October 2017 - tor-commits - lists.torproject.org

[tor/maint-0.3.0] Clear outbuf_flushlen when we clear a connection's outbuf
by nickm＠torproject.org 23 Oct '17

23 Oct '17

commit f7222e6d8cf31ce0e2a4653477ab42645c045db6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 29 10:00:14 2017 -0400 Clear outbuf_flushlen when we clear a connection's outbuf When we added single_conn_free_bytes(), we cleared the outbuf on a connection without setting outbuf_flushlen() to 0. This could cause an assertion failure later on in flush_buf(). Fixes bug 23690; bugfix on 0.2.6.1-alpha. --- changes/bug23690 | 5 +++++ src/or/circuitlist.c | 1 + 2 files changed, 6 insertions(+) diff --git a/changes/bug23690 b/changes/bug23690 new file mode 100644 index 000000000..36ff32e49 --- /dev/null +++ b/changes/bug23690 @@ -0,0 +1,5 @@ + o Major bugfixes (relay, crash, assertion failure): + - Fix a timing-based assertion failure that could occur when the + circuit out-of-memory handler freed a connection's output buffer. + Fixes bug 23690; bugfix on 0.2.6.1-alpha. + diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c index d7dbfe574..b71048590 100644 --- a/src/or/circuitlist.c +++ b/src/or/circuitlist.c @@ -1939,6 +1939,7 @@ single_conn_free_bytes(connection_t *conn) if (conn->outbuf) { result += buf_allocation(conn->outbuf); buf_clear(conn->outbuf); + conn->outbuf_flushlen = 0; } if (conn->type == CONN_TYPE_DIR) { dir_connection_t *dir_conn = TO_DIR_CONN(conn);

1 0

[tor/maint-0.3.2] Merge branch 'maint-0.2.9' into maint-0.3.0
by nickm＠torproject.org 23 Oct '17

23 Oct '17

commit 74e8fd22c9971a7184d74d2775ca1c575e54e08f Merge: 35574d4a9 132e2f69b Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 23 08:53:25 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0 changes/bug23690 | 5 +++++ src/or/circuitlist.c | 1 + 2 files changed, 6 insertions(+)

1 0

[tor/maint-0.3.1] Clear outbuf_flushlen when we clear a connection's outbuf
by nickm＠torproject.org 23 Oct '17

23 Oct '17

commit f7222e6d8cf31ce0e2a4653477ab42645c045db6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 29 10:00:14 2017 -0400 Clear outbuf_flushlen when we clear a connection's outbuf When we added single_conn_free_bytes(), we cleared the outbuf on a connection without setting outbuf_flushlen() to 0. This could cause an assertion failure later on in flush_buf(). Fixes bug 23690; bugfix on 0.2.6.1-alpha. --- changes/bug23690 | 5 +++++ src/or/circuitlist.c | 1 + 2 files changed, 6 insertions(+) diff --git a/changes/bug23690 b/changes/bug23690 new file mode 100644 index 000000000..36ff32e49 --- /dev/null +++ b/changes/bug23690 @@ -0,0 +1,5 @@ + o Major bugfixes (relay, crash, assertion failure): + - Fix a timing-based assertion failure that could occur when the + circuit out-of-memory handler freed a connection's output buffer. + Fixes bug 23690; bugfix on 0.2.6.1-alpha. + diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c index d7dbfe574..b71048590 100644 --- a/src/or/circuitlist.c +++ b/src/or/circuitlist.c @@ -1939,6 +1939,7 @@ single_conn_free_bytes(connection_t *conn) if (conn->outbuf) { result += buf_allocation(conn->outbuf); buf_clear(conn->outbuf); + conn->outbuf_flushlen = 0; } if (conn->type == CONN_TYPE_DIR) { dir_connection_t *dir_conn = TO_DIR_CONN(conn);

1 0

[tor/maint-0.3.1] Merge remote-tracking branch 'public/bug23690_028' into maint-0.2.8
by nickm＠torproject.org 23 Oct '17

23 Oct '17

commit 6f87a85897ca82fac9fc132e0f0cf41eacab20d4 Merge: 91c17ffbd f7222e6d8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 23 08:53:14 2017 -0400 Merge remote-tracking branch 'public/bug23690_028' into maint-0.2.8 changes/bug23690 | 5 +++++ src/or/circuitlist.c | 1 + 2 files changed, 6 insertions(+)

