wallet: Segmentation fault during sync

rednil commented at 2:59 pm on April 5, 2021: none

Trying to sync my several years old wallet using bitcoin-qt on Linux WITH PRUNING ON. After 44% (around Dec. 3 2017, 16:xx), it quits with a segmentation fault. Guessing from the date, I could have made a transaction from that wallet around that time. Tried different computers with different flavors of Linux (Ubuntu 20.04, q4os 20.04) to no avail. If I am syncing without a wallet, it works. Here, logs from a run with GDB and a subsequent backtrace (not sure if that helps, please contact me for debug info):

Reading symbols from ./bitcoin/bitcoin-0.21.0/bin/bitcoin-qt… (No debugging symbols found in ./bitcoin/bitcoin-0.21.0/bin/bitcoin-qt) (gdb) start Function “main” not defined. Make breakpoint pending on future shared library load? (y or [n]) n Starting program: /home/chrischan/bitcoin/bitcoin-0.21.0/bin/bitcoin-qt [Thread debugging using libthread_db enabled] Using host libthread_db library “/lib/x86_64-linux-gnu/libthread_db.so.1”. [New Thread 0x7ffff742f700 (LWP 32345)] [New Thread 0x7ffff63dc700 (LWP 32346)] [New Thread 0x7ffff5a9a700 (LWP 32347)] [New Thread 0x7fffe6ffe700 (LWP 32348)] [New Thread 0x7fffe67fd700 (LWP 32349)] [New Thread 0x7fffc5881700 (LWP 32350)] [New Thread 0x7fff4a870700 (LWP 32353)] [New Thread 0x7fff42ee6700 (LWP 32354)] [Thread 0x7fff4a870700 (LWP 32353) exited] [New Thread 0x7fff426e5700 (LWP 32355)] [New Thread 0x7fff41ee4700 (LWP 32356)] [New Thread 0x7fff416e3700 (LWP 32357)] [New Thread 0x7fff40ee2700 (LWP 32358)] [New Thread 0x7fff2bfff700 (LWP 32359)] [New Thread 0x7fff2b7fe700 (LWP 32360)] [New Thread 0x7fff2affd700 (LWP 32361)] [New Thread 0x7fff2a7fc700 (LWP 32362)] [Thread 0x7fff41ee4700 (LWP 32356) exited]

Thread 6 “b-scheduler” received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffe67fd700 (LWP 32349)] 0x0000555555c2ba7b in ?? () (gdb) bt #0 0x0000555555c2ba7b in ?? () #1 0x0000555555c4d72d in ?? () #2 0x0000555555c4e03d in ?? () #3 0x0000555555c4e454 in ?? () #4 0x0000555555ac964b in ?? () #5 0x0000555555da43b0 in ?? () #6 0x0000555555da31ca in ?? () #7 0x00005555558a097b in ?? () #8 0x0000555555e6e58a in ?? () #9 0x00007ffff7f9c609 in start_thread (arg=) at pthread_create.c:477 #10 0x00007ffff7c16293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 (gdb)

System information

V21.0, from website, verified signature

(1) Old asus EeePc, 2MB RAM, 250GB SSD (2) Acer Laptop, 4MB RAM, 250GB SSD

Ubuntu 20.04 Q4OS (latest)

rednil added the label Bug on Apr 5, 2021

MarcoFalke added the label Wallet on Apr 5, 2021

sipa commented at 4:17 pm on April 5, 2021: member

Can you share the last lines from debug.log?

rednil commented at 4:30 pm on April 5, 2021: none

Sure.

2021-04-05T16:28:49Z Pre-allocating up to position 0xc00000 in rev01085.dat 2021-04-05T16:28:49Z UpdateTip: new best=00000000000000000028b02bad2699993a82fc52e73936b96226296a803b6d6e height=497387 version=0x20000000 log2_work=87.579934 tx=277599023 date=‘2017-12-03T15:22:54Z’ progress=0.440660 cache=85.0MiB(640030txo) 2021-04-05T16:28:51Z UpdateTip: new best=0000000000000000004ea0ab05d11e558456e12e80b1e3a11614d44ea401cbdb height=497388 version=0x20000000 log2_work=87.579971 tx=277600074 date=‘2017-12-03T15:23:16Z’ progress=0.440662 cache=85.8MiB(645919txo) 2021-04-05T16:28:52Z UpdateTip: new best=0000000000000000003b383f9dc396a6bf46d980fa4872bdace5ecd56736a613 height=497389 version=0x20000000 log2_work=87.580007 tx=277602786 date=‘2017-12-03T15:27:40Z’ progress=0.440666 cache=86.4MiB(650778txo)

laanwj commented at 5:32 pm on April 5, 2021: member

Annotation of the backtrace address using the gitian debug information for 0.21.0 x86_64:

