transmission 4.1.0-dev ce66e5c442 regular crashed after memory leak

[eugenepiskunov]

Debian 12
$ uname -a
Linux primus 6.1.0-9-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.27-1 (2023-05-08) x86_64 GNU/Linux

2023-07-01T23:48:19.925222+10:00 primus transmission-daemon[63678]: what(): std::bad_alloc
2023-07-01T23:48:20.029382+10:00 primus systemd[1]: transmission.service: Main process exited, code=killed, status=6/ABRT
2023-07-01T23:48:20.045649+10:00 primus systemd[1]: transmission.service: Failed with result 'signal'.
2023-07-01T23:48:20.046953+10:00 primus systemd[1]: transmission.service: Consumed 7min 30.056s CPU time.
2023-07-01T23:52:20.181139+10:00 primus systemd[1]: transmission.service: Scheduled restart job, restart counter is at 17.
2023-07-01T23:52:20.186658+10:00 primus systemd[1]: Stopped transmission.service - Transmission BitTorrent Daemon.

[ckerr]

@eugenepiskunov I'm happy to try and fix this if we can figure it out, but there's no information there about what caused the crash.

Since you seem to be building from the git repo, could you try making a Debug build, run it in a debugger, and try to get a backtrace from the crash?

[eugenepiskunov]

Hi, @ckerr !
I compiled a binary with debug.
cmake -DCMAKE_CXX_FLAGS="-gdwarf-4 -fno-omit-frame-pointer" -DCMAKE_C_FLAGS="-gdwarf-4 -fno-omit-frame-pointer" -DCMAKE_BUILD_TYPE=Debug ..
Can you tell me how I can run it in a debugger?

[ckerr]

$ gdb ./build/daemon/transmission-daemon
$ handle sigpipe nostop noprint pass
$ r -f
... run until crash
$ thread apply all bt

[eugenepiskunov]

[New Thread 0x7fffcbff76c0 (LWP 3824)]
[Thread 0x7fffcbff76c0 (LWP 3824) exited]
terminate called after throwing an instance of 'std::bad_alloc'
  what():  std::bad_alloc

Thread 2 "transmission-da" received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff65ff6c0 (LWP 1987)]
__pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
44	./nptl/pthread_kill.c: No such file or directory.
(gdb) thread apply all bt