1 0

[tor/maint-0.2.9] Merge branch 'maint-0.2.8' into maint-0.2.9
by nickm＠torproject.org 23 Oct '17

23 Oct '17

commit 132e2f69b1068b139d3c114fddd6efe58d6fc8f4 Merge: fcaf3335b 6f87a8589 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 23 08:53:25 2017 -0400 Merge branch 'maint-0.2.8' into maint-0.2.9 changes/bug23690 | 5 +++++ src/or/circuitlist.c | 1 + 2 files changed, 6 insertions(+)

1 0

[tor/maint-0.3.0] Merge branch 'maint-0.2.9' into maint-0.3.0
by nickm＠torproject.org 23 Oct '17

23 Oct '17

commit 74e8fd22c9971a7184d74d2775ca1c575e54e08f Merge: 35574d4a9 132e2f69b Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 23 08:53:25 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0 changes/bug23690 | 5 +++++ src/or/circuitlist.c | 1 + 2 files changed, 6 insertions(+)

1 0

[tor/maint-0.3.2] Merge branch 'maint-0.2.8' into maint-0.2.9
by nickm＠torproject.org 23 Oct '17

23 Oct '17

commit 132e2f69b1068b139d3c114fddd6efe58d6fc8f4 Merge: fcaf3335b 6f87a8589 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 23 08:53:25 2017 -0400 Merge branch 'maint-0.2.8' into maint-0.2.9 changes/bug23690 | 5 +++++ src/or/circuitlist.c | 1 + 2 files changed, 6 insertions(+)

1 0

[tor/master] Merge remote-tracking branch 'public/bug23690_028' into maint-0.2.8
by nickm＠torproject.org 23 Oct '17

23 Oct '17

commit 6f87a85897ca82fac9fc132e0f0cf41eacab20d4 Merge: 91c17ffbd f7222e6d8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 23 08:53:14 2017 -0400 Merge remote-tracking branch 'public/bug23690_028' into maint-0.2.8 changes/bug23690 | 5 +++++ src/or/circuitlist.c | 1 + 2 files changed, 6 insertions(+)

1 0

[tor/maint-0.3.0] Merge branch 'maint-0.2.8' into maint-0.2.9
by nickm＠torproject.org 23 Oct '17

23 Oct '17

commit 132e2f69b1068b139d3c114fddd6efe58d6fc8f4 Merge: fcaf3335b 6f87a8589 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 23 08:53:25 2017 -0400 Merge branch 'maint-0.2.8' into maint-0.2.9 changes/bug23690 | 5 +++++ src/or/circuitlist.c | 1 + 2 files changed, 6 insertions(+)

1 0

[tor/maint-0.2.9] Clear outbuf_flushlen when we clear a connection's outbuf
by nickm＠torproject.org 23 Oct '17

23 Oct '17

commit f7222e6d8cf31ce0e2a4653477ab42645c045db6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 29 10:00:14 2017 -0400 Clear outbuf_flushlen when we clear a connection's outbuf When we added single_conn_free_bytes(), we cleared the outbuf on a connection without setting outbuf_flushlen() to 0. This could cause an assertion failure later on in flush_buf(). Fixes bug 23690; bugfix on 0.2.6.1-alpha. --- changes/bug23690 | 5 +++++ src/or/circuitlist.c | 1 + 2 files changed, 6 insertions(+) diff --git a/changes/bug23690 b/changes/bug23690 new file mode 100644 index 000000000..36ff32e49 --- /dev/null +++ b/changes/bug23690 @@ -0,0 +1,5 @@ + o Major bugfixes (relay, crash, assertion failure): + - Fix a timing-based assertion failure that could occur when the + circuit out-of-memory handler freed a connection's output buffer. + Fixes bug 23690; bugfix on 0.2.6.1-alpha. + diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c index d7dbfe574..b71048590 100644 --- a/src/or/circuitlist.c +++ b/src/or/circuitlist.c @@ -1939,6 +1939,7 @@ single_conn_free_bytes(connection_t *conn) if (conn->outbuf) { result += buf_allocation(conn->outbuf); buf_clear(conn->outbuf); + conn->outbuf_flushlen = 0; } if (conn->type == CONN_TYPE_DIR) { dir_connection_t *dir_conn = TO_DIR_CONN(conn);

1 0