Opened 8 years ago

Closed 8 years ago

#5095 closed Bug (duplicate)

transmission-daemon 2.73 segfaults in tr_peerIoFlush

Reported by: bircoph Owned by:
Priority: Normal Milestone: None Set
Component: Transmission Version: 2.71
Severity: Major Keywords:
Cc:

Description

Once in a while (depends on an actual load, about several times per 24 hours in general) transmission-daemon from transmission-2.71 segfaults. Distribution is Gentoo.

I recompiled program with -ggdb and here is backtrace:

#0 0xb7705424 in kernel_vsyscall () No symbol table info available. #1 0xb7360976 in writev () from /lib/libc.so.6 No symbol table info available. #2 0xb7684898 in ?? () from /usr/lib/libevent-2.0.so.5 No symbol table info available. #3 0xb7687f15 in evbuffer_write_atmost () from /usr/lib/libevent-2.0.so.5 No symbol table info available. #4 0x08055b2b in tr_evbuffer_write (io=0xb677d7c8, fd=49, howmuch=68) at peer-io.c:317

e = <optimized out> n = <optimized out> errstr = "\001\000\000\000\000\000\000\000\001\000\000\000\064[\005\bȲ\177\266\061\000\000\000\233\033/\267\364\217k\267\360G0\265\000\000\000\000\310\327w\266%\016h\267\000\000\000\000\210\227\177\266i\343g\267\030\000\000\000\360G0\265\366\rh\267\020\000p\266+\021h\267\360G0\265\000\000\000\000\001\000\000\000\270\250\036\265\270\250\036\265L\262\030\265\270\v\000\000\227\023\b\b \241\377\264D-\a\267(\272p\266\330\235\006\bX-\a\267\v", '\000' <repeats 15 times>"\270, \v\000\000\000\000\000\000\004\323\372\bD\000\000\000\000\000\000\000\246\030\062\267\330\235\006\b\210-\a\267\000\000\000\000\001\000\000\000\270\250\036\265/\266\204l:\001\000\000\257\025~PD\000\000\000/\266\204l:\001\000\000\004\323\372\b\317\070\a\b\277\000\000\000\000\000\000\000_\256\204lOYh\267\000\000\000\000\177\f\177\003\000\000\000\000\000\000\000"

#5 0x08055cc1 in tr_peerIoTryWrite (io=0xb677d7c8, howmuch=68) at peer-io.c:1286

e = <optimized out> n = 0 old_len = <optimized out>

#6 0x08057cfd in tr_peerIoFlush (io=0xb677d7c8, dir=TR_CLIENT_TO_PEER, limit=3000) at peer-io.c:1320

bytesUsed = 0

#7 0x0807356d in phaseOne (peerArray=<optimized out>, dir=TR_CLIENT_TO_PEER) at bandwidth.c:219

i = 3 increment = 3000 bytesUsed = <optimized out> n = 4 peerCount = 4 peers = 0xb67c92f8

#8 0x08073b34 in tr_bandwidthAllocate (b=0x8fad304, dir=TR_CLIENT_TO_PEER, period_msec=500)

at bandwidth.c:271

i = <optimized out> peerCount = 16 tmp = {items = 0xb67021e0, n_items = 16, n_alloc = 32} low = {items = 0xb6791018, n_items = 16, n_alloc = 32} high = {items = 0x0, n_items = 0, n_alloc = 0} normal = {items = 0xb67c92f8, n_items = 16, n_alloc = 32} peers = 0xb67021e0

#9 0x0807ec7a in bandwidthPulse (foo=-1, bar=1, vmgr=0xb6701290) at peer-mgr.c:3593

tor = <optimized out> mgr = 0xb6701290 session = 0x8fad1d0

#10 0xb767ff91 in event_base_loop () from /usr/lib/libevent-2.0.so.5 No symbol table info available. #11 0xb7680de3 in event_base_dispatch () from /usr/lib/libevent-2.0.so.5 No symbol table info available. #12 0x08068df0 in libeventThreadFunc (veh=0x8faff60) at trevent.c:248

base = 0xb6700480 eh = 0x8faff60

#13 0x08057dc0 in ThreadFunc? (_t=0x8faffb0) at platform.c:118

t = 0x8faffb0

#14 0xb7423d7f in start_thread () from /lib/libpthread.so.0 No symbol table info available. #15 0xb73689be in clone () from /lib/libc.so.6 No symbol table info available.

libevent-2.0.19 is used, transmission's config.log will follow.

