rsync - Oct 2008 - DO NOT REPLY [Bug 5854] New: --del (+old protocol?) sometimes leads to "double free" crashes

https://bugzilla.samba.org/show_bug.cgi?id=5854

           Summary: --del (+old protocol?) sometimes leads to "double
free"
                    crashes
           Product: rsync
           Version: 3.0.4
          Platform: x64
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: core
        AssignedTo: wayned@samba.org
        ReportedBy: e.a.b.piel@tudelft.nl
         QAContact: rsync-qa@samba.org


It seems to depend on the file list to be synchronised, but sometimes, I get a
detection by glibc of a double free. If I remove "--del" (or
"--delete") from
the arguments, all goes smoothly. For a given file list, it always happens, or
never happens. This is on a x86-64 and the other side is rsync 2.6.9, 32bits.
Trying with a different host having rsync 3.0.3 64bits, it goes fine.

Example:
rsync --archive --recursive --del --files-from=/home/piel/.autosync/lan/list
--exclude-from=/home/piel/.autosync/lan/exclude --cvs-exclude --verbose 
/home/piel/ 'piel@XXXXXX.st.ewi.tudelft.nl:~/backup-dutifh/'
building file list ... done
.bash_history
.mozilla/firefox/673l4j3m.default/
.mozilla/firefox/673l4j3m.default/cookies.sqlite
.mozilla/firefox/673l4j3m.default/formhistory.sqlite
.mozilla/firefox/673l4j3m.default/places.sqlite
*** glibc detected *** rsync: double free or corruption (fasttop): 0x081e3e98
***
======= Backtrace: ========/lib/libc.so.6[0x22c1e0]
/lib/libc.so.6(__libc_free+0x77)[0x22c72b]
rsync[0x804baa1]
rsync[0x804cc92]
rsync[0x804f009]
rsync[0x8058059]
rsync[0x80584bf]
rsync[0x8059374]
/lib/libc.so.6(__libc_start_main+0xdf)[0x1ddd7f]
rsync[0x804ac21]
======= Memory map: =======001aa000-001ab000 r-xp 001aa000 00:00 0         
[vdso]
001ab000-001c5000 r-xp 00000000 03:07 5129514    /lib/ld-2.3.6.so
001c5000-001c6000 r-xp 00019000 03:07 5129514    /lib/ld-2.3.6.so
001c6000-001c7000 rwxp 0001a000 03:07 5129514    /lib/ld-2.3.6.so
001c9000-002ec000 r-xp 00000000 03:07 5129516    /lib/libc-2.3.6.so
002ec000-002ee000 r-xp 00122000 03:07 5129516    /lib/libc-2.3.6.so
002ee000-002f0000 rwxp 00124000 03:07 5129516    /lib/libc-2.3.6.so
002f0000-002f2000 rwxp 002f0000 00:00 0 
00524000-0052d000 r-xp 00000000 03:07 5129560   
/lib/libgcc_s-4.0.2-20051126.so.1
0052d000-0052e000 rwxp 00009000 03:07 5129560   
/lib/libgcc_s-4.0.2-20051126.so.1
00a1f000-00a26000 r-xp 00000000 03:07 3695042    /usr/lib/libpopt.so.0.0.0
00a26000-00a27000 rwxp 00006000 03:07 3695042    /usr/lib/libpopt.so.0.0.0
00b0f000-00b17000 r-xp 00000000 03:07 5129561    /lib/libnss_nis-2.3.6.so
00b17000-00b18000 r-xp 00007000 03:07 5129561    /lib/libnss_nis-2.3.6.so
00b18000-00b19000 rwxp 00008000 03:07 5129561    /lib/libnss_nis-2.3.6.so
00b59000-00b62000 r-xp 00000000 03:07 5129556    /lib/libnss_files-2.3.6.so
00b62000-00b63000 r-xp 00008000 03:07 5129556    /lib/libnss_files-2.3.6.so
00b63000-00b64000 rwxp 00009000 03:07 5129556    /lib/libnss_files-2.3.6.so
00dbd000-00dce000 r-xp 00000000 03:07 5129518    /lib/libnsl-2.3.6.so
00dce000-00dcf000 r-xp 00010000 03:07 5129518    /lib/libnsl-2.3.6.so
00dcf000-00dd0000 rwxp 00011000 03:07 5129518    /lib/libnsl-2.3.6.so
00dd0000-00dd2000 rwxp 00dd0000 00:00 0 
00dd4000-00dd7000 r-xp 00000000 03:07 5129562    /lib/libattr.so.1.1.0
00dd7000-00dd8000 rwxp 00002000 03:07 5129562    /lib/libattr.so.1.1.0
00dda000-00de0000 r-xp 00000000 03:07 5129565    /lib/libacl.so.1.1.0
00de0000-00de1000 rwxp 00005000 03:07 5129565    /lib/libacl.so.1.1.0
08047000-08092000 r-xp 00000000 03:07 3702674    /usr/bin/rsync
08092000-08095000 rw-p 0004a000 03:07 3702674    /usr/bin/rsync
08095000-080a4000 rw-p 08095000 00:00 0 
081de000-081ff000 rw-p 081de000 00:00 0          [heap]
b7c00000-b7c21000 rw-p b7c00000 00:00 0 
b7c21000-b7d00000 ---p b7c21000 00:00 0 
b7d3e000-b7da0000 rw-p b7d3e000 00:00 0 
b7da0000-b7fa0000 r--p 00000000 03:07 3694951    /usr/lib/locale/locale-archive
b7fa0000-b7fa2000 rw-p b7fa0000 00:00 0 
b7fc6000-b7fc7000 rw-p b7fc6000 00:00 0 
bff5b000-bff71000 rw-p bff5b000 00:00 0          [stack]
rsync: writefd_unbuffered failed to write 4092 bytes [sender]: Broken pipe (32)
unexpected tag 107 [sender]
rsync error: unexplained error (code 134) at io.c(1166) [sender=3.0.4]


