[tor-bugs] #25245 [Core Tor/Tor]: Crash in assert_connection_ok when changing Exit options

[Tor Bug Tracker & Wiki]

#25245: Crash in assert_connection_ok when changing Exit options
-------------------------------------------------+-------------------------
 Reporter:  toralf                               |          Owner:  (none)
     Type:  defect                               |         Status:  new
 Priority:  Very High                            |      Milestone:  Tor:
                                                 |  0.3.3.x-final
Component:  Core Tor/Tor                         |        Version:  Tor:
                                                 |  0.3.3.2-alpha
 Severity:  Normal                               |     Resolution:
 Keywords:  crash, regression?, tor-exit, tor-   |  Actual Points:
  relay, ipv6, 033-must, 033-triage-20180320,    |
  033-included-20180320                          |
Parent ID:                                       |         Points:  1
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by rl1987):

 Let's ponder some more about this. Look at the above stack traces.
 Libevent calls back into tor, then the called function calls
 `assert_connection_ok()`, which explodes.

 The function in question is `conn_write_callback()` in main.c. It calls
 `connection_handle_write()` which seems to succeed (otherwise it would
 attempt to close and null out `outbuf_flushlen` for connection in
 question).

 However, right after that `assert_connection_ok()` fails. Do we have a
 race condition here? Is there one more exception case when edge connection
 cannot be writable despite `outbuf_flushlen` not being zero? Does libevent
 de-schedule `EV_WRITE` for already accepted connections when listener is
 closed?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/25245#comment:18>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online