Attachments (1)

config.log (158.5 KB) - added by bircoph 8 years ago.
config.log for crashed build

Download all attachments as: .zip

Change History (25)

Changed 8 years ago by bircoph

config.log for crashed build

comment:1 Changed 8 years ago by jordan

bircoph, could you try this in valgrind?

comment:2 Changed 8 years ago by bircoph

Hello,

I'll use valgrind as soon as I'll be able to catch this bug again. As for now, I updated libevent to 2.0.20 and haven't seen this bug for about 1.5 days.

comment:3 Changed 8 years ago by bircoph

I just updated transmission to 2.72 (2.73 sources are not fetchable at this moment and there is really no difference between 2.72 and 2.73 on Linux). We'll see if I'll catch this bug again.

comment:4 Changed 8 years ago by bircoph

  • Resolution set to worksforme
  • Status changed from new to closed
  • Version changed from 2.71 to 2.72

Hello,

with transmission-2.72 and libevent-2.0.20 I can't reproduce this issue anymore.

comment:5 Changed 8 years ago by bircoph

Huh, just when I thought the issue is closed, transmission-2.72 segfaulted again: [kernel] transmission-da[2941]: segfault at 103e ip 0000103e sp b70c7f80 error 4 in transmission-daemon[8048000+71000]

I'll recompile with debug info and will post gdb backtrace when this bug will occur again. Afterwards I'll post valgrind output on next error (perhaps valgrind --db-attach=yes). I do not want to run valgrind --vgdb=full as this will kill host performance for several days.

comment:6 Changed 8 years ago by livings124

  • Version changed from 2.72 to 2.71

comment:7 Changed 8 years ago by rsd

Same bug here, multiple crashes in a day.

I'm running transmission-daemon 2.73+ (13620) on a fully uptodate debian squeeze.

Program received signal SIGPIPE, Broken pipe.
[Switching to Thread 0x7ffff41ee700 (LWP 11122)]
0x00007ffff67f6a57 in writev () from /lib/libc.so.6
(gdb) where
#0  0x00007ffff67f6a57 in writev () from /lib/libc.so.6
#1  0x00007ffff79b064a in ?? () from /usr/local/lib/libevent-2.0.so.5
#2  0x00007ffff79b1108 in evbuffer_write_atmost ()
   from /usr/local/lib/libevent-2.0.so.5
#3  0x00000000004131b7 in tr_evbuffer_write (io=0x8d1db0, fd=62, howmuch=3000)
    at peer-io.c:317
#4  0x0000000000415c2f in tr_peerIoTryWrite (io=0x8d1db0, howmuch=3000)
    at peer-io.c:1286
#5  0x0000000000415df9 in tr_peerIoFlush (io=0x8d1db0, dir=TR_CLIENT_TO_PEER, 
    limit=3000) at peer-io.c:1320
#6  0x000000000043c319 in phaseOne (peerArray=0x7ffff41edcd0, 
    dir=TR_CLIENT_TO_PEER) at bandwidth.c:219
#7  0x000000000043c528 in tr_bandwidthAllocate (b=0x6ae7b0, 
    dir=TR_CLIENT_TO_PEER, period_msec=500) at bandwidth.c:271
#8  0x000000000044d2dd in bandwidthPulse (foo=-1, bar=1, vmgr=0x6af760)
    at peer-mgr.c:3611
#9  0x00007ffff79ac799 in event_base_loop ()
   from /usr/local/lib/libevent-2.0.so.5
#10 0x000000000042dac2 in libeventThreadFunc (veh=0x6aeb90) at trevent.c:248
#11 0x0000000000415f61 in ThreadFunc (_t=0x6aec10) at platform.c:118
#12 0x00007ffff6a968ca in start_thread () from /lib/libpthread.so.0
#13 0x00007ffff67fdb6d in clone () from /lib/libc.so.6
#14 0x0000000000000000 in ?? ()



