crash on magnet links

[shellbound]

transmission-daemon has started crashing whenever i add magnet links. i am adding them using a program that uses the api - Transmission Remote GUI. this is what i see in the debug log:

Assertion failed: (b->bit_count > 0), function tr_bitfieldGetRaw, file bitfield.
c, line 171.

i have a process manager restart the daemon when it crashes and it keeps restarting and crashing about 30 times until it finally has no problem with the magnet link. makes me think there is some sort of race condition at play.

using version r13332. the most recent link to cause the problem was for ​this torrent.

[cfpp2p]

hmmm .... I can't get this to happen with your provided magnetlink. Using v2.52+ and Transmission Remote GUI v4.0.3

[livings124]

Unfortunately this can't be reproduced. Please reopen if there's more information.

[shellbound]

this happens consistently for me. what information can i provide that will help?

[livings124]

That's a good question. Is it always the same crash message?

[shellbound]

yes

[jordan]

shellbound, I still am not seeing this crash. Is there any chance you could get a backtrace saying where the call to bitfield.c:171 is coming from?

[jordan]

any news on this?

[jordan]

any news on this?

[livings124]

Since this can't be reproduced, there's nothing we can do with this. Please reopen with more information.

[fmunozs]

I cross compiled the statically latest Transmission, and I am getting this assert, updated with a better backtrace, nostrip'ed binary hopefully this helps. This is running on ARM.

/home/developer $ TRANSMISSION_WEB_HOME=/opt/transmissionr/web gdb /opt/transmissionr/bin/transmission-daemon 
GNU gdb (GDB) 7.2-debian
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabi".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /opt/transmissionr/bin/transmission-daemon...done.
(gdb) r -f 
Starting program: /opt/transmissionr/bin/transmission-daemon -f
process 8549 is executing new program: /opt/transmissionr/bin/transmission-daemon
[Thread debugging using libthread_db enabled]
[New Thread 0x3acbf470 (LWP 8552)]
[New Thread 0x3aebf470 (LWP 8553)]
[New Thread 0x3b0bf470 (LWP 8554)]
[16:01:05.606] Transmission 2.61+ (13420) started (session.c:720)
[16:01:05.607] Couldn't read "/home/developer/.config/transmission-daemon/stats.json": No such file or directory (utils.c:445)
[16:01:05.607] Couldn't read "/home/developer/.config/transmission-daemon/stats.benc": No such file or directory (utils.c:445)
[16:01:05.607] Cache Maximum cache size set to 2.00 MiB (128 blocks) (cache.c:249)
[16:01:05.607] RPC Server Adding address to whitelist: 127.0.0.1 (rpc-server.c:803)
[16:01:05.607] RPC Server Serving RPC and Web requests on port 127.0.0.1:9091/transmission/ (rpc-server.c:997)
[16:01:05.607] RPC Server Whitelist enabled (rpc-server.c:1001)
[16:01:05.608] Bound socket 12 to port 51413 on 0.0.0.0 (net.c:373)
[16:01:05.608] Bound socket 13 to port 51413 on :: (net.c:373)
[16:01:05.608] UDP Failed to set receive buffer: requested 4194304, got 262142 (tr-udp.c:77)
[16:01:05.608] UDP Please add the line "net.core.rmem_max = 4194304" to /etc/sysctl.conf (tr-udp.c:82)
[16:01:05.608] UDP Failed to set send buffer: requested 1048576, got 262142 (tr-udp.c:88)
[16:01:05.608] UDP Please add the line "net.core.wmem_max = 1048576" to /etc/sysctl.conf (tr-udp.c:93)
[16:01:05.608] DHT Initializing DHT (tr-dht.c:276)
[16:01:05.608] DHT Reusing old id (tr-dht.c:305)
[16:01:05.608] DHT DHT initialized (tr-dht.c:330)
[16:01:05.608] DHT Bootstrapping from 150 IPv4 nodes (tr-dht.c:153)
[16:01:05.608] Using settings from "/home/developer/.config/transmission-daemon" (daemon.c:517)
[16:01:05.608] Saved "/home/developer/.config/transmission-daemon/settings.json" (bencode.c:1731)
[16:01:05.608] Breaking+Bad+S05E04+Fifty-One+HDTV+x264-FQM+[eztv] Read resume file "/home/developer/.config/transmission-daemon/resume/Breaking+Bad+S05E04+Fifty-One+HDTV+x264-FQM+[eztv].776060eac4e22888.resume" (resume.c:692)
[16:01:05.608] Breaking+Bad+S05E04+Fifty-One+HDTV+x264-FQM+[eztv] Couldn't load DND flags. DND list ((nil)) has 0 children; torrent has 0 files (resume.c:217)
[16:01:05.608] Loaded 1 torrents (session.c:1937)
[16:01:05.608] Port Forwarding (NAT-PMP) initnatpmp succeeded (0) (natpmp.c:72)
[16:01:05.608] Port Forwarding (NAT-PMP) sendpublicaddressrequest succeeded (2) (natpmp.c:72)
[16:01:13.611] Port Forwarding (UPnP) UPNP_GetValidIGD failed (errno 0 - Success) (upnp.c:214)
[16:01:13.611] Port Forwarding (UPnP) If your router supports UPnP, please make sure UPnP is enabled! (upnp.c:217)
[16:01:13.611] Port Forwarding Starting (port-forwarding.c:93)
[16:01:22.614] Breaking+Bad+S05E04+Fifty-One+HDTV+x264-FQM+[eztv] Scrape successful. Rescraping in 1800 seconds. (announcer.c:1352)
transmission-daemon: bitfield.c:171: tr_bitfieldGetRaw: Assertion `b->bit_count > 0' failed.

