diff options
| author | Nick Mathewson <nickm@torproject.org> | 2016-09-22 15:20:31 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2016-09-22 15:20:31 -0400 |
| commit | 077f6a4888e88a4895e7b2234ff2fd81412307d0 (patch) | |
| tree | 19afb7b837c4e37b331b042753cb62bb3917555f | |
| parent | 0baa276ea9673ba1c7efce009d30a4afb4f63a6a (diff) | |
| parent | d78711c0ae83c505a966791a18a6b8d5b7e4a8d1 (diff) | |
| download | tor-077f6a4888e88a4895e7b2234ff2fd81412307d0.tar.gz tor-077f6a4888e88a4895e7b2234ff2fd81412307d0.zip | |
Merge branch 'maint-0.2.8'
| -rw-r--r-- | changes/bug20203 | 6 | ||||
| -rw-r--r-- | src/or/circuitlist.c | 10 | ||||
| -rw-r--r-- | src/or/relay.c | 9 |
3 files changed, 23 insertions, 2 deletions
diff --git a/changes/bug20203 b/changes/bug20203 new file mode 100644 index 0000000000..711c91ba85 --- /dev/null +++ b/changes/bug20203 @@ -0,0 +1,6 @@ + o Major bugfixes (relay, OOM handler): + - Fix a timing-dependent assertion failure that could occur when we + tried to flush from a circuit after having freed its cells because + of an out-of-memory condition. Fixes bug 20203; bugfix on + 0.2.8.1-alpha. Thanks to "cypherpunks" for help diagnosing this + one. diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c index 3c92baa274..2b3c4169cb 100644 --- a/src/or/circuitlist.c +++ b/src/or/circuitlist.c @@ -1920,8 +1920,14 @@ marked_circuit_free_cells(circuit_t *circ) return; } cell_queue_clear(&circ->n_chan_cells); - if (! CIRCUIT_IS_ORIGIN(circ)) - cell_queue_clear(& TO_OR_CIRCUIT(circ)->p_chan_cells); + if (circ->n_mux) + circuitmux_clear_num_cells(circ->n_mux, circ); + if (! CIRCUIT_IS_ORIGIN(circ)) { + or_circuit_t *orcirc = TO_OR_CIRCUIT(circ); + cell_queue_clear(&orcirc->p_chan_cells); + if (orcirc->p_mux) + circuitmux_clear_num_cells(orcirc->p_mux, circ); + } } static size_t diff --git a/src/or/relay.c b/src/or/relay.c index 5fedba28a3..1794215378 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -2613,6 +2613,15 @@ channel_flush_from_first_active_circuit, (channel_t *chan, int max)) } /* Circuitmux told us this was active, so it should have cells */ + if (/*BUG(*/ queue->n == 0 /*)*/) { + log_warn(LD_BUG, "Found a supposedly active circuit with no cells " + "to send. Trying to recover."); + circuitmux_set_num_cells(cmux, circ, 0); + if (! circ->marked_for_close) + circuit_mark_for_close(circ, END_CIRC_REASON_INTERNAL); + continue; + } + tor_assert(queue->n > 0); /* |