Bug 504143

Created attachment 181242 [details]
Crash stacktrace

SUMMARY

KTorrent crashed while it was seeding a number of torrents in the background.

STEPS TO REPRODUCE

There is no definitive reproducer. It just happens at rare and random points in time while KTorrent is seeding torrents in the background.

SOFTWARE/OS VERSIONS

Operating System: Kubuntu 24.04
KDE Plasma Version: 5.27.12
KDE Frameworks Version: 5.115.0
Qt Version: 5.15.13
Kernel Version: 6.11.0-1013-lowlatency (64-bit)
Graphics Platform: X11
Processors: 16 × 12th Gen Intel® Core™ i7-12700K
Memory: 31.1 GiB of RAM
Graphics Processor: NVIDIA GeForce RTX 5080/PCIe/SSE2
Manufacturer: ASUS

KTorrent and libktorrent are versions 23.08.5 with the following patches applied:

https://invent.kde.org/network/libktorrent/-/merge_requests/80
https://invent.kde.org/network/libktorrent/-/merge_requests/81
https://invent.kde.org/network/libktorrent/-/merge_requests/82

ADDITIONAL INFORMATION

I suspect, there may be a race condition in play, and the occasional `close(-1)` calls that were attempted to be fixed by MR80 referenced above may be a side effect of it.

I have collected a backtrace of the crash (attached). Here are two relevant threads from it:

Thread 2 (Thread 0x7562a033d280 (LWP 2293)):
#0  bt::BitSet::set (on=true, i=19835, this=0x5ccdbe237a60) at /usr/src/libktorrent-23.08.5-1lastique1/src/util/bitset.h:199
#1  bt::PeerManager::Private::updateAvailableChunks (this=this@entry=0x5ccdbe237a40) at /usr/src/libktorrent-23.08.5-1lastique1/src/peer/peermanager.cpp:608
#2  0x00007562a74af9c0 in bt::PeerManager::Private::update (this=0x5ccdbe237a40) at /usr/src/libktorrent-23.08.5-1lastique1/src/peer/peermanager.cpp:573
#3  0x00007562a74afb7d in bt::PeerManager::update (this=<optimized out>) at /usr/src/libktorrent-23.08.5-1lastique1/src/peer/peermanager.cpp:121
#4  0x00007562a74e77c3 in bt::TorrentControl::update (this=0x5ccdbdf30280) at /usr/src/libktorrent-23.08.5-1lastique1/src/torrent/torrentcontrol.cpp:149
#5  0x00005ccda500ee96 in kt::Core::update (this=0x5ccdbd56d0e0) at /usr/src/ktorrent-23.08.5-1lastique0/ktorrent/core.cpp:874
#6  0x00007562a5512e16 in ?? () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#7  0x00007562a551710d in QTimer::timeout(QTimer::QPrivateSignal) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#8  0x00007562a550624b in QObject::event(QEvent*) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#9  0x00007562a616bd45 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /lib/x86_64-linux-gnu/libQt5Widgets.so.5
#10 0x00007562a54d8118 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#11 0x00007562a55345ab in QTimerInfoList::activateTimers() () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#12 0x00007562a5534ed9 in ?? () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#13 0x00007562a39145b5 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#14 0x00007562a3973717 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#15 0x00007562a3913a53 in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#16 0x00007562a5535279 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#17 0x00007562a54d6a7b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#18 0x00007562a54df3e8 in QCoreApplication::exec() () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#19 0x00005ccda5002d6f in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/ktorrent-23.08.5-1lastique0/ktorrent/main.cpp:254

Thread 1 (Thread 0x7562897326c0 (LWP 2956)):
#0  0x00007562a76b3d57 in tc_malloc () from /usr/lib/x86_64-linux-gnu/libtcmalloc_minimal.so.4
#1  0x00007562a52e70ea in QArrayData::allocate(unsigned long, unsigned long, unsigned long, QFlags<QArrayData::AllocationOption>) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#2  0x00007562a5337933 in QByteArray::QByteArray(char const*, int) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#3  0x00007562a509804b in QX11Info::display() () from /lib/x86_64-linux-gnu/libQt5X11Extras.so.5
#4  0x00007562a6d79413 in KCrash::defaultCrashHandler(int) () from /lib/x86_64-linux-gnu/libKF5Crash.so.5
#5  <signal handler called>
#6  0x00007562a76b3657 in tc_newarray () from /usr/lib/x86_64-linux-gnu/libtcmalloc_minimal.so.4
#7  0x00007562a7495d2b in std::__new_allocator<std::_List_node<net::TrafficShapedSocket*> >::allocate (this=0x5ccdbc392610, __n=1) at /usr/include/c++/13/bits/new_allocator.h:151
#8  std::allocator_traits<std::allocator<std::_List_node<net::TrafficShapedSocket*> > >::allocate (__n=1, __a=...) at /usr/include/c++/13/bits/alloc_traits.h:482
#9  std::__cxx11::_List_base<net::TrafficShapedSocket*, std::allocator<net::TrafficShapedSocket*> >::_M_get_node (this=0x5ccdbc392610) at /usr/include/c++/13/bits/stl_list.h:518
#10 std::__cxx11::list<net::TrafficShapedSocket*, std::allocator<net::TrafficShapedSocket*> >::_M_create_node<net::TrafficShapedSocket* const&> (this=0x5ccdbc392610) at /usr/include/c++/13/bits/stl_list.h:710
#11 std::__cxx11::list<net::TrafficShapedSocket*, std::allocator<net::TrafficShapedSocket*> >::_M_insert<net::TrafficShapedSocket* const&> (__position=..., this=0x5ccdbc392610) at /usr/include/c++/13/bits/stl_list.h:2005
#12 std::__cxx11::list<net::TrafficShapedSocket*, std::allocator<net::TrafficShapedSocket*> >::push_back (__x=<synthetic pointer>: <optimized out>, this=0x5ccdbc392610) at /usr/include/c++/13/bits/stl_list.h:1306
#13 net::SocketGroup::add (s=0x5ccdc0cfc5a0, this=0x5ccdbc392600) at /usr/src/libktorrent-23.08.5-1lastique1/src/net/socketgroup.h:43
#14 net::UploadThread::update (this=0x5ccdbc3ae0d0) at /usr/src/libktorrent-23.08.5-1lastique1/src/net/uploadthread.cpp:58
#15 net::UploadThread::update (this=0x5ccdbc3ae0d0) at /usr/src/libktorrent-23.08.5-1lastique1/src/net/uploadthread.cpp:30
#16 0x00007562a7496519 in net::NetworkThread::run (this=0x5ccdbc3ae0d0) at /usr/src/libktorrent-23.08.5-1lastique1/src/net/networkthread.cpp:35
#17 0x00007562a52db674 in ?? () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#18 0x00007562a4a9caa4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447
#19 0x00007562a4b29c3c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

I can see that both of the threads operate on TrafficShapedSocket objects concurrently. Specifically, Thread 2 may be calling net::TrafficShapedSocket::close() from bt::PeerManager::Private::update() through bt::Peer::kill(), and Thread 1 is the uploading thread that calls various TrafficShapedSocket methods in net::UploadThread::update() and net::UploadThread::waitForSocketsReady().

I can add that I occasionally see other weirdness in KTorrent behavior when it is just seeding in the background. I reported https://bugs.kde.org/show_bug.cgi?id=471400 previously, and a few times I've seen KTorrent just terminate silently in the background (I did not collect any backtrace back then). Given that this happens very unregularly, it is quite possible that there is some threading or memory related issue.