Thread 3 (Thread 0x7ffff39ed700 (LWP 11123)):
#0  0x00007ffff67f73e3 in select () from /lib/libc.so.6
No symbol table info available.
#1  0x0000000000432dc7 in tr_select (nfds=0, r_fd_set=0x7ffff39ecd50, 
    w_fd_set=0x7ffff39eccd0, c_fd_set=0x7ffff39ecc50, t=0x7ffff39ecdf0)
    at web.c:307
No locals.
#2  0x000000000043320a in tr_webThreadFunc (vsession=0x6ae5c0) at web.c:397
        usec = 1000000
        r_fd_set = {__fds_bits = {0 <repeats 16 times>}}
        max_fd = -1
        t = {tv_sec = 0, tv_usec = 230848}
        w_fd_set = {__fds_bits = {0 <repeats 16 times>}}
        c_fd_set = {__fds_bits = {0 <repeats 16 times>}}
        msec = 1000
        unused = 0
        msg = 0x0
        mcode = CURLM_OK
        multi = 0x6c7d70
        web = 0x6c7cb0
        taskCount = 0
        task = 0xd93d80
        session = 0x6ae5c0
#3  0x0000000000415f61 in ThreadFunc (_t=0x6afd10) at platform.c:118
        t = 0x6afd10
#4  0x00007ffff6a968ca in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#5  0x00007ffff67fdb6d in clone () from /lib/libc.so.6
No symbol table info available.
#6  0x0000000000000000 in ?? ()
No symbol table info available.

Thread 2 (Thread 0x7ffff41ee700 (LWP 11122)):
#0  0x00007ffff67f6a57 in writev () from /lib/libc.so.6
No symbol table info available.
#1  0x00007ffff79b064a in ?? () from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#2  0x00007ffff79b1108 in evbuffer_write_atmost ()
   from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#3  0x00000000004131b7 in tr_evbuffer_write (io=0x8d1db0, fd=62, howmuch=3000)
    at peer-io.c:317
        e = 4442409
        n = 0
        errstr = "\000\000\000\000\000\000\000\000\260\347j\000\000\000\000\000\027\357\250P\000\000\000\000p\245\354\000\000\000\000\000\300\330\036\364\377\177\000\000p\245\354\000\000\000\000\000\340\330\036\364\377\177\000\000\000\000\000\000\000\000\000\000\020\331\036\364\377\177\000\000\363\310C", '\000' <repeats 13 times>"\270, \v", '\000' <repeats 14 times>"\300, \360m\000\000\000\000\000\260\255\203\000\000\000\000\000p\245\354\000\000\000\000\000p\245\354\000\000\000\000\000\027\357\250P\000\000\000\000@\331\036\364\377\177\000\000\000\000\000\000\000\000\000\000p\331\036\364\377\177\000\000\363\310C\000\000\000\000\000\260\255\203\000\000\000\000\000\270\v", '\000' <repeats 14 times>, "8\036\215\000\000\000\000\000\220\331\036\364\377\177\000\000!,A\000\000\000\000\000\273*A\000\000\000\000\000`\255\203\000\000\000\000\000\270\v\000\000\000\000\000\000\000\335\036\364\377\177\000"
#4  0x0000000000415c2f in tr_peerIoTryWrite (io=0x8d1db0, howmuch=3000)
    at peer-io.c:1286
        e = -199304208
        n = 0
        old_len = 41800
#5  0x0000000000415df9 in tr_peerIoFlush (io=0x8d1db0, dir=TR_CLIENT_TO_PEER, 
    limit=3000) at peer-io.c:1320
        bytesUsed = 0
        __PRETTY_FUNCTION__ = "tr_peerIoFlush"
#6  0x000000000043c319 in phaseOne (peerArray=0x7ffff41edcd0, 
    dir=TR_CLIENT_TO_PEER) at bandwidth.c:219
        i = 8
        increment = 3000
        bytesUsed = -1
        n = 15
        peerCount = 36
        peers = 0xbd96d0
#7  0x000000000043c528 in tr_bandwidthAllocate (b=0x6ae7b0, 
    dir=TR_CLIENT_TO_PEER, period_msec=500) at bandwidth.c:271
        i = 36
        peerCount = 36
        tmp = {items = 0xcb68e0, n_items = 36, n_alloc = 64}
        low = {items = 0xc0c2d0, n_items = 36, n_alloc = 64}
        high = {items = 0x0, n_items = 0, n_alloc = 0}
        normal = {items = 0xbd96d0, n_items = 36, n_alloc = 64}
        peers = 0xcb68e0
#8  0x000000000044d2dd in bandwidthPulse (foo=-1, bar=1, vmgr=0x6af760)
    at peer-mgr.c:3611
        tor = 0x6aed60
        mgr = 0x6af760
        session = 0x6ae5c0
#9  0x00007ffff79ac799 in event_base_loop ()
   from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#10 0x000000000042dac2 in libeventThreadFunc (veh=0x6aeb90) at trevent.c:248
        base = 0x6aed60
        eh = 0x6aeb90
#11 0x0000000000415f61 in ThreadFunc (_t=0x6aec10) at platform.c:118
        t = 0x6aec10
#12 0x00007ffff6a968ca in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#13 0x00007ffff67fdb6d in clone () from /lib/libc.so.6
No symbol table info available.
#14 0x0000000000000000 in ?? ()
No symbol table info available.

