[tor-bugs] #3390 [Tor Relay]: Tor exit node crashed

[Tor Bug Tracker & Wiki]

#3390: Tor exit node crashed
-----------------------+----------------------------------------------------
 Reporter:  whabib     |          Owner:                    
     Type:  defect     |         Status:  new               
 Priority:  major      |      Milestone:  Tor: 0.2.2.x-final
Component:  Tor Relay  |        Version:                    
 Keywords:             |         Parent:                    
   Points:             |   Actualpoints:                    
-----------------------+----------------------------------------------------

Comment(by nickm):

 .... as far as I can tell, none of the first 2 possible causes (not
 "clauses," apparently I can't type today) is happening.  Revised
 possibilities seem to be:

  * Adding someting to desc_by_eid_map incorrectly -- except that
 everywhere we add to desc_by_eid_map, I believe we are doing it right.
  * Changing an extrainfo_digest entry after adding it to desc_by_eid_map
 -- except that nothing modifies an extrainfo_digest once it's set.
  * Freeing a descriptor without removing it from desc_by_eid_map, which
 poisons the whole routerinfo_t.  This is likeliest to be happening with a
 routerinfo_t, since there's only two places that call
 signed_descriptor_free(), and they both look safe to me.
  * Generic corruption -- always conceivable, though if this is the cause
 here, it'll be hard to trace it down.

 So the next step is to audit every routerinfo_free and make sure it's
 safe.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3390#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online