core dump from rsync

Thu Oct 10 17:07:00 EST 2002

-----BEGIN PGP SIGNED MESSAGE-----

The FreeSWAN project uses rsync to keep our FTP repository up-to-date.
The FTP server is at xs4all.nl, and we rsync to one of their FreeBSD boxes
(xs1.xs4all.nl) over SSH.

We have been experiencing core dumps from the remote rsync. Initially this
was with the XS4ALL provided rsync in /usr/local/bin/rsync. Since I didn't
have access to the source code for this one, I built a new copy and
have been using that one with the same results.

The core dumps are around 19Mb, but we run out of disk quota at that point,
so they might be bigger (and the gdb trace falling off suggests that they
are).
It does not occur on every run, but pretty close. It looks like it is has
gotten into a loop trying to report an error, and we eventually blow the
stack.

I will attempt to put code into log_exit() to abort sooner, and see if
I can find the root cause.

The client is:
bash-2.05$ rsync --version
rsync  version 2.5.5  protocol version 26
Copyright (C) 1996-2002 by Andrew Tridgell and others
<http://rsync.samba.org/>
Capabilities: 64-bit files, socketpairs, hard links, symlinks, batchfiles, 
              IPv6, 64-bit system inums, 64-bit internal inums

rsync comes with ABSOLUTELY NO WARRANTY.  This is free software, and you
are welcome to redistribute it under certain conditions.  See the GNU
General Public Licence for details.
bash-2.05$ uname -a
Linux abigail.freeswan.org 2.4.19 #1 Fri Aug 9 16:46:30 EDT 2002 i686 unknown
bash-2.05$ which rsync
/sandel/bin/rsync

(i.e. locally built)

freeswan at xs1:~$ uname -a
FreeBSD xs1.xs4all.nl 4.5-RELEASE-p3 FreeBSD 4.5-RELEASE-p3 #0: Fri Apr 19 11:42:45 CEST 2002     cor at xs0.xs4all.nl:/usr/src/sys/compile/XS4ALL-SMP  i386
freeswan at xs1:~$ which rsync
/home/f/freeswan/bin/rsync
freeswan at xs1:~$ ldd /home/f/freeswan/bin/rsync
/home/f/freeswan/bin/rsync:
        libc.so.4 => /usr/lib/libc.so.4 (0x2808b000)

freeswan at xs1:~$ rsync --version
rsync  version 2.5.5  protocol version 26
Copyright (C) 1996-2002 by Andrew Tridgell and others
<http://rsync.samba.org/>
Capabilities: 64-bit files, socketpairs, hard links, symlinks, batchfiles, 
              IPv6, 32-bit system inums, 64-bit internal inums

rsync comes with ABSOLUTELY NO WARRANTY.  This is free software, and you
are welcome to redistribute it under certain conditions.  See the GNU
General Public Licence for details.

freeswan at xs1:~$ gdb src/rsync-2.5.5/rsync FTP/rsync.core 
GNU gdb 4.18
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-unknown-freebsd"...
Core was generated by `rsync'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libc.so.4...done.
Reading symbols from /usr/libexec/ld-elf.so.1...done.
#0  0x280fb10d in vfprintf () from /usr/lib/libc.so.4
(gdb) bt
#0  0x280fb10d in vfprintf () from /usr/lib/libc.so.4
#1  0x280cb086 in vsnprintf () from /usr/lib/libc.so.4
#2  0x8052261 in rprintf (code=FERROR, 
    format=0x8069540 "rsync error: %s (code %d) at %s(%d)\n") at log.c:295
#3  0x80528e0 in log_exit (code=13, file=0x80693b9 "log.c", line=279)
    at log.c:564
#4  0x804c632 in _exit_cleanup (code=13, file=0x80693b9 "log.c", line=279)
    at cleanup.c:87
#5  0x8052218 in rwrite (code=FERROR, 
    buf=0xbbc007fc "rsync error: errors with program diagnostics (code 13) at log.c(279)\n", len=69) at log.c:279
#6  0x80522d2 in rprintf (code=FERROR, 
    format=0x8069540 "rsync error: %s (code %d) at %s(%d)\n") at log.c:324
#7  0x80528e0 in log_exit (code=13, file=0x80693b9 "log.c", line=279)
    at log.c:564
#8  0x804c632 in _exit_cleanup (code=13, file=0x80693b9 "log.c", line=279)
    at cleanup.c:87
#9  0x8052218 in rwrite (code=FERROR, 
    buf=0xbbc00cec "rsync error: errors with program diagnostics (code 13) at log.c(279)\n", len=69) at log.c:279
#10 0x80522d2 in rprintf (code=FERROR, 
    format=0x8069540 "rsync error: %s (code %d) at %s(%d)\n") at log.c:324
#11 0x80528e0 in log_exit (code=13, file=0x80693b9 "log.c", line=279)
    at log.c:564
#12 0x804c632 in _exit_cleanup (code=13, file=0x80693b9 "log.c", line=279)
    at cleanup.c:87
#13 0x8052218 in rwrite (code=FERROR, 
    buf=0xbbc011dc "rsync error: errors with program diagnostics (code 13) at log.c(279)\n", len=69) at log.c:279
#14 0x80522d2 in rprintf (code=FERROR, 
    format=0x8069540 "rsync error: %s (code %d) at %s(%d)\n") at log.c:324
#15 0x80528e0 in log_exit (code=13, file=0x80693b9 "log.c", line=279)
    at log.c:564
#16 0x804c632 in _exit_cleanup (code=13, file=0x80693b9 "log.c", line=279)
    at cleanup.c:87
#17 0x8052218 in rwrite (code=FERROR, 
    buf=0xbbc016cc "rsync error: errors with program diagnostics (code 13) at log.c(279)\n", len=69) at log.c:279

... it goes on like this in this loop until GDB says it can't read anymore:

(gdb) up 100000
Cannot access memory at address 0xbcde21ec.

(gdb) down
#23999 0x80528e0 in log_exit (code=13, file=0x80693b9 "log.c", line=279)
    at log.c:564
564                     rprintf(FERROR,"rsync error: %s (code %d) at %s(%d)\n", 

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] mcr at sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
Comment: Finger me for keys

iQCVAwUBPaWzToqHRg3pndX9AQEhdAP/eLIkxp4AoDAeI+SrnH7PswxWWZFNoYcw
5ntidd1GZgXD2ZDAkDcdFSwDvDerBm5z0DJlPdnJc1U2sYWXBGodoMxlxY4AVCEg
fTJviM41NmlAewQkx5vMNoyUrMDgFBw84xmG3Oa5rh8qzF1rqJfNob1Mkhm+pk8d
fRUe6V27Vd0=
=u66A
-----END PGP SIGNATURE-----