Thread 1 (Thread 0x7ffff7fe1720 (LWP 11119)):
#0  0x00007ffff6a9e86d in nanosleep () from /lib/libpthread.so.0
No symbol table info available.
#1  0x000000000042f8d3 in tr_wait_msec (msec=1000) at utils.c:862
        ts = {tv_sec = 1, tv_nsec = 0}
#2  0x0000000000407609 in main (argc=3, argv=0x7fffffffe748) at daemon.c:577
        c = 0
        optarg = 0x0
        settings = {val = {b = 176 '\260', d = 3.4592105006704045e-317, 
            i = 7001520, s = {len = 7001520, str = {
                buf = "\200\000\000\000\000\000\000\000\200\000\000\000\000\000\000", ptr = 0x80 <Address 0x80 out of bounds>}}, l = {vals = 0x6ad5b0, 
              alloc = 128, count = 128}}, type = 8 '\b'}
        boolVal = false
        loaded = true
        foreground = true
        dumpSettings = false
        configDir = 0x6ac0f0 "/home/exz/.config/transmission-daemon"
        pid_filename = 0x6adc98 "ciao.pid"
        watchdir = 0x0
        pidfile_created = true
        session = 0x6ae5c0
A debugging session is active.

comment:8 Changed 8 years ago by rsd

  • Resolution worksforme deleted
  • Severity changed from Normal to Major
  • Status changed from closed to reopened

comment:9 Changed 8 years ago by x190

Please try running in gdb in this manner to handle SIGPIPE.

$ gdb transmission-daemon
(gdb) handle SIGPIPE nostop noprint nopass
(gdb) r -f
... run until Transmission crashes...
(gdb) thread apply all bt full
Last edited 8 years ago by x190 (previous) (diff)

comment:10 Changed 8 years ago by jordan

  • Summary changed from transmission-daemon 2.71 segfaults to transmission-daemon 2.71 segfaults in tr_peerIoFlush

comment:11 Changed 8 years ago by bircoph

I've seen this issue with 2.73 too (and I use 2.73 now). I saved full trace with proper SIGPIPE handling, but due to an error its lost now...

It looks like this bug is reproducible only on high loads (or maybe on some rare condition), so it will take some time to reproduce it again.

comment:12 Changed 8 years ago by bircoph

  • Summary changed from transmission-daemon 2.71 segfaults in tr_peerIoFlush to transmission-daemon 2.73 segfaults in tr_peerIoFlush
  • Version changed from 2.71 to 2.73

comment:13 Changed 8 years ago by livings124

  • Version changed from 2.73 to 2.71

comment:14 Changed 8 years ago by bircoph

  • Version changed from 2.71 to 2.73

Hm, I was lucky to catch it soon: here is a backtrace for SIGSEGV:

Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb70f6b40 (LWP 5416) (gdb) bt #0 0x0809d45f in UTPSocket::selective_ack (this=0xd4bb, base=54458, mask=0xd4b9 <Address 0xd4b9 out of bounds>, len=15 '\017') at utp.cpp:1546 #1 0x0000d4bc in ?? () #2 0x0000d4bb in ?? () #3 0x0000d4ba in ?? () #4 0x0000d4b9 in ?? () #5 0x0000000f in ?? () #6 0x00000000 in ?? ()

Please not that whole program is compiled with -ggdb, looks like stack is corrupted.

comment:15 Changed 8 years ago by livings124

  • Version changed from 2.73 to 2.71

comment:16 Changed 8 years ago by x190

See #5002 et al.

bircoph: Can you test with the latest revision? Please check that r13620 changes are included in source code.

https://build.transmissionbt.com/job/trunk-linux/

comment:17 follow-ups: Changed 8 years ago by cfpp2p

I might be seeing two separate bugs in this ticket. bircoph's originaly posted crash (#5095) with libevent's writev() and aslo the exact same libevent crash posted by rsd (comment:7) also crashes in libevent writev(). This first bug might be fixed by updating libevent to 2.0.20 or current libevent version 2.0.21-stable (18 Nov 2012). bircoph stated at comment:4 that the issue seemed fixed with updating to libevent-2.0.20. Both rsd and bircoph comment that crashes occur several times in a day.