 0(gdb) info line *0x0000555555c2ba7b
 1Line 360 of "wallet/scriptpubkeyman.cpp" starts at address 0x555555c2ba79 <LegacyScriptPubKeyMan::MarkUnusedAddresses(CScript const&)+873>
 2   and ends at 0x555555c2ba82 <LegacyScriptPubKeyMan::MarkUnusedAddresses(CScript const&)+882>.
 3
 4(gdb) info line *0x0000555555c4d72d 
 5Line 287 of "/usr/include/c++/7/bits/stl_tree.h" starts at address 0x555555c4d72d <CWallet::AddToWalletIfInvolvingMe(std::shared_ptr<CTransaction const> const&, CWalletTx::Confirmation, bool)+925>
 6   and ends at 0x555555c4d735 <CWallet::AddToWalletIfInvolvingMe(std::shared_ptr<CTransaction const> const&, CWalletTx::Confirmation, bool)+933>.
 7
 8(gdb) info line *0x0000555555c4e03d
 9Line 1152 of "wallet/wallet.cpp" starts at address 0x555555c4e02f <CWallet::SyncTransaction(std::shared_ptr<CTransaction const> const&, CWalletTx::Confirmation, bool)+95>
10   and ends at 0x555555c4e045 <CWallet::SyncTransaction(std::shared_ptr<CTransaction const> const&, CWalletTx::Confirmation, bool)+117>.
11
12(gdb) info line *0x0000555555c4e454
13Line 1217 of "wallet/wallet.cpp" starts at address 0x555555c4e42c <CWallet::blockConnected(CBlock const&, int)+220> and ends at 0x555555c4e458 <CWallet::blockConnected(CBlock const&, int)+264>.
14
15(gdb) info line *0x0000555555ac964b
16Line 222 of "validationinterface.cpp"
17   starts at address 0x555555ac9638 <std::_Function_handler<void(), CMainSignals::BlockConnected(const std::shared_ptr<const CBlock>&, const CBlockIndex*)::<lambda()> >::_M_invoke(const std::_Any_data &)+760>
18   and ends at 0x555555ac9670 <std::_Function_handler<void(), CMainSignals::BlockConnected(const std::shared_ptr<const CBlock>&, const CBlockIndex*)::<lambda()> >::_M_invoke(const std::_Any_data &)+816>.

So this line: https://github.com/bitcoin/bitcoin/blob/v0.21.0/src/wallet/scriptpubkeyman.cpp#L360

The only thing I can think of is some kind of out of bounds access. E.g. as far as I see it doesn’t check meta.has_key_origin, nor the length of meta.key_origin.path.

0bool internal = (meta.key_origin.path[1] & ~BIP32_HARDENED_KEY_LIMIT) != 0;

MarcoFalke renamed this:
~~Segmentation fault during sync~~
wallet: Segmentation fault during sync
on Apr 5, 2021

rednil commented at 1:55 pm on April 7, 2021: none

Now I tried it without pruning. Full node completely synced, updated from 0.20.1 to 0.21.0, placed my old wallet file (not the one it was indexing before) into the “wallets” directory, started up bitcoin-qt, hit “Load Wallet”, selected my file => segfault after a few seconds:

