summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNick Mathewson <nickm@torproject.org>2016-09-22 15:20:31 -0400
committerNick Mathewson <nickm@torproject.org>2016-09-22 15:20:31 -0400
commit077f6a4888e88a4895e7b2234ff2fd81412307d0 (patch)
tree19afb7b837c4e37b331b042753cb62bb3917555f
parent0baa276ea9673ba1c7efce009d30a4afb4f63a6a (diff)
parentd78711c0ae83c505a966791a18a6b8d5b7e4a8d1 (diff)
downloadtor-077f6a4888e88a4895e7b2234ff2fd81412307d0.tar.gz
tor-077f6a4888e88a4895e7b2234ff2fd81412307d0.zip
Merge branch 'maint-0.2.8'
-rw-r--r--changes/bug202036
-rw-r--r--src/or/circuitlist.c10
-rw-r--r--src/or/relay.c9
3 files changed, 23 insertions, 2 deletions
diff --git a/changes/bug20203 b/changes/bug20203
new file mode 100644
index 0000000000..711c91ba85
--- /dev/null
+++ b/changes/bug20203
@@ -0,0 +1,6 @@
+ o Major bugfixes (relay, OOM handler):
+ - Fix a timing-dependent assertion failure that could occur when we
+ tried to flush from a circuit after having freed its cells because
+ of an out-of-memory condition. Fixes bug 20203; bugfix on
+ 0.2.8.1-alpha. Thanks to "cypherpunks" for help diagnosing this
+ one.
diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c
index 3c92baa274..2b3c4169cb 100644
--- a/src/or/circuitlist.c
+++ b/src/or/circuitlist.c
@@ -1920,8 +1920,14 @@ marked_circuit_free_cells(circuit_t *circ)
return;
}
cell_queue_clear(&circ->n_chan_cells);
- if (! CIRCUIT_IS_ORIGIN(circ))
- cell_queue_clear(& TO_OR_CIRCUIT(circ)->p_chan_cells);
+ if (circ->n_mux)
+ circuitmux_clear_num_cells(circ->n_mux, circ);
+ if (! CIRCUIT_IS_ORIGIN(circ)) {
+ or_circuit_t *orcirc = TO_OR_CIRCUIT(circ);
+ cell_queue_clear(&orcirc->p_chan_cells);
+ if (orcirc->p_mux)
+ circuitmux_clear_num_cells(orcirc->p_mux, circ);
+ }
}
static size_t
diff --git a/src/or/relay.c b/src/or/relay.c
index 5fedba28a3..1794215378 100644
--- a/src/or/relay.c
+++ b/src/or/relay.c
@@ -2613,6 +2613,15 @@ channel_flush_from_first_active_circuit, (channel_t *chan, int max))
}
/* Circuitmux told us this was active, so it should have cells */
+ if (/*BUG(*/ queue->n == 0 /*)*/) {
+ log_warn(LD_BUG, "Found a supposedly active circuit with no cells "
+ "to send. Trying to recover.");
+ circuitmux_set_num_cells(cmux, circ, 0);
+ if (! circ->marked_for_close)
+ circuit_mark_for_close(circ, END_CIRC_REASON_INTERNAL);
+ continue;
+ }
+
tor_assert(queue->n > 0);
/*