But then at comment:5 bircoph gets another crash and this appears to be a different crash comment:14, namely the infamous UTPSocket::selective_ack crash reported in a multitude of tickets ( #5044 #5002 #4960 #4935 #5062 #4658 etc. ) This second bug might be fixed by r13620. bircoph comments that crashes are infrequent.

rsd states:

I'm running transmission-daemon 2.73+ (13620) on a fully uptodate debian squeeze

rsd --- what version of libevent were you using when the original crash occured? Does updating libevent to 2.0.20 or 2.0.21-stable (18 Nov 2012) fix the issue for you?

please note that at this moment https://build.transmissionbt.com/job/trunk-linux/ is ONLY r13619 NOT YET!! r13620

Last edited 8 years ago by cfpp2p (previous) (diff)

comment:18 in reply to: ↑ 17 Changed 8 years ago by bircoph

To put things clear, at the moment of hitting the second bug I used libevent-2.0.21 and transmission-2.73.

I'll try r13620 (or above) when I'll have some time to install it properly, perhaps this weekend.

comment:19 Changed 8 years ago by rsd

I'm having a hard time reproducing the issue after trying (gdb) handle SIGPIPE nostop noprint nopass

and i can confirm this happens under weird conditions (maybe not enough space on the hd?) . Looks like i'm running libevent-2.0.18 (according to aptitude) and i will try to backport the latest version (if possible).

I'll keep you updated.

comment:20 in reply to: ↑ 17 Changed 8 years ago by rsd

Replying to cfpp2p:

But then at comment:5 bircoph gets another crash and this appears to be a different crash comment:14, namely the infamous UTPSocket::selective_ack crash reported in a multitude of tickets ( #5044 #5002 #4960 #4935 #5062 #4658 etc. ) This second bug might be fixed by r13620. bircoph comments that crashes are infrequent.

Should i open a new ticket or post somewhere else about the second bug?
transmission-daemon 2.73+ (13622) just crashed, and i got exactly that error. Hopefully i was debugging, here is the backtrace:

[Switching to Thread 0x7ffff41ee700 (LWP 18011)]
0x000000000047b1e7 in UTPSocket::selective_ack (this=0x1432610, base=9431, mask=0x7ffff41ecd76 "",
    len=8 '\b') at utp.cpp:1575
1575                            resends[nr++] = v;


Thread 3 (Thread 0x7ffff39ed700 (LWP 18012)):
#0  0x00007ffff67f73e3 in select () from /lib/libc.so.6
No symbol table info available.
#1  0x0000000000432dc7 in tr_select (nfds=0, r_fd_set=0x7ffff39ecd50, w_fd_set=0x7ffff39eccd0, 
    c_fd_set=0x7ffff39ecc50, t=0x7ffff39ecdf0) at web.c:307
No locals.
#2  0x000000000043320a in tr_webThreadFunc (vsession=0x6ae5c0) at web.c:397
        usec = 1000000
        r_fd_set = {__fds_bits = {0 <repeats 16 times>}}
        max_fd = -1
        t = {tv_sec = 0, tv_usec = 229697}
        w_fd_set = {__fds_bits = {0 <repeats 16 times>}}
        c_fd_set = {__fds_bits = {0 <repeats 16 times>}}
        msec = 1000
        unused = 0
        msg = 0x0
        mcode = CURLM_OK
        multi = 0x6c71c0
        web = 0x6c7100
        taskCount = 0
        task = 0x79f760
        session = 0x6ae5c0
#3  0x0000000000415f61 in ThreadFunc (_t=0x6afd10) at platform.c:118
        t = 0x6afd10
#4  0x00007ffff6a968ca in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#5  0x00007ffff67fdb6d in clone () from /lib/libc.so.6
No symbol table info available.
#6  0x0000000000000000 in ?? ()
No symbol table info available.

