[tor-bugs] #18116 [Tor]: abort in circuitmux_detach_all_circuits on Tor Browser exit with stem scripts running

Wed Feb 10 04:56:06 UTC 2016

#18116: abort in circuitmux_detach_all_circuits on Tor Browser exit with stem
scripts running
-------------------------------------+------------------------------------
 Reporter:  teor                     |          Owner:  andrea
     Type:  defect                   |         Status:  assigned
 Priority:  Very High                |      Milestone:  Tor: 0.2.8.x-final
Component:  Tor                      |        Version:
 Severity:  Major                    |     Resolution:
 Keywords:  crash TorCoreTeam201602  |  Actual Points:
Parent ID:  #18117                   |         Points:
  Sponsor:                           |
-------------------------------------+------------------------------------

Comment (by andrea):

 Ah, looks like my theory was wrong, so don't worry about the
 second_elapsed_callback() code.  The bug was introduced in
 8b4e5b7ee902fb7fa07767410a18433d752c7aef from nickm's
 decouple_circuit_mark branch, which split circuit_about_to_free() out from
 circuit_free(), but left a bare circuit_free() call in the
 circuit_free_all() loop, so that if any circuits are left open at the time
 that call occurs (this is the race), cmux won't be properly notified to
 detach them.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18116#comment:14>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online