
[13:46:09.608] Bound socket 13 to port 61233 on 0.0.0.0 (net.c:415)
[13:46:09.608] Bound socket 14 to port 61233 on :: (net.c:415)
[13:46:09.608] Port Forwarding Stopped (port-forwarding.c:184)
[13:46:09.608] setrlimit( RLIMIT_NOFILE, 2048 ) (fdlimit.c:854)
[13:46:09.608] socket limit is 512 (fdlimit.c:862)
[13:46:09.608] Using settings from "/data/info" (daemon.c:483)
[13:46:09.608] Saved "/data/info/settings.json" (bencode.c:1683)
[13:46:09.608] Blocklist "level1.bin" contains 224914 entries (blocklist.c:114)
[13:46:09.608] Blocklist "blocklist.bin" contains 224908 entries (blocklist.c:114)
[13:46:09.611] Loaded 34 torrents (session.c:1816)
[LWP 4 exited]
[New LWP 4]
[13:46:20.612] SO_SNDBUF size is 49152 (fdlimit.c:676)
[13:46:20.612] SO_RCVBUF size is 49152 (fdlimit.c:678)



Program received signal SIGSEGV, Segmentation fault.
[Switching to LWP 2]
0xfed359b3 in t_splay () from /lib/libc.so.1

(gdb) thread apply all bt

Thread 3 (LWP 3):
#0  0xfed9af15 in __pollsys () from /lib/libc.so.1
#1  0xfed8cd46 in _pollsys () from /lib/libc.so.1
#2  0xfed443be in pselect () from /lib/libc.so.1
#3  0xfed446b4 in select () from /lib/libc.so.1
#4  0x0807c00c in tr_select (nfds=20, r_fd_set=0xfe4b5ef0, w_fd_set=0xfe4b5e70, c_fd_set=0xfe4b5df0, t=0xfe4b5f78) at web.c:258
#5  0x0807c2a4 in tr_webThreadFunc (vsession=0x80cecd0) at web.c:331
#6  0x08067317 in ThreadFunc (_t=0x80ce690) at platform.c:110
#7  0xfed97b30 in _thr_setup () from /lib/libc.so.1
#8  0xfed97e20 in L3_doit () from /lib/libc.so.1
#9  0xfe670a00 in ?? ()
#10 0x00000000 in ?? ()

Thread 2 (LWP 2):
#0  0xfed359b3 in t_splay () from /lib/libc.so.1
#1  0xfed35880 in t_delete () from /lib/libc.so.1
#2  0xfed352e0 in realloc () from /lib/libc.so.1
#3  0xfef85de7 in evbuffer_expand (buf=0x831fcf8, datlen=4096) at buffer.c:376
#4  0xfef8611b in evbuffer_read (buf=0x831fcf8, fd=36, howmuch=4096) at buffer.c:469
#5  0x08065b98 in event_read_cb (fd=36, event=2, vio=0x8ab7620) at peer-io.c:238
#6  0xfef85661 in event_base_loop (base=0x80cf6e8, flags=0) at event.c:395
#7  0xfef8594f in event_loop (flags=0) at event.c:471
#8  0xfef8596e in event_dispatch () at event.c:409
#9  0x08077d6f in libeventThreadFunc (veh=0x80d4008) at trevent.c:244
#10 0x08067317 in ThreadFunc (_t=0x80ce618) at platform.c:110
#11 0xfed97b30 in _thr_setup () from /lib/libc.so.1
#12 0xfed97e20 in L3_doit () from /lib/libc.so.1
#13 0xfe670200 in ?? ()
#14 0x00000000 in ?? ()

Thread 1 (LWP 1):
#0  0xfed9a215 in ___nanosleep () from /lib/libc.so.1
#1  0xfed8bc72 in __nanosleep () from /lib/libc.so.1
#2  0xfebe2b67 in nanosleep () from /lib/librt.so.1
#3  0x080793da in tr_wait_msec (msec=1000) at utils.c:869
#4  0x0805d711 in main (argc=5, argv=0x8047c70) at daemon.c:537
#0  0xfed359b3 in t_splay () from /lib/libc.so.1

[jordan]

Could you please see if you can reproduce this error with a nightly tarball from ​https://build.transmissionbt.com/job/2.0x-linux/ ?

[oh_noes]

Thanks.

I can confirm it's fixed in 2.13+ (11666).

daemon no longer crashes.