Thread 2 (Thread 0x7ffff41ee700 (LWP 18011)):
#0  0x000000000047b1e7 in UTPSocket::selective_ack (this=0x1432610, base=9431, 
    mask=0x7ffff41ecd76 "", len=8 '\b') at utp.cpp:1575
        v = 9486
        bit_set = false
        pkt = 0x959e20
        bits = 55
        count = 9488
        nr = 9488
        __PRETTY_FUNCTION__ = "void UTPSocket::selective_ack(uint, const byte*, byte)"
        i = 100000
        resends = {9466, 9465, 9464, 9463, 9462, 9461, 9460, 9459, 9458, 9457, 9456, 9455, 9454, 
          9453, 9452, 9451, 9450, 9449, 9448, 9447, 9446, 9445, 9444, 9443, 9442, 9441, 9440, 
          9439, 9438, 9437, 9436, 9435}
        back_off = false
#1  0x000000000047c4ef in UTP_ProcessIncoming (conn=0x1432610, 
    packet=0x7ffff41ecd60 "!\001!{\343>`\265z]%\242", len=30, syn=false) at utp.cpp:2099
        packet_end = 0x7ffff41ecd7e "6\361 }"
        __PRETTY_FUNCTION__ = "size_t UTP_ProcessIncoming(UTPSocket*, const byte*, size_t, bool)"
        min_rtt = 130506
        prev_delay_base = 2052924856
        pk_ack_nr = 9429
        time = 17104319494362
        their_delay = 2242172965
        pf = 0x7ffff41ecd60
        pf1 = 0x7ffff41ecd60
        selack_ptr = 0x7ffff41ecd76 ""
        data = 0x7ffff41ecd7e "6\361 }"
        extension = 0
        seqnr = 0
        acks = 0
        actual_delay = 2052924834
        pk_seq_nr = 52838
        pk_flags = 2 '\002'
        acked_bytes = 1382
        p = 3812516021
#2  0x000000000047d915 in UTP_IsIncomingUTP (incoming_proc=0x42cad4 <incoming>, 
    send_to_proc=0x42cbfc <tr_utpSendTo>, send_to_userdata=0x6ae5c0, 
    buffer=0x7ffff41ecd60 "!\001!{\343>`\265z]%\242", len=30, to=0x7ffff41ecce0, tolen=16)
    at utp.cpp:2580
        read = 1400
        conn = 0x1432610
        i = 7
        pf = 0x7ffff41ecd60
        pf1 = 0x7ffff41ecd60
        flags = 2 '\002'
        seq_nr = 0
        addr = {_in = {
            _in6 = "\000\000\000\000\000\000\000\000\000\000\377\377l\355\304", <incomplete sequence \351>, _in6w = {0, 0, 0, 0, 0, 65535, 60780, 59844}, _in6d = {0, 0, 4294901760, 3921997164}, 
            _in6addr = {__in6_u = {
                __u6_addr8 = "\000\000\000\000\000\000\000\000\000\000\377\377l\355\304", <incomplete sequence \351>, __u6_addr16 = {0, 0, 0, 0, 0, 65535, 60780, 59844}, __u6_addr32 = {0, 0, 
                  4294901760, 3921997164}}}}, _port = 21992}
        p = 0x7ffff41ecd60
        p1 = 0x7ffff41ecd60
        version = 1 '\001'
        id = 8571
#3  0x000000000042ce07 in tr_utpPacket (buf=0x7ffff41ecd60 "!\001!{\343>`\265z]%\242", buflen=30, 
    from=0x7ffff41ecce0, fromlen=16, ss=0x6ae5c0) at tr-utp.c:179
No locals.
#4  0x000000000042c5cd in event_callback (s=16, type=2, sv=0x6ae5c0) at tr-udp.c:225
        rc = 30
        fromlen = 16
        buf = "!\001!{\343>`\265z]%\242\000\002\000\000\316f$\325\000\b\000\000\000\000p\000\000\000\066\361 }\000\213op6\244\344\343\305\303\302\215k#\r\273\227\t\204\067|\205\065\206\000?zZ\236\221\")\273\215\347\310V\257f\377Q\312\340\017\261\004\337\004r\022\373\211\276\205\231\001$xzM,\031\224\\\275i\305\337\356@\255\t\263\r&\240\316\063f\326\065\267\003\372\016XfR\301\063\f\265;&\242\212\333:\345\255}\246c\tZ\314\360\327Z}\326\355\316\066\373Y\265%\276\221?\037\303Q\352\r\243\035\352\224\026?\237=\354\345P\365W\243\340\375\236\231U\202+,\254\373\364\376B\375\337\375I\345\253\360\261j\376\356\226\027\030\005dy\267\212\021h0\274\222\242\201{IQvI\362,{\203P\f\323?\357`\255S\330\366w\252\001g3\332\000{j?x\016\272H)\226\343\342\002\061\314\374y\274S\265\237\017\311wx\206)\362\211\260RX\030[\211\363\263\330\311.\263\334\341\332\327\267\024\200E%\372!?\246\242/!iQ\031?\247{\300\020\332\310z\363 Yh?[ÁSG:q\336\034\364\343f]\347\000&]nO\332GYX\322\070\021\321-\261\200\315\322\330rA\222\323/'\353\275\327\320-\362d\331[\031b\034"...
        from = {ss_family = 2, __ss_align = 0, 
          __ss_padding = "@\276\250\366\377\177\000\000 \000\000\000\000\000\000\000@\276\250\366\377\177\000\000\020\000\000\000\000\000\000\000\250\210\307\000\000\000\000\000H\276\250\366\377\177\000\000\200\211\307\000\000\000\000\000pLz\366\377\177\000\000\243B(\367\377\177\000\000\020\000\000\000\000\000\000\000@\276\250\366\377\177\000\000\020\000\000\000\000\000\000\000\340\305!\001\000\000\000\000\200\033\355\000\000\000\000"}
        ss = 0x6ae5c0
        __PRETTY_FUNCTION__ = "event_callback"
#5  0x00007ffff79ac799 in event_base_loop () from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#6  0x000000000042dac2 in libeventThreadFunc (veh=0x6aeb90) at trevent.c:248
        base = 0x6aed60
        eh = 0x6aeb90
#7  0x0000000000415f61 in ThreadFunc (_t=0x6aec10) at platform.c:118
        t = 0x6aec10
#8  0x00007ffff6a968ca in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#9  0x00007ffff67fdb6d in clone () from /lib/libc.so.6
No symbol table info available.
#10 0x0000000000000000 in ?? ()
No symbol table info available.

