[tor-bugs] #23712 [Core Tor/Tor]: sched: DESTROY cell on a circuit bypasses the scheduler

[Tor Bug Tracker & Wiki]

#23712: sched: DESTROY cell on a circuit bypasses the scheduler
--------------------------+------------------------------------
 Reporter:  dgoulet       |          Owner:  (none)
     Type:  defect        |         Status:  needs_review
 Priority:  Medium        |      Milestone:  Tor: 0.3.2.x-final
Component:  Core Tor/Tor  |        Version:
 Severity:  Normal        |     Resolution:
 Keywords:  tor-sched     |  Actual Points:
Parent ID:                |         Points:
 Reviewer:                |        Sponsor:
--------------------------+------------------------------------

Comment (by dgoulet):

 One quick note here. When a DESTROY cell is sent, it is from
 `circuit_about_to_free()` which means that the "circuit_t" will get freed
 momentarily. However, we put a cell on the circuit queue for which we
 should be updating our cmux cell count (`circuitmux_set_num_cells()`) but
 that function takes a circuit object that we can't use... The circ ID is
 available but we can't do much with it with the current interface.

 That is "OK" because for the scheduler to know if more needs to be
 flushed, it uses `circuitmux_num_cells()` which counts the cell + destroy
 cell.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/23712#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online