[tor-bugs] #9017 [Tor]: Crash in assert_connection_ok

[Tor Bug Tracker & Wiki]

#9017: Crash in assert_connection_ok
--------------------------+-------------------------------------------------
 Reporter:  usuality      |          Owner:                    
     Type:  defect        |         Status:  needs_review      
 Priority:  major         |      Milestone:  Tor: 0.2.4.x-final
Component:  Tor           |        Version:  Tor: 0.2.3.25     
 Keywords:  023-backport  |         Parent:                    
   Points:                |   Actualpoints:                    
--------------------------+-------------------------------------------------

Comment(by usuality):

 Crashed again.

 {{{
 connection.c:4066 assert_connection_ok: Assertion (conn->type ==
 CONN_TYPE_EXIT && conn->state == EXIT_CONN_STATE_RESOLVING) ||
 connection_is_writing(conn) || conn->write_blocked_on_bw ||
 (CONN_IS_EDGE(conn) && TO_EDGE_CONN(conn)->edge_blocked_on_circ) failed;
 aborting.

 Program received signal SIGABRT, Aborted.
 0x000008e1c28ae74a in kill () at <stdin>:2
 2       <stdin>: No such file or directory.
         in <stdin>
 Current language:  auto; currently asm
 (gdb) where
 #0  0x000008e1c28ae74a in kill () at <stdin>:2
 #1  0x000008e1c29127ca in abort () at /usr/src/lib/libc/stdlib/abort.c:70
 #2  0x000008dfbbcc650c in assert_connection_ok (conn=0x8e1c6655000, now=0)
 at connection.c:4061
 #3  0x000008dfbbcbd720 in _connection_mark_for_close (conn=0x8e1c6655000,
 line=135,
     file=0x8dfbbe8159f "connection_edge.c") at connection.c:673
 #4  0x000008dfbbcc8187 in connection_edge_reached_eof (conn=0x8e1c6655000)
 at connection_edge.c:135
 #5  0x000008dfbbcc582a in connection_reached_eof (conn=0x8e1c6655000) at
 connection.c:3945
 #6  0x000008dfbbcc2c0e in connection_handle_read_impl (conn=0x8e1c6655000)
 at connection.c:2733
 #7  0x000008dfbbcc2c48 in connection_handle_read (conn=0x8e1c6655000) at
 connection.c:2748
 #8  0x000008dfbbc112d0 in conn_read_callback (fd=103, event=2,
 _conn=0x8e1c6655000) at main.c:705
 #9  0x000008e1cb237a38 in event_base_loop (base=0x8e1cb63d800,
 flags=Variable "flags" is not available.
 ) at /usr/src/lib/libevent/event.c:402
 #10 0x000008dfbbc13cae in do_main_loop () at main.c:1959
 #11 0x000008dfbbc15341 in tor_main (argc=1, argv=0x7f7fffff4388) at
 main.c:2652
 #12 0x000008dfbbc0f8ab in main (argc=1, argv=0x7f7fffff4388) at
 tor_main.c:30
 (gdb) up 2
 #2  0x000008dfbbcc650c in assert_connection_ok (conn=0x8e1c6655000, now=0)
 at connection.c:4061
 4061    connection.c: No such file or directory.
         in connection.c
 Current language:  auto; currently c
 (gdb) p *conn
 $1 = {magic = 4030152723, state = 3 '\003', type = 5, purpose = 1,
 read_blocked_on_bw = 0,
   write_blocked_on_bw = 0, hold_open_until_flushed = 0, inbuf_reached_eof
 = 1, in_flushed_some = 0,
   linked = 0, reading_from_linked_conn = 0, writing_to_linked_conn = 0,
 active_on_link = 0,
   linked_conn_is_closed = 0, proxy_state = 0, s = 103, conn_array_index =
 330, read_event = 0x8e1c85da480,
   write_event = 0x8e1bdce5a80, inbuf = 0x8e1c01f3ac0, outbuf =
 0x8e1c93d5200, outbuf_flushlen = 392,
   timestamp_lastread = 1370519533, timestamp_lastwritten = 1370519523,
 timestamp_created = 1370519523,
   socket_family = 2, addr = {family = 2 '\002', addr = {dummy_ =
 3242793927, in_addr = {
         s_addr = 3242793927}, in6_addr = {__u6_addr = {__u6_addr8 =
 "Ç\033IÁ", '\0' <repeats 11 times>,
           __u6_addr16 = {7111, 49481, 0, 0, 0, 0, 0, 0}, __u6_addr32 =
 {3242793927, 0, 0, 0}}}}},
   port = 80, marked_for_close = 0, marked_for_close_file = 0x0,
   address = 0x8e1c85b2880 "api-public.addthis.com", linked_conn = 0x0,
 global_identifier = 326395,
   dirreq_id = 0}
 (gdb) p *conn->outbuf
 $2 = {magic = 2969563922, datalen = 392, default_chunk_size = 4096, head =
 0x8e1c20d0000,
   tail = 0x8e1c20d0000}
 }}}

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9017#comment:14>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online