Thread 1 (Thread 0x7ffff7fe1720 (LWP 18008)):
#0  0x00007ffff6a9e86d in nanosleep () from /lib/libpthread.so.0
No symbol table info available.
#1  0x000000000042f8d3 in tr_wait_msec (msec=1000) at utils.c:862
        ts = {tv_sec = 1, tv_nsec = 0}
#2  0x0000000000407609 in main (argc=2, argv=0x7fffffffe758) at daemon.c:577
        c = 0
        optarg = 0x0
        settings = {val = {b = 176 '\260', d = 3.4592105006704045e-317, i = 7001520, s = {
              len = 7001520, str = {
                buf = "\200\000\000\000\000\000\000\000\200\000\000\000\000\000\000", 
                ptr = 0x80 <Address 0x80 out of bounds>}}, l = {vals = 0x6ad5b0, alloc = 128, 
              count = 128}}, type = 8 '\b'}
        boolVal = false
        loaded = true
        foreground = true
        dumpSettings = false
        configDir = 0x6ac0f0 "/home/exz/.config/transmission-daemon"
        pid_filename = 0x6adc98 "ciao.pid"
        watchdir = 0x0
        pidfile_created = true
        session = 0x6ae5c0
#0  0x000000000047b1e7 in UTPSocket::selective_ack (this=0x1432610, base=9431, 
    mask=0x7ffff41ecd76 "", len=8 '\b') at utp.cpp:1575
#1  0x000000000047c4ef in UTP_ProcessIncoming (conn=0x1432610, 
    packet=0x7ffff41ecd60 "!\001!{\343>`\265z]%\242", len=30, syn=false) at utp.cpp:2099
#2  0x000000000047d915 in UTP_IsIncomingUTP (incoming_proc=0x42cad4 <incoming>, 
    send_to_proc=0x42cbfc <tr_utpSendTo>, send_to_userdata=0x6ae5c0, 
    buffer=0x7ffff41ecd60 "!\001!{\343>`\265z]%\242", len=30, to=0x7ffff41ecce0, tolen=16)
    at utp.cpp:2580
#3  0x000000000042ce07 in tr_utpPacket (buf=0x7ffff41ecd60 "!\001!{\343>`\265z]%\242", buflen=30, 
    from=0x7ffff41ecce0, fromlen=16, ss=0x6ae5c0) at tr-utp.c:179
#4  0x000000000042c5cd in event_callback (s=16, type=2, sv=0x6ae5c0) at tr-udp.c:225
#5  0x00007ffff79ac799 in event_base_loop () from /usr/local/lib/libevent-2.0.so.5
#6  0x000000000042dac2 in libeventThreadFunc (veh=0x6aeb90) at trevent.c:248
#7  0x0000000000415f61 in ThreadFunc (_t=0x6aec10) at platform.c:118
#8  0x00007ffff6a968ca in start_thread () from /lib/libpthread.so.0
#9  0x00007ffff67fdb6d in clone () from /lib/libc.so.6
#10 0x0000000000000000 in ?? ()

comment:21 Changed 8 years ago by cfpp2p

Should i open a new ticket or post somewhere else about the second bug?

This is the same bug as: https://trac.transmissionbt.com/ticket/5002#comment:14

too bad #5128 doesn't fix this...

comment:22 Changed 8 years ago by rsd

Back in topic, i got the SIGPIPE error again on 13622.

