[tor-bugs] #5552 [Tor Client]: Reported amount of uploaded data occasionally inflated by several gigabytes

[Tor Bug Tracker & Wiki]

#5552: Reported amount of uploaded data occasionally inflated by several gigabytes
------------------------+---------------------------------------------------
 Reporter:  fk          |          Owner:                     
     Type:  defect      |         Status:  new                
 Priority:  normal      |      Milestone:  Tor: 0.2.3.x-final 
Component:  Tor Client  |        Version:  Tor: 0.2.3.13-alpha
 Keywords:              |         Parent:                     
   Points:              |   Actualpoints:                     
------------------------+---------------------------------------------------

Comment(by fk):

 I started by adding an assert() in decrement_buckets().

 The assert() was triggered right after starting Tor while fetching
 directory information.

 {{{
 (gdb) where
 #0  0x000000000064476c in thr_kill () at thr_kill.S:3
 #1  0x0000000000691320 in abort () at /usr/src/lib/libc/stdlib/abort.c:65
 #2  0x00000000006796d0 in __assert (func=0x1891a <Address 0x1891a out of
 bounds>, file=0x6 <Address 0x6 out of bounds>, line=0, failedexpr=0x0)
     at /usr/src/lib/libc/gen/assert.c:54
 #3  0x000000000055d129 in decrement_buckets (bev_ssl=0x800c7f300) at
 bufferevent_openssl.c:557
 #4  0x000000000055dcad in do_handshake (bev_ssl=0x800c7f300) at
 bufferevent_openssl.c:960
 #5  0x000000000055e071 in bufferevent_ssl_renegotiate (bev=0x800c7f300) at
 bufferevent_openssl.c:1057
 #6  0x00000000004cd164 in connection_or_handle_event_cb
 (bufev=0x800c7f300, event=128, arg=0x80272c840) at connection_or.c:1262
 #7  0x000000000056dd52 in bufferevent_run_deferred_callbacks_locked
 (_=0x800c7f4b0, arg=0x800c7f300) at bufferevent.c:144
 #8  0x0000000000561755 in event_process_deferred_callbacks
 (queue=0x800c7c408, breakptr=0x800c7c3e0) at event.c:1364
 #9  0x0000000000561873 in event_process_active (base=0x800c7c300) at
 event.c:1403
 #10 0x0000000000561e18 in event_base_loop (base=0x800c7c300, flags=0) at
 event.c:1589
 #11 0x00000000004056b4 in do_main_loop () at main.c:1933
 #12 0x0000000000407048 in tor_main (argc=5, argv=0x7fffffffd660) at
 main.c:2628
 #13 0x00000000004003eb in main (argc=5, argv=0x7fffffffd660) at
 tor_main.c:30
 (gdb) f 3
 #3  0x000000000055d129 in decrement_buckets (bev_ssl=0x800c7f300) at
 bufferevent_openssl.c:557
 557             assert(num_w >= bev_ssl->counts.n_written);
 (gdb) l
 552
 553             if (num_w >= bev_ssl->counts.n_written) {
 554                       event_warnx("BUG: num_w is %d,
 bev_ssl->counts.n_written is %d",
 555                               num_w, bev_ssl->counts.n_written);
 556             }
 557             assert(num_w >= bev_ssl->counts.n_written);
 558             if (w)
 559
 _bufferevent_decrement_write_buckets(&bev_ssl->bev, w);
 560             if (r)
 561                     _bufferevent_decrement_read_buckets(&bev_ssl->bev,
 r);
 (gdb) p w
 $1 = 18446744073709551283
 (gdb) p num_w
 $2 = 0
 (gdb) p bev_ssl->counts.n_written
 $3 = 333
 }}}

 Is this wrapping really expected, Nick?

 If passing 18446744073709551283 to _bufferevent_decrement_write_buckets()
 isn't an issue, it's unclear to me what an appropriate assert() would look
 like. Any suggestions?

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5552#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online