[tor-bugs] #30771 [Core Tor/Tor]: rend_data_get_pk_digest: Assertion rend_data failed; aborting.

[Tor Bug Tracker & Wiki]

#30771: rend_data_get_pk_digest: Assertion rend_data failed; aborting.
-------------------------------------------+-------------------------------
 Reporter:  nickm                          |          Owner:  (none)
     Type:  defect                         |         Status:  new
 Priority:  High                           |      Milestone:  Tor:
                                           |  0.4.1.x-final
Component:  Core Tor/Tor                   |        Version:
 Severity:  Normal                         |     Resolution:
 Keywords:  041-regression crash 041-must  |  Actual Points:
Parent ID:                                 |         Points:
 Reviewer:                                 |        Sponsor:
-------------------------------------------+-------------------------------

Comment (by asn):

 {{{
      circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_FINISHED);

      /* close any other intros launched in parallel */
 rend_client_close_other_intros(rend_data_get_pk_digest(circ->rend_data,
                                                            NULL));
 }}}

 This seems to be caused by a bad interaction between #29034 and #28780,
 plus some naughty v2 code. The v2 code marks the circuit as closed and
 then tries to access `rend_data` out of it, but because of #28780 the mark
 for close repurposes the circuit to a padding circuit instead, and then
 because #29034 we also clean its rend_data. This causes the crash.

 A temporary bandaid can be found here that allows the HS connection to go
 through: https://github.com/torproject/tor/pull/1074

 However this is a problematic pattern and we should look into this. I
 opened a new ticket at #30773.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30771#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online