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x3acbf470 (LWP 8552)]
0x4105c5f4 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:67
67	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
	in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt
#0  0x4105c5f4 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:67
#1  0x41062158 in abort () at abort.c:88
#2  0x41054f28 in __assert_fail (assertion=<value optimized out>, file=<value optimized out>, line=<value optimized out>, function=0x41178bf0 "")
    at assert.c:78
#3  0x0004cb38 in tr_bitfieldGetRaw (b=0x3acbea2c, byte_count=0x3acbea78) at bitfield.c:171
#4  0x00050f9c in tr_cpCreatePieceBitfield (cp=0xe99d8, byte_count=0x3acbea78) at completion.c:289
#5  0x0007b1d4 in addField (tor=0xe97f0, inf=0xe97f8, st=0xe9ad8, d=0xfe9a0, key=0x1003fc "pieces") at rpcimpl.c:656
#6  0x0007bc40 in addInfo (tor=0xe97f0, d=0xfe9a0, fields=0xfe7a8) at rpcimpl.c:748
#7  0x0007be94 in torrentGet (session=0xe6228, args_in=0xfe720, args_out=0xfe8b8, idle_data=0x0) at rpcimpl.c:785
#8  0x0007f83c in request_exec (session=0xe6228, request=0x3acbebf8, callback=0x6d340 <rpc_response_func>, callback_user_data=0xe9228) at rpcimpl.c:1864
#9  0x0007fab0 in tr_rpc_request_exec_json (session=0xe6228, request_json=0xfed20, request_len=1051, callback=0x6d340 <rpc_response_func>, 
    callback_user_data=0xe9228) at rpcimpl.c:1907
#10 0x0006d4f8 in handle_rpc (req=0xe8ea0, server=0xe8d40) at rpc-server.c:553
#11 0x0006da48 in handle_request (req=0xe8ea0, arg=0xe8d40) at rpc-server.c:667
#12 0x000b0ea8 in evhttp_handle_request ()
#13 0x000affb4 in evhttp_connection_done ()
#14 0x000b04a8 in evhttp_read_body ()
#15 0x000a528c in _bufferevent_run_readcb ()
#16 0x000b8dc0 in bufferevent_readcb ()
#17 0x0009d150 in event_base_loop ()
#18 0x0003af3c in libeventThreadFunc (veh=0xe6040) at trevent.c:248
#19 0x0001e270 in ThreadFunc (_t=0xe6128) at platform.c:118
#20 0x4119d94c in start_thread (arg=<value optimized out>) at pthread_create.c:302
#21 0x41108868 in clone () at ../ports/sysdeps/unix/sysv/linux/arm/nptl/../clone.S:101
#22 0x41108868 in clone () at ../ports/sysdeps/unix/sysv/linux/arm/nptl/../clone.S:101
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) 

[rsd]

Same error here, crash while adding any magnet link, Transmission remote gui 4.0.3 and transmission-daemon 2.61+ (13450).

transmission-daemon: bitfield.c:171: tr_bitfieldGetRaw: Assertion `b->bit_count > 0' failed.

