Package: transmission-daemon Version: 2.92-2 Severity: normal Dear Maintainer,
1. These segfaults have happened 11 times on my system since Feb 26; the
/var/log/syslog* have been rotated so that I can not check whether
segfault has happened before Feb 26. These segfaults happened randomly.
I have collected 6 cores of segfaults. Next description will use
core.4 as example.
2. transmission-daemon started on 2017-03-11 09:29:27 using:
$ ulimit -c unlimited
$ > ~/tmp/transmission.log ; transmission-daemon --logfile
~/tmp/transmission.log --log-debug
Message in syslog related to core.4(the segfault on 08:11:32 have
no core file saved):
$ zgrep segfault /var/log/syslog.1
Mar 11 08:11:32 archon kernel: [ 408.155176] transmission-da[2572]:
segfault at 0 ip 00007f2850fe4a0c sp 00007f284bfaeaf8 error 4 in
libc-2.24.so[7f2850e9c000+195000]
Mar 11 09:34:01 archon kernel: [ 5356.546761] transmission-da[14443]:
segfault at 0 ip 00007f6df7849a0c sp 00007f6df2813af8 error 4 in
libc-2.24.so[7f6df7701000+195000]
The attachment is the gdb backtrace generated with following command:
$ gdb --batch -ex "bt" -ex "bt full" -ex "thread apply all bt full"
-ex "quit" transmission-daemon core.4 &> core.4.backtrace-log
3. Here are some investigation by myself.
The request 0x7f6decb08fc0 used by scrape_request_delegate():
(gdb) p *((const tr_scrape_request *) 0x7f6decb08fc0)
$1 = {url = 0x0,
log_name = "[FILENAME_OF_TORRENT_REMOVED---http://354.354.354.354:75535]";,
'\000' <repeats 56 times>, info_hash = {
"{INFO_HASH_REMOVED_1",
"INFO_HASH_REMOVED_2",
"INFO_HASH_REMOVED_3",
'\000' <repeats 19 times> <repeats 61 times>}, info_hash_count = 3}
Note that some text is changed due to private reason.
Obviously, segfault happens because of request->url is NULL(0x0)
and is compared with "http"
using memcmp()(announcer.c:1402).
The request 0x7f6decb08fc0 is the 2nd element of local variable
requests(0x7f6decb08a30) of function multiscrape():
(gdb) p &((const tr_scrape_request *) 0x7f6decb08a30)[1]
$4 = (const tr_scrape_request *) 0x7f6decb08fc0
The request 0x7f6decb08fc0 is likely build from tr_tier
(tr_ptrArray *) 0x7f6df2813b60)->items[1] as the hash, name and
tracker are matched:
(gdb) p (((tr_tier *) ((tr_ptrArray *)
0x7f6df2813b60)->items[1])->tor->info->hash)
$11 = "{INFO_HASH_REMOVED_1"
(gdb) p (((tr_tier *) ((tr_ptrArray *)
0x7f6df2813b60)->items[1])->tor->info->name)
$13 = 0x7f6dec3fb110 "FILENAME_OF_TORRENT_REMOVED"
(gdb) p *(((tr_tier *) ((tr_ptrArray *)
0x7f6df2813b60)->items[1])->currentTracker)
$14 = {key = 0x7f6dec4f5ba0 "http://354.354.354.354:75535";,
announce = 0x7f6dec4f5ae0 "http://354.354.354.354:75535/annonuce";,
scrape = 0x0, tracker_id_str = 0x0, seederCount = -1, leecherCount = -1,
downloadCount = -1, downloaderCount = 0, consecutiveFailures = 0, id = 59}
The torrent of this tr_tier:
(gdb) p *(((tr_tier *) ((tr_ptrArray *) 0x7f6df2813b60)->items[1])->tor)
$15 = {session = 0x560e62f8a920, info = {totalSize = 176553400,
originalName = 0x7f6dec3fb150 "FILENAME_OF_TORRENT_REMOVED",
name = 0x7f6dec3fb110 "FILENAME_OF_TORRENT_REMOVED",
torrent = 0x7f6dec46f990