Thread 3 (Thread 0x7ffff5dfe6c0 (LWP 1988) "transmission-da"):
#0  0x00007ffff74ee345 in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=0x7ffff5df76a0, rem=0x7ffff5df76a0) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:48
#1  0x00007ffff74f2c53 in __GI___nanosleep (req=<optimized out>, rem=<optimized out>) at ../sysdeps/unix/sysv/linux/nanosleep.c:25
#2  0x00005555556620c3 in std::this_thread::sleep_for<long, std::ratio<1l, 1000l> > (__rtime=...) at /usr/include/c++/12/bits/this_thread_sleep.h:80
#3  0x00005555556752cb in tr_web::Impl::curlThreadFunc (this=0x5555559d9b10) at /root/transmission/Transmission/libtransmission/web.cc:708
#4  0x000055555567a8d8 in std::__invoke_impl<void, void (tr_web::Impl::*)(), tr_web::Impl*> (__f=@0x5555559df120: (void (tr_web::Impl::*)(tr_web::Impl * const)) 0x555555674fa6 <tr_web::Impl::curlThreadFunc()>, __t=@0x5555559df118: 0x5555559d9b10) at /usr/include/c++/12/bits/invoke.h:74
#5  0x000055555567a837 in std::__invoke<void (tr_web::Impl::*)(), tr_web::Impl*> (__fn=@0x5555559df120: (void (tr_web::Impl::*)(tr_web::Impl * const)) 0x555555674fa6 <tr_web::Impl::curlThreadFunc()>) at /usr/include/c++/12/bits/invoke.h:96
#6  0x000055555567a7a7 in std::thread::_Invoker<std::tuple<void (tr_web::Impl::*)(), tr_web::Impl*> >::_M_invoke<0ul, 1ul> (this=0x5555559df118) at /usr/include/c++/12/bits/std_thread.h:252
#7  0x000055555567a760 in std::thread::_Invoker<std::tuple<void (tr_web::Impl::*)(), tr_web::Impl*> >::operator() (this=0x5555559df118) at /usr/include/c++/12/bits/std_thread.h:259
#8  0x000055555567a744 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (tr_web::Impl::*)(), tr_web::Impl*> > >::_M_run (this=0x5555559df110) at /usr/include/c++/12/bits/std_thread.h:210
#9  0x00007ffff76d44a3 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#10 0x00007ffff74a7fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#11 0x00007ffff75285bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thread 2 (Thread 0x7ffff65ff6c0 (LWP 1987) "transmission-da"):
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
#1  0x00007ffff74a9d2f in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  0x00007ffff745aef2 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007ffff7445472 in __GI_abort () at ./stdlib/abort.c:79
#4  0x00007ffff769d919 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#5  0x00007ffff76a8e1a in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#6  0x00007ffff76a8e85 in std::terminate() () from /lib/x86_64-linux-gnu/libstdc++.so.6
#7  0x00007ffff76a90d8 in __cxa_throw () from /lib/x86_64-linux-gnu/libstdc++.so.6
#8  0x00007ffff769d524 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#9  0x000055555565113d in std::__new_allocator<std::byte>::allocate (this=0x7ffff65ed8ef, __n=3358769152) at /usr/include/c++/12/bits/new_allocator.h:137
#10 0x000055555564fd63 in std::allocator_traits<std::allocator<std::byte> >::allocate (__a=..., __n=3358769152) at /usr/include/c++/12/bits/alloc_traits.h:464
#11 0x00005555556dfc6d in small::vector<std::byte, 16400ul, std::allocator<std::byte>, std::integral_constant<bool, true>, unsigned long, std::ratio<5l, 1l> >::make_size_internal<std::integral_constant<bool, false>, small::vector<std::byte, 16400ul, std::allocator<std::byte>, std::integral_constant<bool, true>, unsigned long, std::ratio<5l, 1l> >::make_size(unsigned long)::{lambda(void*)#1}>(unsigned long, small::vector<std::byte, 16400ul, std::allocator<std::byte>, std::integral_constant<bool, true>, unsigned long, std::ratio<5l, 1l> >::make_size(unsigned long)::{lambda(void*)#1}&&, unsigned long) (this=0x7ffff124e078, new_size=1679397137, emplace_func=..., new_emplaced_size=0) at /root/transmission/Transmission/third-party/small/include/small/vector.hpp:1310