Each time i debug with handle SIGPIPE nostop noprint nopass transmission doesn't crash, except for the utp handling problem, are they related?

This time i forgot to run "handle SIGPIPE etc." and i got the error. I guess this is no help, but if you need it here is the backtrace:

Program received signal SIGPIPE, Broken pipe.
[Switching to Thread 0x7ffff41ee700 (LWP 12919)]
0x00007ffff67f6a57 in writev () from /lib/libc.so.6

#0  0x00007ffff67f6a57 in writev () from /lib/libc.so.6
No symbol table info available.
#1  0x00007ffff79b064a in ?? () from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#2  0x00007ffff79b1108 in evbuffer_write_atmost () from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#3  0x00000000004131b7 in tr_evbuffer_write (io=0x8a79e0, fd=29, howmuch=2534) at peer-io.c:317
        e = 4442409
        n = 0
        errstr = "\000\000\000\000\000\000\000\000\260\347j\000\000\000\000\000\235\257\267P\000\000\000\000\200\312\177\000\000\000\000\000\300\330\036\364\377\177\000\000\200\312\177\000\000\000\000\000\340\330\036\364\377\177\000\000\000\000\000\000\000\000\000\000\020\331\036\364\377\177\000\000\363\310C", '\000' <repeats 13 times>"\346, \t", '\000' <repeats 15 times>"\224, o\000\000\000\000\000\340Am\000\000\000\000\000\200\312\177\000\000\000\000\000\200\312\177\000\000\000\000\000\235\257\267P\000\000\000\000@\331\036\364\377\177\000\000\000\000\000\000\000\000\000\000p\331\036\364\377\177\000\000\363\310C\000\000\000\000\000\340Am\000\000\000\000\000\346\t", '\000' <repeats 14 times>, "hz\212\000\000\000\000\000\220\331\036\364\377\177\000\000!,A\000\000\000\000\000p\331\036\364\000\000\000\000\220Am", '\000' <repeats 14 times>"\335, \036\364\377\177\000"
#4  0x0000000000415c2f in tr_peerIoTryWrite (io=0x8a79e0, howmuch=2534) at peer-io.c:1286
        e = -199304208
        n = 0
        old_len = 2534
#5  0x0000000000415df9 in tr_peerIoFlush (io=0x8a79e0, dir=TR_CLIENT_TO_PEER, limit=3000)
    at peer-io.c:1320
        bytesUsed = 0
        __PRETTY_FUNCTION__ = "tr_peerIoFlush"
#6  0x000000000043c319 in phaseOne (peerArray=0x7ffff41edcd0, dir=TR_CLIENT_TO_PEER)
    at bandwidth.c:219
        i = 3
        increment = 3000
        bytesUsed = 3000
        n = 6
        peerCount = 6
        peers = 0x6fbd70
#7  0x000000000043c528 in tr_bandwidthAllocate (b=0x6ae7b0, dir=TR_CLIENT_TO_PEER, period_msec=500)
    at bandwidth.c:271
        i = 6
        peerCount = 6
        tmp = {items = 0x6fc410, n_items = 6, n_alloc = 32}
        low = {items = 0x71b060, n_items = 6, n_alloc = 32}
        high = {items = 0x0, n_items = 0, n_alloc = 0}
        normal = {items = 0x6fbd70, n_items = 6, n_alloc = 32}
        peers = 0x6fc410
#8  0x000000000044d2dd in bandwidthPulse (foo=-1, bar=1, vmgr=0x6af760) at peer-mgr.c:3611
        tor = 0x6aed60
        mgr = 0x6af760
        session = 0x6ae5c0
#9  0x00007ffff79ac799 in event_base_loop () from /usr/local/lib/libevent-2.0.so.5
No symbol table info available.
#10 0x000000000042dac2 in libeventThreadFunc (veh=0x6aeb90) at trevent.c:248
        base = 0x6aed60
        eh = 0x6aeb90
#11 0x0000000000415f61 in ThreadFunc (_t=0x6aec10) at platform.c:118
        t = 0x6aec10
#12 0x00007ffff6a968ca in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#13 0x00007ffff67fdb6d in clone () from /lib/libc.so.6
No symbol table info available.
#14 0x0000000000000000 in ?? ()
No symbol table info available.
A debugging session is active.

comment:23 Changed 8 years ago by livings124

cfpp2p: should this be closed as a duplicate of #5002?

comment:24 Changed 8 years ago by cfpp2p

  • Resolution set to duplicate
  • Status changed from reopened to closed

should this be closed as a duplicate of #5002?

yes

Note: See TracTickets for help on using tickets.