"/home/kralcyor/.config/transmission-daemon/torrents/FILENAME_OF_TORRENT_REMOVED.7b8d920ba22ab7a5.torrent",
webseeds = 0x0, comment = 0x7f6dec32f450 "",
creator = 0x7f6dec3fb190 "rin-pr/0.5.1", files = 0x7f6dec2b2700,
pieces = 0x7f6dec468c90, trackers = 0x7f6dec46e0e0,
dateCreated = 1485837788, trackerCount = 68, webseedCount = 0,
fileCount = 1, pieceSize = 262144, pieceCount = 674,
hash = "{INFO_HASH_REMOVED_1",
hashString = "HASH_STRING_REMOVED_1",
isPrivate = false, isFolder = false}, magicNumber = 95549,
error = TR_STAT_OK, errorString = '\000' <repeats 127 times>,
errorTracker = '\000' <repeats 127 times>,
obfuscatedHash = "OBFUSCATED_HASH_REMOVED_1",
incompleteMetadata = 0x0, peer_id = "-TR2920-k0igydl6wtr0",
peer_id_creation_time = 1489195834,
downloadDir = 0x7f6dec45df80 "DOWNLOAD_DIR_REMOVED",
incompleteDir = 0x0, infoDictLength = 13587, infoDictOffset = 0,
currentDir = 0x7f6dec45df80 "DOWNLOAD_DIR_REMOVED",
blockSize = 16384, blockCount = 10776, lastBlockSize = 15800,
lastPieceSize = 130488, blockCountInPiece = 16, blockCountInLastPiece = 8,
completion = {tor = 0x7f6dec46fa10, blockBitfield = {bits = 0x0,
alloc_count = 0, bit_count = 10776, true_count = 10776,
have_all_hint = true, have_none_hint = false},
sizeWhenDoneLazy = 176553400, sizeWhenDoneIsDirty = true,
haveValidLazy = 0, haveValidIsDirty = true, sizeNow = 176553400},
completeness = TR_SEED, tiers = 0x7f6dec46f490, dhtAnnounceAt = 1489197288,
dhtAnnounce6At = 1489197384, dhtAnnounceInProgress = false,
dhtAnnounce6InProgress = false, lpdAnnounceAt = 1489195767,
downloadedCur = 0, downloadedPrev = 180364824, uploadedCur = 0,
uploadedPrev = 1582164452, corruptCur = 0, corruptPrev = 0,
etaDLSpeedCalculatedAt = 0, etaDLSpeed_Bps = 0, etaULSpeedCalculatedAt = 0,
etaULSpeed_Bps = 0, addedDate = 1485844188, activityDate = 1488957740,
doneDate = 1485844394, startDate = 1489195767, anyDate = 1489195767,
secondsDownloading = 226, secondsSeeding = 401015, queuePosition = 70,
metadata_func = 0x0, metadata_func_user_data = 0x0, completeness_func = 0x0,
completeness_func_user_data = 0x0, ratio_limit_hit_func = 0x0,
ratio_limit_hit_func_user_data = 0x0, idle_limit_hit_func = 0x0,
idle_limit_hit_func_user_data = 0x0, queue_started_user_data = 0x0,
queue_started_callback = 0x0, isRunning = true, isStopping = false,
isDeleting = false, startAfterVerify = false, isDirty = true,
isQueued = false, magnetVerify = false, infoDictOffsetIsCached = false,
maxConnectedPeers = 60, verifyState = TR_VERIFY_NONE, lastStatTime = 0,
stats = {id = 0, activity = TR_STATUS_STOPPED, error = TR_STAT_OK,
errorString = '\000' <repeats 511 times>, recheckProgress = 0,
percentComplete = 0, metadataPercentComplete = 0, percentDone = 0,
seedRatioPercentDone = 0, rawUploadSpeed_KBps = 0,
rawDownloadSpeed_KBps = 0, pieceUploadSpeed_KBps = 0,
pieceDownloadSpeed_KBps = 0, eta = 0, etaIdle = 0, peersConnected = 0,
peersFrom = {0, 0, 0, 0, 0, 0, 0}, peersSendingToUs = 0,
peersGettingFromUs = 0, webseedsSendingToUs = 0, sizeWhenDone = 0,
leftUntilDone = 0, desiredAvailable = 0, corruptEver = 0,
