[tor-bugs] #12862 [Tor]: Refactor code to modify circ->n_chan only by circuit_set_circid_chan_helper

[Tor Bug Tracker & Wiki]

#12862: Refactor code to modify circ->n_chan only by circuit_set_circid_chan_helper
-------------------------+---------------------
 Reporter:  cypherpunks  |          Owner:
     Type:  defect       |         Status:  new
 Priority:  normal       |      Milestone:
Component:  Tor          |        Version:
 Keywords:               |  Actual Points:
Parent ID:               |         Points:
-------------------------+---------------------
 Right now code assigns circ->n_chan before actually keeps it in chan-
 circid map. Previous value of circ->n_chan used as old_chan by
 circuit_set_n_circid_chan() and circuit_set_circid_chan_helper()

 For example:
 {{{
   if (old_chan) {
     /*
      * If we're changing channels or ID and had an old channel and a non
      * zero old ID and weren't marked for close (i.e., we should have been
      * attached), detach the circuit. ID changes require this because
      * circuitmux hashes on (channel_id, circuit_id).
      */
     if (old_id != 0 && (old_chan != chan || old_id != id) &&
         !(circ->marked_for_close)) {
       tor_assert(old_chan->cmux);
       circuitmux_detach_circuit(old_chan->cmux, circ);
     }

     /* we may need to remove it from the conn-circid map */
     search.circ_id = old_id;
     search.chan = old_chan;
     found = HT_REMOVE(chan_circid_map, &chan_circid_map, &search);
     if (found) {
       tor_free(found);
       if (direction == CELL_DIRECTION_OUT) {
         /* One fewer circuits use old_chan as n_chan */
         --(old_chan->num_n_circuits);
       } else {
         /* One fewer circuits use old_chan as p_chan */
         --(old_chan->num_p_circuits);
       }
     }
   }
 }}}
 It's useless to process such circ->n_chan as old_chan

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12862>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online