#12 0x00005555556df498 in small::vector<std::byte, 16400ul, std::allocator<std::byte>, std::integral_constant<bool, true>, unsigned long, std::ratio<5l, 1l> >::make_size (this=0x7ffff124e078, new_size=1679397137) at /root/transmission/Transmission/third-party/small/include/small/vector.hpp:1266
#13 0x00005555556deb88 in small::vector<std::byte, 16400ul, std::allocator<std::byte>, std::integral_constant<bool, true>, unsigned long, std::ratio<5l, 1l> >::resize (this=0x7ff--Type <RET> for more, q to quit, c to continue without paging--
ff124e078, n=1679397137) at /root/transmission/Transmission/third-party/small/include/small/vector.hpp:1120
#14 0x00005555556de435 in libtransmission::StackBuffer<16400ul, std::byte, std::ratio<5l, 1l> >::reserve_space (this=0x7ffff124e068, n_bytes=16397) at /root/transmission/Transmission/libtransmission/../libtransmission/tr-buffer.h:267
#15 0x00005555557218dd in tr_peerIo::write_bytes (this=0x7ffff1249ac0, bytes=0x7ffff65edaf0, n_bytes=16397, is_piece_data=true) at /root/transmission/Transmission/libtransmission/../libtransmission/peer-io.h:138
#16 0x0000555555722a23 in tr_peerIo::write<std::byte> (this=0x7ffff1249ac0, buf=warning: RTTI symbol not found for class 'libtransmission::StackBuffer<16400ul, std::byte, std::ratio<5l, 1l> >'
..., is_piece_data=true) at /root/transmission/Transmission/libtransmission/../libtransmission/peer-io.h:149
#17 0x000055555571be90 in (anonymous namespace)::protocol_send_message<unsigned int, unsigned int, std::basic_string_view<char, std::char_traits<char> > > (msgs=0x7ffff0eb0b10, type=7 '\a') at /root/transmission/Transmission/libtransmission/peer-msgs.cc:836
#18 0x00005555557198ae in (anonymous namespace)::peer_pulse_helpers::add_next_piece (msgs=0x7ffff0eb0b10, now=1688600295) at /root/transmission/Transmission/libtransmission/peer-msgs.cc:1943
#19 0x0000555555719973 in (anonymous namespace)::peer_pulse_helpers::fill_output_buffer (msgs=0x7ffff0eb0b10, now=1688600295) at /root/transmission/Transmission/libtransmission/peer-msgs.cc:1973
#20 0x0000555555719a24 in (anonymous namespace)::peerPulse (vmsgs=0x7ffff0eb0b10) at /root/transmission/Transmission/libtransmission/peer-msgs.cc:2002
#21 0x0000555555718585 in (anonymous namespace)::didWrite (bytes_written=1382, was_piece_data=true, vmsgs=0x7ffff0eb0b10) at /root/transmission/Transmission/libtransmission/peer-msgs.cc:1718
#22 0x00005555556db21b in tr_peerIo::did_write_wrapper (this=0x7ffff1249ac0, bytes_transferred=1382) at /root/transmission/Transmission/libtransmission/peer-io.cc:265
#23 0x00005555556db5f2 in tr_peerIo::try_write (this=0x7ffff1249ac0, max=7915499) at /root/transmission/Transmission/libtransmission/peer-io.cc:314
#24 0x00005555556dcda4 in tr_peerIo::on_utp_state_change (this=0x7ffff1249ac0, state=2) at /root/transmission/Transmission/libtransmission/peer-io.cc:622
#25 0x00005555556dd780 in operator() (__closure=0x0, args=0x7ffff65f60b0) at /root/transmission/Transmission/libtransmission/peer-io.cc:747
#26 0x00005555556dd7a4 in _FUN () at /root/transmission/Transmission/libtransmission/peer-io.cc:750
#27 0x0000555555808c2a in utp_call_on_state_change (ctx=0x7ffff000b4a0, socket=0x7ffff0e58da0, state=2) at /root/transmission/Transmission/third-party/libutp/utp_callbacks.cpp:116
#28 0x0000555555804154 in utp_process_incoming (conn=0x7ffff0e58da0, packet=0x7ffff65f6490 "!", len=20, syn=false) at /root/transmission/Transmission/third-party/libutp/utp_internal.cpp:2313
#29 0x0000555555805b19 in utp_process_udp (ctx=0x7ffff000b4a0, buffer=0x7ffff65f6490 "!", len=20, to=0x7ffff65f6410, tolen=16) at /root/transmission/Transmission/third-party/libutp/utp_internal.cpp:2915
#30 0x000055555563a466 in tr_utpPacket (buf=0x7ffff65f6490 "!", buflen=20, from=0x7ffff65f6410, fromlen=16, ss=0x5555559e41f0) at /root/transmission/Transmission/libtransmission/tr-utp.cc:216
#31 0x0000555555638580 in (anonymous namespace)::event_callback (s=13, type=2, vsession=0x5555559e41f0) at /root/transmission/Transmission/libtransmission/tr-udp.cc:129