Thread 19 “b-qt-walletctrl” received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff457fa700 (LWP 759452)] 0x0000555555c2ba7b in ?? () (gdb) bt #0 0x0000555555c2ba7b in ?? () #1 0x0000555555c4d72d in ?? () #2 0x0000555555c4e03d in ?? () #3 0x0000555555c4f2ba in ?? () #4 0x0000555555c51a46 in ?? () #5 0x0000555555c53e7b in ?? () #6 0x0000555555b7aba5 in ?? () #7 0x00005555557ffabe in ?? () #8 0x00005555564ab464 in ?? () #9 0x00005555564a13eb in ?? () #10 0x0000555556589fbc in ?? () #11 0x00005555565915ff in ?? () #12 0x000055555646e288 in ?? () #13 0x00005555564c6eae in ?? () #14 0x00005555564c4c56 in ?? () #15 0x000055555646c06f in ?? () #16 0x00005555562f34ca in ?? () #17 0x00005555562f5b7d in ?? () #18 0x00007ffff7f98609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007ffff7c12293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 (gdb)

debug.log:

2021-04-07T13:44:22Z init message: Lade Wallet… 2021-04-07T13:44:23Z [main.dat] Wallet File Version = 139900 2021-04-07T13:44:23Z [main.dat] Keys: 0 plaintext, 4015 encrypted, 4015 w/ metadata, 4015 total. Unknown wallet records: 0 2021-04-07T13:44:23Z [main.dat] Wallet completed loading in 1374ms 2021-04-07T13:44:24Z init message: Durchsuche erneut… 2021-04-07T13:44:24Z [main.dat] Rescanning last 180900 blocks (from block 497263)… 2021-04-07T13:44:24Z [main.dat] Rescan started from block 000000000000000000cc0bef9e18edb27c254b1294e0056fb92f02a00117abc9… 2021-04-07T13:44:38Z New outbound peer connected: version: 70015, blocks=678167, peer=2 (full-relay) 2021-04-07T13:44:38Z New outbound peer connected: version: 70016, blocks=678167, peer=3 (full-relay)

The wallet file worked until quite recently, maybe 0.19 or so.

demensdeum commented at 6:42 pm on May 5, 2021: none

I have two wallet.dat files, and with old wallet.dat (2014 year) everything is ok, but with another wallet.dat (2019 year) I got crash on Windows 10 that I can’t trace, and crash in Ubuntu that I can trace from source code with debug mode. I use pruned mode (4096MB). Ubuntu lldb crash trace:

lldb src/qt/bitcoin-qt process launch – -reindex-chainstate -prune=4096

thread #12, name = ‘b-scheduler’, stop reason = signal SIGSEGV: invalid address (fault address: 0x78) frame #0: 0x00005555557cf3c9 bitcoin-qt`CBlockIndex::GetBlockTime(this=0x0000000000000000) const at chain.h:262:25 259 260 int64_t GetBlockTime() const 261 { -> 262 return (int64_t)nTime; 263 } 264 265 int64_t GetBlockTimeMax() const

db.log is empty debug.log: https://pastebin.com/jP6tH3PE

lldb stack trace: https://pastebin.com/0n9CG0Vm

DeerSpotter commented at 6:11 pm on June 21, 2021: none

any updates on this

rednil commented at 7:06 pm on June 21, 2021: none

I found out that this was NOT my recent wallet that worked not long ago. Instead, it was possibly a VERY old, somehow corrupted wallet I already had problems with years ago. So I guess this is low prio, although it’s still a segfault.

achow101 commented at 2:28 am on October 15, 2021: member

The problem is likely that the wallets are encrypted and so the new fields that are being used are not actually populated at the time of use, causing the segfault. The metadata upgrade requires the private keys to be available, so the wallet needs to be unlocked.

If you were to unlock your wallet before the problematic blocks is reached, then the upgrade will occur and there won’t be a crash.

demensdeum commented at 11:31 am on December 21, 2021: none

Bitcoin core Qt, v22.0.0. still crashing. wallet.dat https://www.mediafire.com/file/rcf2yc3bhinztio/wallet.dat/file I have passphrase from it, and I don’t know how to unlock it from UI, I can only change passphrase.

fanquake commented at 11:53 am on February 23, 2022: member

It’s been confirmed that this is the same issue as #24335. I’m going to close this issue to consolidate discussion there. Ideally we’ll get this solved for 23.0.

fanquake closed this on Feb 23, 2022

DrahtBot locked this on Feb 23, 2023

wallet: Segmentation fault during sync #21605