commit a9379d6750d025d8bfe54a79c26e89eb45393f3a Author: Nick Mathewson nickm@torproject.org Date: Fri Jul 19 09:49:52 2019 -0400

Set 'routerlist' global to NULL before freeing it.

There is other code that uses this value, and some of it is apparently reachable from inside router_dir_info_changed(), which routerlist_free() apparently calls. (ouch!) This is a minimal fix to try to resolve the issue without causing other problems.

Fixes bug 31003. I'm calling this a bugfix on 0.1.2.2-alpha, where the call to router_dir_info_changed() was added to routerlist_free(). --- changes/bug31003 | 4 ++++ src/feature/nodelist/routerlist.c | 12 ++++++------ 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/changes/bug31003 b/changes/bug31003 new file mode 100644 index 000000000..6c7516338 --- /dev/null +++ b/changes/bug31003 @@ -0,0 +1,4 @@ + o Minor bugfixes (crash on exit): + - Avoid a set of possible code paths that could use try to use freed memory + in routerlist_free() while Tor was exiting. Fixes bug 31003; bugfix on + 0.1.2.2-alpha. diff --git a/src/feature/nodelist/routerlist.c b/src/feature/nodelist/routerlist.c index 4a99427cd..61af09742 100644 --- a/src/feature/nodelist/routerlist.c +++ b/src/feature/nodelist/routerlist.c @@ -954,20 +954,18 @@ routerlist_free_(routerlist_t *rl) smartlist_free(rl->routers); smartlist_free(rl->old_routers); if (rl->desc_store.mmap) { - int res = tor_munmap_file(routerlist->desc_store.mmap); + int res = tor_munmap_file(rl->desc_store.mmap); if (res != 0) { log_warn(LD_FS, "Failed to munmap routerlist->desc_store.mmap"); } } if (rl->extrainfo_store.mmap) { - int res = tor_munmap_file(routerlist->extrainfo_store.mmap); + int res = tor_munmap_file(rl->extrainfo_store.mmap); if (res != 0) { log_warn(LD_FS, "Failed to munmap routerlist->extrainfo_store.mmap"); } } tor_free(rl); - - router_dir_info_changed(); }

/** Log information about how much memory is being used for routerlist, @@ -1426,8 +1424,10 @@ routerlist_reparse_old(routerlist_t *rl, signed_descriptor_t *sd) void routerlist_free_all(void) { - routerlist_free(routerlist); - routerlist = NULL; + routerlist_t *rl = routerlist; + routerlist = NULL; // Prevent internals of routerlist_free() from using + // routerlist. + routerlist_free(rl); dirlist_free_all(); if (warned_nicknames) { SMARTLIST_FOREACH(warned_nicknames, char *, cp, tor_free(cp));