#32 0x00005555557adbff in event_persist_closure (base=0x5555559e09c0, ev=0x7ffff00072e0) at /root/transmission/Transmission/third-party/libevent/event.c:1623
#33 0x00005555557adef1 in event_process_active_single_queue (base=0x5555559e09c0, activeq=0x5555559e0e10, max_to_process=2147483647, endtime=0x0) at /root/transmission/Transmission/third-party/libevent/event.c:1682
#34 0x00005555557ae488 in event_process_active (base=0x5555559e09c0) at /root/transmission/Transmission/third-party/libevent/event.c:1783
#35 0x00005555557aebb8 in event_base_loop (base=0x5555559e09c0, flags=4) at /root/transmission/Transmission/third-party/libevent/event.c:2006
#36 0x000055555574ac0e in tr_session_thread_impl::sessionThreadFunc (this=0x5555559e08b0, evbase=0x5555559e09c0) at /root/transmission/Transmission/libtransmission/session-thread.cc:245
#37 0x000055555574cd82 in std::__invoke_impl<void, void (tr_session_thread_impl::*)(event_base*), tr_session_thread_impl*, event_base*> (__f=@0x5555559de1f8: (void (tr_session_thread_impl::*)(tr_session_thread_impl * const, event_base *)) 0x55555574ab28 <tr_session_thread_impl::sessionThreadFunc(event_base*)>, __t=@0x5555559de1f0: 0x5555559e08b0) at /usr/include/c++/12/bits/invoke.h:74
--Type <RET> for more, q to quit, c to continue without paging--
#38 0x000055555574ccaa in std::__invoke<void (tr_session_thread_impl::*)(event_base*), tr_session_thread_impl*, event_base*> (__fn=@0x5555559de1f8: (void (tr_session_thread_impl::*)(tr_session_thread_impl * const, event_base *)) 0x55555574ab28 <tr_session_thread_impl::sessionThreadFunc(event_base*)>) at /usr/include/c++/12/bits/invoke.h:96
#39 0x000055555574cbdd in std::thread::_Invoker<std::tuple<void (tr_session_thread_impl::*)(event_base*), tr_session_thread_impl*, event_base*> >::_M_invoke<0ul, 1ul, 2ul> (this=0x5555559de1e8) at /usr/include/c++/12/bits/std_thread.h:252
#40 0x000055555574cb7a in std::thread::_Invoker<std::tuple<void (tr_session_thread_impl::*)(event_base*), tr_session_thread_impl*, event_base*> >::operator() (this=0x5555559de1e8) at /usr/include/c++/12/bits/std_thread.h:259
#41 0x000055555574cb5e in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (tr_session_thread_impl::*)(event_base*), tr_session_thread_impl*, event_base*> > >::_M_run (this=0x5555559de1e0) at /usr/include/c++/12/bits/std_thread.h:210
#42 0x00007ffff76d44a3 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#43 0x00007ffff74a7fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#44 0x00007ffff75285bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thread 1 (Thread 0x7ffff6aa0d80 (LWP 1982) "transmission-da"):
#0  0x00007ffff7527c06 in epoll_wait (epfd=3, events=0x5555559e0530, maxevents=32, timeout=997) at ../sysdeps/unix/sysv/linux/epoll_wait.c:30
#1  0x00005555557bf9a6 in epoll_dispatch (base=0x5555559e0270, tv=0x7fffffffda00) at /root/transmission/Transmission/third-party/libevent/epoll.c:465
#2  0x00005555557aeb49 in event_base_loop (base=0x5555559e0270, flags=0) at /root/transmission/Transmission/third-party/libevent/event.c:1992
#3  0x00005555557ae510 in event_base_dispatch (event_base=0x5555559e0270) at /root/transmission/Transmission/third-party/libevent/event.c:1817
#4  0x0000555555583216 in tr_daemon::start (this=0x7fffffffe2f0, foreground=true) at /root/transmission/Transmission/daemon/daemon.cc:830
#5  0x00005555555aaccc in tr_daemon::spawn (this=0x7fffffffe2f0, foreground=true, exit_code=0x7fffffffe38c, error=0x7fffffffe2e0) at /root/transmission/Transmission/daemon/daemon-posix.cc:184
#6  0x0000555555583bf4 in main (argc=5, argv=0x7fffffffe4b8) at /root/transmission/Transmission/daemon/daemon.cc:947
(gdb)

[eugenepiskunov]

Hi, @ckerr
transmission crashing only if started under transmission user, under root its ok

[ckerr]

@eugenepiskunov thanks for the backtrace!

I've moved this to the bug tracker @ #5735, so I'm closing this discussion thread.