DO NOT REPLY [Bug 6293] New: rsync crashes when transferring files

[samba-bugs at samba.org]

https://bugzilla.samba.org/show_bug.cgi?id=6293

           Summary: rsync crashes when transferring files
           Product: rsync
           Version: 3.0.5
          Platform: x86
        OS/Version: Mac OS X
            Status: NEW
          Severity: normal
          Priority: P3
         Component: core
        AssignedTo: wayned at samba.org
        ReportedBy: dirk.samba at miriup.de
         QAContact: rsync-qa at samba.org


I'm using rsync to backup a virtual machine that has no direct USB support.
rsync fails with the following messages:

-----8<-----
rsync -az --recursive --append --delete --delete-excluded --progress --exclude
.Trash --exclude file1.extension --exclude directory1 host1.local:/home/dirk/
/Volumes/volume1/Backup/host1.local/home/dirk
receiving file list ... 
rsync: opendir "/home/dirk/application1-tools-linuxjiVQAZ" failed: Permission
denied (13)
rsync: opendir "/home/dirk/.dbus" failed: Permission denied (13)
50918 files to consider
IO error encountered -- skipping file deletion
rsync: send_files failed to open "/home/dirk/.viminfo": Permission denied (13)
rsync: open
"/Volumes/volume1/Backup/host1.local/home/dirk/src/application2-0.3/.svn/text-base/build.xml.svn-base"
failed: Permission denied (13)
rsync: connection unexpectedly closed (1256948 bytes received so far)
[generator]
rsync error: error in rsync protocol data stream (code 12) at io.c(600)
[generator=3.0.5]
-----8<-----

After the last message I receive an alert from the MacOSX crash reporter about
a access violation. I made the kernel dump it core and got the following
backtrace:

-----8<-----
#0  0x0003123b in map_ptr (map=0x0, offset=0, len=32768) at fileio.c:192
192             if (offset >= map->p_offset && offset+len <=
map->p_offset+map->p_len)
(gdb) bt
#0  0x0003123b in map_ptr (map=0x0, offset=0, len=32768) at fileio.c:192
#1  0x00011e54 in receive_data (f_in=5, fname_r=0x0, fd_r=-1, size_r=0,
fname=0x0, fd=-1, total_size=50263) at receiver.c:202
#2  0x00012271 in discard_receive_data (f_in=<value temporarily unavailable,
due to optimizations>, length=<value temporarily unavailable, due to
optimizations>) at receiver.c:321
#3  0x000133f2 in recv_files (f_in=5, local_name=0x0) at receiver.c:695
#4  0x0001cd9c in do_recv (f_in=5, f_out=4, local_name=0x0) at main.c:774
#5  0x0001d187 in client_run (f_in=5, f_out=4, pid=9689, argc=1, argv=0x300354)
at main.c:1068
#6  0x0001e290 in main (argc=2, argv=0x300350) at main.c:1275
-----8<-----

I have no clue what's happening inside my virtual machine.

On the the end with the crash, this is what I believe happens:
 - something causes line 689 in receiver.c to return -1
 - discard_receive_data gets called
 - receive_data gets called with fd_r=-1
 - line 181 of receiver.c doesn't match
 - line 189 sets mapbuf = NULL
 - line 202 calls map_ptr with map=0x0
 - line 192 tries to access map->p_offset with a NULL pointer

I have a core dump and can provide more information if required.


-- 
Configure bugmail: https://bugzilla.samba.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.