-- 
Configure bugmail: https://bugzilla.samba.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.

https://bugzilla.samba.org/show_bug.cgi?id=5854


wayned@samba.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED




------- Comment #1 from wayned@samba.org  2008-11-02 00:24 CST -------
What would really help is if you would run an rsync that didn't have its
debug
symbols stripped off so that the backtrace would show details on each function
in the stack.  If you compile rsync yourself, you can try running the version
from the build dir and see if it will crash with a better backtrace.  You might
also try running the non-stripped version under valgrind, which can give even
more info on memory issues.  Also, which rsync is crashing?  The lack of lib64
dirs makes me wonder if it is the 2.6.9 rsync that is crashing.  (I have tried
to duplicate the problem, and have not gotten it to fail.)


-- 
Configure bugmail: https://bugzilla.samba.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.

https://bugzilla.samba.org/show_bug.cgi?id=5854


matt at mattmccutchen.net changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |WORKSFORME




------- Comment #2 from matt at mattmccutchen.net  2010-03-17 02:42 CST -------
Closing due to lack of response.  Eric, please feel free to reopen if you can
provide a useful stack trace.


-- 
Configure bugmail: https://bugzilla.samba.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.

https://bugzilla.samba.org/show_bug.cgi?id=5854


stdio.stdlib at msa.hinet.net changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |stdio.stdlib at msa.hinet.net




------- Comment #3 from stdio.stdlib at msa.hinet.net  2010-07-12 01:38 CST
-------
I found it on 2010/07/12 with rsync 3.0.7.

cmd is :
/usr/sbin/rsync -aHq --ignore-existing
--password-file="/tmp/rsync.passwd"
root at 2.66.69.43::mp3/ /home/roy/roy_test


*** glibc detected *** /usr/sbin/rsync: double free or corruption (!prev):
0x00080290 ***
======= Backtrace: ========/lib/libc.so.6[0x40189000]
/lib/libc.so.6[0x4018a0ac]
/lib/libc.so.6(cfree+0x164)[0x4018a758]
/lib/libc.so.6(fclose+0x36c)[0x4017678c]
/usr/sbin/rsync[0x2419c]
/usr/sbin/rsync[0x243cc]
/lib/libc.so.6(__default_sa_restorer_v2+0x0)[0x40148090]
/usr/sbin/rsync[0x32b84]
/usr/sbin/rsync[0x32e38]
/usr/sbin/rsync[0x33478]
/usr/sbin/rsync[0x33924]
/usr/sbin/rsync[0x12ffc]
/usr/sbin/rsync[0x25548]
/usr/sbin/rsync[0x25754]
/usr/sbin/rsync[0x26fa0]
/lib/libc.so.6(__libc_start_main+0x1bc)[0x4012f924]
/usr/sbin/rsync(getpwnam+0x34)[0xa3f4]
======= Memory map: =======00008000-00065000 r-xp 00000000 00:0f 3115540   
/mnt/tmp3/roy/rsync
0006d000-00071000 rw-p 0005d000 00:0f 3115540    /mnt/tmp3/roy/rsync
00071000-000a1000 rwxp 00071000 00:00 0          [heap]
40000000-4001d000 r-xp 00000000 01:00 1395       /lib/ld-2.5.so
4001d000-4001f000 rw-p 4001d000 00:00 0 
40024000-40026000 rw-p 0001c000 01:00 1395       /lib/ld-2.5.so
40026000-400ff000 r-xp 00000000 07:00 325       
/usr/local/modules/lib/libiconv.so.2
400ff000-40106000 ---p 000d9000 07:00 325       
/usr/local/modules/lib/libiconv.so.2
40106000-40107000 rw-p 000d8000 07:00 325       
/usr/local/modules/lib/libiconv.so.2
40107000-40113000 r-xp 00000000 01:00 1432       /lib/libgcc_s.so.1
40113000-4011a000 ---p 0000c000 01:00 1432       /lib/libgcc_s.so.1
4011a000-4011b000 rw-p 0000b000 01:00 1432       /lib/libgcc_s.so.1
4011b000-40242000 r-xp 00000000 01:00 1394       /lib/libc-2.5.so
40242000-40249000 ---p 00127000 01:00 1394       /lib/libc-2.5.so
40249000-4024a000 r--p 00126000 01:00 1394       /lib/libc-2.5.so
4024a000-4024c000 rw-p 00127000 01:00 1394       /lib/libc-2.5.so
4024c000-4024f000 rw-p 4024c000 00:00 0 
40270000-402b2000 rw-p 40270000 00:00 0 
402b2000-402bb000 r-xp 00000000 01:00 1430       /lib/libnss_files-2.5.so
402bb000-402c2000 ---p 00009000 01:00 1430       /lib/libnss_files-2.5.so
402c2000-402c3000 r--p 00008000 01:00 1430       /lib/libnss_files-2.5.so
402c3000-402c4000 rw-p 00009000 01:00 1430       /lib/libnss_files-2.5.so
40cf2000-40d33000 rw-p 40cf2000 00:00 0 
bed38000-bed4d000 rw-p bed38000 00:00 0          [stack]


-- 
Configure bugmail: https://bugzilla.samba.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.