uploadedEver = 0, downloadedEver = 0, haveValid = 0, haveUnchecked = 0,
manualAnnounceTime = 0, ratio = 0, addedDate = 0, doneDate = 0,
startDate = 0, activityDate = 0, idleSecs = 0, secondsDownloading = 0,
secondsSeeding = 0, finished = false, queuePosition = 0,
isStalled = false}, next = 0x7f6dec467b80, uniqueId = 71, bandwidth = {
band = {{isLimited = false, honorParentLimits = true, bytesLeft = 0,
desiredSpeed_Bps = 500000, raw = {newest = 5, transfers = {{date = 0,
size = 0}, {date = 1489195836133, size = 116}, {
date = 1489195836714, size = 105}, {date = 1489195836985,
size = 314}, {date = 1489195838143, size = 98}, {
date = 1489195865149, size = 96}, {date = 0, size = 0}, {
date = 0, size = 0}, {date = 0, size = 0}, {date = 0,
size = 0}}, cache_time = 0, cache_val = 0}, piece = {newest = 0,
transfers = {{date = 0, size = 0}, {date = 0, size = 0}, {date = 0,
size = 0}, {date = 0, size = 0}, {date = 0, size = 0}, {
date = 0, size = 0}, {date = 0, size = 0}, {date = 0, size = 0},
{date = 0, size = 0}, {date = 0, size = 0}}, cache_time = 0,
cache_val = 0}}, {isLimited = false, honorParentLimits = true,
bytesLeft = 0, desiredSpeed_Bps = 50000, raw = {newest = 5,
transfers = {{date = 0, size = 0}, {date = 1489195836133,
size = 417}, {date = 1489195836714, size = 264}, {
date = 1489195837462, size = 96}, {date = 1489195838143,
size = 146}, {date = 1489195865149, size = 96}, {date = 0,
size = 0}, {date = 0, size = 0}, {date = 0, size = 0}, {
date = 0, size = 0}}, cache_time = 0, cache_val = 0}, piece = {
newest = 0, transfers = {{date = 0, size = 0}, {date = 0, size = 0},
{date = 0, size = 0}, {date = 0, size = 0}, {date = 0, size = 0}, {
date = 0, size = 0}, {date = 0, size = 0}, {date = 0, size = 0},
{date = 0, size = 0}, {date = 0, size = 0}}, cache_time = 0,
cache_val = 0}}}, parent = 0x560e62f8ab28, priority = 0 '\000',
magicNumber = 43143, uniqueKey = 71, session = 0x560e62f8a920, children = {
items = 0x7f6deca9c410, n_items = 0, n_alloc = 32}, peer = 0x0},
swarm = 0x7f6dec46f570, desiredRatio = 2,
ratioLimitMode = TR_RATIOLIMIT_GLOBAL, idleLimitMinutes = 30,
idleLimitMode = TR_IDLELIMIT_GLOBAL, finishedSeedingByIdle = false}
This tr_tier is the 52nd tier of its torrent:
(gdb) p &(((tr_tier *) ((tr_ptrArray *)
0x7f6df2813b60)->items[1])->tor)->tiers->tiers[51]
$17 = (tr_tier *) 0x7f6dec4fb590
(gdb) p (tr_tier *) ((tr_ptrArray *) 0x7f6df2813b60)->items[1]
$18 = (tr_tier *) 0x7f6dec4fb590
This tr_tier has two trackers:
(gdb) p *((tr_tier *) ((tr_ptrArray *) 0x7f6df2813b60)->items[1])
$19 = {byteCounts = {0, 0, 0}, trackers = 0x7f6dec45ed40, tracker_count = 2,
currentTracker = 0x7f6dec45ed78, currentTrackerIndex = 1,
tor = 0x7f6dec46fa10, scrapeAt = 1489195810,
lastScrapeStartTime = 1489196040, lastScrapeTime = 0,
lastScrapeSucceeded = false, lastScrapeTimedOut = false,
announceAt = 1489196040, manualAnnounceAllowedAt = 1489196160,
lastAnnounceStartTime = 0, lastAnnounceTime = 1489196040,
lastAnnounceSucceeded = false, lastAnnounceTimedOut = false,
announce_events = 0x7f6dec4614a0, announce_event_count = 1,
