[tor-bugs] #18930 [- Select a component]: Segmentation fault: entry->parsed->intro_nodes

[Tor Bug Tracker & Wiki]

#18930: Segmentation fault: entry->parsed->intro_nodes
--------------------------------------+--------------------------
     Reporter:  juha                  |      Owner:
         Type:  defect                |     Status:  new
     Priority:  Medium                |  Milestone:
    Component:  - Select a component  |    Version:  Tor: 0.2.7.6
     Severity:  Normal                |   Keywords:  tor2web
Actual Points:                        |  Parent ID:
       Points:                        |   Reviewer:
      Sponsor:                        |
--------------------------------------+--------------------------
 I have been running Tor on tor2web mode and now it has started to crash.

 It crashes after few minutes of use. Before that it works normally.


 {{{
 Program received signal SIGSEGV, Segmentation fault.
 0x00005555555c02d6 in rend_client_get_random_intro_impl (
    entry=0x5555555bf1bf <rend_client_fetch_v2_desc+114>, strict=0,
 warnings=0)
    at src/or/rendclient.c:1353
 1353      smartlist_add_all(usable_nodes, entry->parsed->intro_nodes);
 }}}


 Tor version:
 Tor 0.2.7.6 (git-605ae665009853bd)

 On log:
 Apr 29 03:52:05.920 [notice] Tor v0.2.7.6 running on Linux with Libevent
 2.0.21-stable, OpenSSL 1.0.1f and Zlib 1.2.8.
 ...
 Apr 29 03:52:18.000 [notice] Tor has successfully opened a circuit. Looks
 like client functionality is working.
 Apr 29 03:52:18.000 [notice] Bootstrapped 100%: Done

 (gdb) bt full

 {{{
 #0  0x00005555555c02d6 in rend_client_get_random_intro_impl (
     entry=0x5555555bf1bf <rend_client_fetch_v2_desc+114>, strict=0,
 warnings=0)
     at src/or/rendclient.c:1353
         i = 32767
         intro = 0x1
         options = 0x555555a74770
         usable_nodes = 0x555556944060
         n_excluded = 0
         __PRETTY_FUNCTION__ = "rend_client_get_random_intro_impl"
         __func__ = "rend_client_get_random_intro_impl"
 #1  0x00005555555c05de in rend_client_any_intro_points_usable (
     entry=0x5555555bf1bf <rend_client_fetch_v2_desc+114>)
     at src/or/rendclient.c:1422
         extend_info = 0x555556860078
         rv = 2054450743
 #2  0x00005555555bfea1 in rend_client_desc_trynow (
     query=0x5555568ea1f0 "oahmssjdnck7ntzx") at src/or/rendclient.c:1217
         base_conn_sl_idx = 45
         base_conn_sl_len = 97
         base_conn = 0x5555567aef00
         conn = 0x5555567aef00
         entry = 0x5555555bf1bf <rend_client_fetch_v2_desc+114>
         rend_data = 0x5555568661e0
         now = 1461908592
         conns = 0x555555a5c890
         __PRETTY_FUNCTION__ = "rend_client_desc_trynow"
 #3  0x00005555555bf366 in rend_client_refetch_v2_renddesc (
     rend_query=0x5555568ea1f0) at src/or/rendclient.c:921
         ret = 0
         e = 0x0
         __func__ = "rend_client_refetch_v2_renddesc"
         __PRETTY_FUNCTION__ = "rend_client_refetch_v2_renddesc"
 #4  0x0000555555699e50 in connection_dir_about_to_close (
     dir_conn=0x5555568ee290) at src/or/directory.c:2312
 ---Type <return> to continue, or q <return> to quit---
         conn = 0x5555568ee290
 #5  0x0000555555663b87 in connection_about_to_close_connection (
     conn=0x5555568ee290) at src/or/connection.c:704
         __func__ = "connection_about_to_close_connection"
 #6  0x000055555558de1c in connection_unlink (conn=0x5555568ee290)
     at src/or/main.c:430
 No locals.
 #7  0x000055555558f4c6 in conn_close_if_marked (i=48) at src/or/main.c:982
         conn = 0x5555568ee290
         retval = 1452204688
         now = 1461908592
         __PRETTY_FUNCTION__ = "conn_close_if_marked"
         __func__ = "conn_close_if_marked"
 #8  0x000055555558ec09 in close_closeable_connections () at
 src/or/main.c:760
         conn = 0x5555568ee290
         i = 0
 #9  0x000055555558ed88 in conn_read_callback (fd=-1, event=2,
     _conn=0x5555568ee290) at src/or/main.c:795
         conn = 0x5555568ee290
         __PRETTY_FUNCTION__ = "conn_read_callback"
 #10 0x00007ffff7684f24 in event_base_loop ()
    from /usr/lib/x86_64-linux-gnu/libevent-2.0.so.5
 No symbol table info available.
 #11 0x0000555555591da6 in run_main_loop_once () at src/or/main.c:2226
         loop_result = 0
         __PRETTY_FUNCTION__ = "run_main_loop_once"
 #12 0x0000555555591ef6 in run_main_loop_until_done () at
 src/or/main.c:2267
         loop_result = 1
 #13 0x0000555555591cbf in do_main_loop () at src/or/main.c:2198
         now = 1461907585
         __PRETTY_FUNCTION__ = "do_main_loop"
         __func__ = "do_main_loop"
 #14 0x0000555555595d95 in tor_main (argc=1, argv=0x7fffffffe588)
     at src/or/main.c:3294
 ---Type <return> to continue, or q <return> to quit---
         result = 0
         __PRETTY_FUNCTION__ = "tor_main"
 #15 0x000055555558d4a4 in main (argc=1, argv=0x7fffffffe588)
     at src/or/tor_main.c:30
         r = 32767
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18930>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online