Here is the ​magnet link

And i also did a bt:

[New Thread 0x7ffff41ee700 (LWP 25048)]
[New Thread 0x7ffff39ed700 (LWP 25049)]
[New Thread 0x7ffff31ec700 (LWP 25050)]
[New Thread 0x7ffff29eb700 (LWP 25084)]
[Thread 0x7ffff29eb700 (LWP 25084) exited]

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff41ee700 (LWP 25048)]
0x00007ffff67601b5 in raise () from /lib/libc.so.6

Thread 4 (Thread 0x7ffff31ec700 (LWP 25050)):
#0  0x00007ffff6a9e86d in nanosleep () from /lib/libpthread.so.0
No symbol table info available.
#1  0x000000000042e5e7 in tr_wait_msec (msec=17016) at utils.c:858
        ts = {tv_sec = 17, tv_nsec = 16000000}
#2  0x0000000000427ed7 in nap (roughly_sec=15) at tr-dht.c:96
        roughly_msec = 15000
        msec = 17016
#3  0x000000000042836b in dht_bootstrap (closure=0x6b0590) at tr-dht.c:189
        cl = 0x6b0590
        i = 8
        num = 168
        num6 = 90
#4  0x0000000000414d95 in ThreadFunc (_t=0x6b05c0) at platform.c:118
        t = 0x6b05c0
#5  0x00007ffff6a968ca in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#6  0x00007ffff67fd92d in clone () from /lib/libc.so.6
No symbol table info available.
#7  0x0000000000000000 in ?? ()
No symbol table info available.

Thread 3 (Thread 0x7ffff39ed700 (LWP 25049)):
#0  0x00007ffff67f71a3 in select () from /lib/libc.so.6
No symbol table info available.
#1  0x0000000000431a93 in tr_select (nfds=0, r_fd_set=0x7ffff39ecd50, 
    w_fd_set=0x7ffff39eccd0, c_fd_set=0x7ffff39ecc50, t=0x7ffff39ecdf0)
    at web.c:307
No locals.
#2  0x0000000000431ed6 in tr_webThreadFunc (vsession=0x6a9260) at web.c:397
        usec = 1000000
        r_fd_set = {__fds_bits = {0 <repeats 16 times>}}
        max_fd = -1
        t = {tv_sec = 0, tv_usec = 385185}
        w_fd_set = {__fds_bits = {0 <repeats 16 times>}}
        c_fd_set = {__fds_bits = {0 <repeats 16 times>}}
        msec = 1000
        unused = 0
        msg = 0x0
        mcode = CURLM_OK
        multi = 0x7fffec016620
        web = 0x7fffec016560
        taskCount = 0
        task = 0x0
        session = 0x6a9260
#3  0x0000000000414d95 in ThreadFunc (_t=0x6aca10) at platform.c:118
        t = 0x6aca10
#4  0x00007ffff6a968ca in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#5  0x00007ffff67fd92d in clone () from /lib/libc.so.6
No symbol table info available.
#6  0x0000000000000000 in ?? ()
No symbol table info available.

