[tor-bugs] #7164 [Tor]: microdesc.c:378: Bug: microdesc_free() called, but md was still referenced 1 node(s); held_by_nodes == 1

[Tor Bug Tracker & Wiki]

#7164: microdesc.c:378: Bug: microdesc_free() called, but md was still referenced
1 node(s); held_by_nodes == 1
------------------------+-------------------------------------------------
     Reporter:  jaj123  |      Owner:
         Type:  defect  |     Status:  needs_information
     Priority:  major   |  Milestone:  Tor: 0.2.???
    Component:  Tor     |    Version:  Tor: 0.2.4.19
   Resolution:          |   Keywords:  tor-client 024-backport 025-triaged
Actual Points:          |  Parent ID:
       Points:          |
------------------------+-------------------------------------------------

Comment (by cypherpunks):

 Corruption of nodelist_map could to explain this bug.
 {{{
   for (iter = HT_START(nodelist_map, &the_nodelist->nodes_by_id); iter; )
 {
 }}}
 Probably ends before affected node->md fixed.
 That corruption probably not affects HT_FIND or HT_INSERT because values
 of
 (head)->hth_table[HT_ELT_HASH_(elm,field,hashfn) % head->hth_table_length]
 not broken.
 Corruption probably happens during HT_GROW or something.

 It's only theory that could be confirmed by new logs, node->rs will be
 NULL if nodelist_map was corrupted.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/7164#comment:47>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online