announce_event_alloc = 4, key = 708, scrapeIntervalSec = 1800,
announceIntervalSec = 600, announceMinIntervalSec = 120,
lastAnnouncePeerCount = 0, isRunning = false, isAnnouncing = false,
isScraping = true, wasCopied = false,
lastAnnounceStr = "Connection failed", '\000' <repeats 110 times>,
lastScrapeStr = '\000' <repeats 127 times>}
The first tracker is:
(gdb) p ((tr_tier *) ((tr_ptrArray *) 0x7f6df2813b60)->items[1])->trackers[0]
$21 = {key = 0x7f6dec4f5f50 "udp://354.354.354.354:75535",
announce = 0x7f6dec4f5a80 "udp://354.354.354.354:75535/annonuce",
scrape = 0x7f6dec4f5ab0 "udp://354.354.354.354:75535/annonuce",
tracker_id_str = 0x0, seederCount = -1, leecherCount = -1,
downloadCount = -1, downloaderCount = 0, consecutiveFailures = 1, id = 60}
Note that the scrape URL of this tracker is available. The second tracker is:
(gdb) p ((tr_tier *) ((tr_ptrArray *) 0x7f6df2813b60)->items[1])->trackers[1]
$22 = {key = 0x7f6dec4f5ba0 "http://354.354.354.354:75535";,
announce = 0x7f6dec4f5ae0 "http://354.354.354.354:75535/annonuce";,
scrape = 0x0, tracker_id_str = 0x0, seederCount = -1, leecherCount = -1,
downloadCount = -1, downloaderCount = 0, consecutiveFailures = 0, id = 59}
Note that the scrape URL of this tracker is NULL(0x0).
The current tracker is pointed to trackers[1]:
(gdb) p *(((tr_tier *) ((tr_ptrArray *)
0x7f6df2813b60)->items[1])->currentTracker)
$24 = {key = 0x7f6dec4f5ba0 "http://354.354.354.354:75535";,
announce = 0x7f6dec4f5ae0 "http://354.354.354.354:75535/annonuce";,
scrape = 0x0, tracker_id_str = 0x0, seederCount = -1, leecherCount = -1,
downloadCount = -1, downloaderCount = 0, consecutiveFailures = 0, id = 59}
4. 11 segfaults all happened at 0 ip xxxa0c sp xxxaf8 error 4 in
libc-2.24.so[xxx000+195000].
6 core files correspond to 3 different torrents. The tr_tier all
have two trackers; one is udp://, the other is http://. All trackers
are unable to connect.
5. If it is needed, I can provide core files via private email.
And I have a debug logfile logged using
"transmission-daemon --logfile /home/kralcyor/tmp/transmission.log
--log-debug"
for segfault of core.4; though it seems useless. If it is needed, I
can also provide this logfile
via private email.
Regards,
Jun MO
-- System Information:
Debian Release: 9.0
APT prefers unstable-debug
APT policy: (500, 'unstable-debug'), (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.9.0-2-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages transmission-daemon depends on:
ii adduser 3.115
ii init-system-helpers 1.47
ii libc6 2.24-9
ii libcurl3-gnutls 7.52.1-3
ii libevent-2.0-5 2.0.21-stable-3
ii libminiupnpc10 1.9.20140610-2.1
ii libnatpmp1 20110808-4+b1
ii libssl1.1 1.1.0e-1
ii libsystemd0 232-19
ii lsb-base 9.20161125
ii transmission-common 2.92-2
ii zlib1g 1:1.2.8.dfsg-5
Versions of packages transmission-daemon recommends:
ii transmission-cli 2.92-2
transmission-daemon suggests no packages.
-- Configuration Files:
/etc/transmission-daemon/settings.json [Errno 13] Permission denied:
'/etc/transmission-daemon/settings.json'
-- debconf-show failed
core.4.backtrace-log
Description: Binary data