Thread 2 (Thread 0x7ffff41ee700 (LWP 25048)):
#0  0x00007ffff67601b5 in raise () from /lib/libc.so.6
No symbol table info available.
#1  0x00007ffff6762fc0 in abort () from /lib/libc.so.6
No symbol table info available.
#2  0x00007ffff6759301 in __assert_fail () from /lib/libc.so.6
No symbol table info available.
#3  0x000000000043be66 in tr_bitfieldGetRaw (b=0x7ffff41ed820, 
    byte_count=0x7ffff41ed8c0) at bitfield.c:171
        n = 0
        bits = 0x0
        __PRETTY_FUNCTION__ = "tr_bitfieldGetRaw"
#4  0x000000000043f594 in tr_cpCreatePieceBitfield (cp=0x6b79e8, 
    byte_count=0x7ffff41ed8c0) at completion.c:289
        ret = 0x1
        pieces = {bits = 0x0, alloc_count = 0, bit_count = 0, true_count = 0, 
          have_all_hint = false, have_none_hint = false}
        n = 0
#5  0x0000000000463ca9 in addField (tor=0x6b77c0, inf=0x6b77c8, st=0x6b7b60, 
    d=0x6af790, key=0x6b2af8 "pieces") at rpcimpl.c:656
        byte_count = 0
        bytes = 0x7ffff41ed900
        str = 0x40880c "\205\300t\nH\213E\370H\213@\b\353\bH\213E\370H\203\300\b\311\303UH\211\345H\203\354\060H\211}\330H\211u\320H\213E\330H\211\307\350\317\363\377\377\204\300\017\204\214"
        keylen = 6
#6  0x0000000000464787 in addInfo (tor=0x6b77c0, d=0x6af790, fields=0x6b0990)
    at rpcimpl.c:748
        i = 34
        inf = 0x6b77c8
        st = 0x6b7b60
        str = 0x6b2af8 "pieces"
        n = 37
#7  0x0000000000464969 in torrentGet (session=0x6a9260, args_in=0x6af740, 
    args_out=0x6b30d0, idle_data=0x0) at rpcimpl.c:785
        i = 0
        torrentCount = 1
        torrents = 0x6af650
        list = 0x6b7730
        fields = 0x6b0990
        msg = 0x0
        strVal = 0x6b30d0 "\020wk"
        __PRETTY_FUNCTION__ = "torrentGet"
#8  0x0000000000467b5e in request_exec (session=0x6a9260, 
    request=0x7ffff41edb50, callback=0x45734b <rpc_response_func>, 
    callback_user_data=0x6ba7e0) at rpcimpl.c:1864
        tag = -1
        response = {val = {b = 176 '\260', d = 3.4707202539559222e-317, 
            i = 7024816, s = {len = 7024816, str = {
                buf = "\b\000\000\000\000\000\000\000\002\000\000\000\000\000\000", ptr = 0x8 <Address 0x8 out of bounds>}}, l = {vals = 0x6b30b0, alloc = 8, 
              count = 2}}, type = 8 '\b'}
        args_out = 0x6b30d0
        buf = 0x280
        i = 7
        str = 0x6af708 "torrent-get"
        args_in = 0x6af740
        result = 0x0
#9  0x0000000000467d9a in tr_rpc_request_exec_json (session=0x6a9260, 
    request_json=0x6b346a, request_len=639, 
    callback=0x45734b <rpc_response_func>, callback_user_data=0x6ba7e0)
    at rpcimpl.c:1907
        top = {val = {b = 224 '\340', d = 3.4634080823974717e-317, 
            i = 7010016, s = {len = 7010016, str = {
                buf = "\004\000\000\000\000\000\000\000\004\000\000\000\000\000\000", ptr = 0x4 <Address 0x4 out of bounds>}}, l = {vals = 0x6af6e0, 
              alloc = 4, count = 4}}, type = 8 '\b'}
        have_content = 1
#10 0x00000000004574e6 in handle_rpc (req=0x6ba720, server=0x6acff0)
    at rpc-server.c:553
        data = 0x6ba7e0
#11 0x0000000000457973 in handle_request (req=0x6ba720, arg=0x6acff0)
    at rpc-server.c:667
        auth = 0x0
        user = 0x0
        pass = 0x0
        server = 0x6acff0
#12 0x00007ffff79c027a in ?? () from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#13 0x00007ffff79bf4db in ?? () from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#14 0x00007ffff79bf925 in ?? () from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#15 0x00007ffff79bff85 in ?? () from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#16 0x00007ffff79b3538 in ?? () from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#17 0x00007ffff79ac799 in event_base_loop ()
   from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#18 0x000000000042c7d6 in libeventThreadFunc (veh=0x6a98a0) at trevent.c:248
        base = 0x6a9aa0
        eh = 0x6a98a0
#19 0x0000000000414d95 in ThreadFunc (_t=0x6a9920) at platform.c:118
        t = 0x6a9920
#20 0x00007ffff6a968ca in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#21 0x00007ffff67fd92d in clone () from /lib/libc.so.6
No symbol table info available.
#22 0x0000000000000000 in ?? ()
No symbol table info available.

Thread 1 (Thread 0x7ffff7fe1720 (LWP 25045)):
#0  0x00007ffff6a9e86d in nanosleep () from /lib/libpthread.so.0
No symbol table info available.
#1  0x000000000042e5e7 in tr_wait_msec (msec=1000) at utils.c:858
        ts = {tv_sec = 1, tv_nsec = 0}
#2  0x00000000004075b9 in main (argc=2, argv=0x7fffffffe758) at daemon.c:577
        c = 0
        optarg = 0x0
        settings = {val = {b = 176 '\260', d = 3.4531394220143073e-317, 
            i = 6989232, s = {len = 6989232, str = {
                buf = "\200\000\000\000\000\000\000\000\200\000\000\000\000\000\000", ptr = 0x80 <Address 0x80 out of bounds>}}, l = {vals = 0x6aa5b0, 
              alloc = 128, count = 128}}, type = 8 '\b'}
        boolVal = false
        loaded = true
        foreground = true
        dumpSettings = false
        configDir = 0x6a90f0 "/home/bla/.config/transmission-daemon"
        pid_filename = 0x6aac98 "test.pid"
        watchdir = 0x0
        pidfile_created = true
        session = 0x6a9260

[cfpp2p]

still no crash here

[jordan]

Fixed in r13504.