Opened 12 years ago

Last modified 7 years ago

#425 closed defect (Fixed)

circuitlist.c:1076 assert failure 0.1.2.12-rc

Reported by: seeess Owned by:
Priority: Low Milestone:
Component: Core Tor/Tor Version: 0.1.2.13
Severity: Keywords:
Cc: seeess Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

0.1.2.12-rc bombed out on my OR

from the log
May 08 05:03:07.903 [info] conn_close_if_marked(): Conn (addr [scrubbed], fd 61, type Directory, state 6) marked, but wants to flush 18336 bytes. (Marked at main.c:641)
May 08 05:03:07.903 [info] conn_close_if_marked(): We stalled too much while trying to write 15416 bytes to addr [scrubbed]. If this happens a lot, either something is wrong with your network connection, or something is wrong with theirs. (fd 61, type Directory, state 6, marked at main.c:641).
May 08 05:03:09.895 [warn] Failing because we have 991 connections already. Please raise your ulimit -n.
May 08 05:03:09.985 [info] connection_exit_connect_dir(): Opening dir bridge
May 08 05:03:09.985 [warn] Failing because we have 991 connections already. Please raise your ulimit -n.
May 08 05:03:10.210 [err] circuitlist.c:1076: assert_circuit_ok: Assertion conn->_base.type == CONN_TYPE_EXIT failed; aborting.

my ulimit -n is 1024

gdb bt
Core was generated by `tor -f /var/lib/tor/data.pub/torrc'.
Program terminated with signal 6, Aborted.
#0 0xb7f9d410 in ?? ()
(gdb) bt
#0 0xb7f9d410 in ?? ()
#1 0xbfdd992c in ?? ()
#2 0x00000006 in ?? ()
#3 0x00006d6c in ?? ()
#4 0xb7ced771 in raise () from /lib/libc.so.6
#5 0xb7ceeea8 in abort () from /lib/libc.so.6
#6 0x080581ae in assert_circuit_ok (c=0xa6ae020) at circuitlist.c:1049
#7 0x08072f3d in connection_exit_begin_conn (cell=0xbfdd9c80, circ=0xa6ae020)

at connection_edge.c:2099

#8 0x0809a8f5 in connection_edge_process_relay_cell (cell=0xbfdd9c80,

circ=0xa6ae020, conn=0x0, layer_hint=0x0) at relay.c:1019

#9 0x0809b0a0 in circuit_receive_relay_cell (cell=0xbfdd9c80, circ=0xa6ae020,

cell_direction=2) at relay.c:169

#10 0x0805d05b in command_process_cell (cell=0xbfdd9c80, conn=0x8472d18)

at command.c:327

#11 0x0807552e in connection_or_process_inbuf (conn=0x8472d18)

at connection_or.c:768

#12 0x080694c6 in connection_process_inbuf (conn=0x6d6c, package_partial=1)

at connection.c:2242

#13 0x0806c513 in connection_handle_read (conn=0x8472d18) at connection.c:1452
#14 0x08095bb8 in conn_read_callback (fd=152, event=2, _conn=0x8472d18)

at main.c:422

#15 0xb7df2332 in event_base_loop () from /usr/lib/libevent-1.1a.so.1
#16 0xb7df2549 in event_loop () from /usr/lib/libevent-1.1a.so.1
#17 0xb7df256e in event_dispatch () from /usr/lib/libevent-1.1a.so.1
#18 0x08095717 in tor_main (argc=3, argv=0xbfdda424) at main.c:1267
#19 0x080b8ee2 in main (argc=Cannot access memory at address 0x6d6c
) at tor_main.c:22

note: I did already upgrade to .13 (running on another instance) on that box, and had to recompile .12 to get a bt, i dunno if that matters at all but fyi

so let me know what to type in to gdb or what info you need

[Automatically added by flyspray2trac: Operating System: All]

Child Tickets

Change History (5)

comment:1 Changed 12 years ago by seeess

#6 0x080581ae in assert_circuit_ok (c=0xa6ae020) at circuitlist.c:1049

1049 tor_assert(c->magic == ORIGIN_CIRCUIT_MAGIC
c->magic == OR_CIRCUIT_MAGIC);

(gdb) print *c
$1 = {magic = 2561392719, n_conn = 0x0,

n_conn_id_digest = '\0' <repeats 19 times>, n_circ_id = 0, n_port = 0,
n_addr = 0, package_window = 1000, deliver_window = 1000, onionskin = 0x0,
timestamp_created = 1178614989, timestamp_dirty = 0, state = 3 '\003',
purpose = 1 '\001', marked_for_close = 0, marked_for_close_file = 0x0,
next = 0xaad3db8}

(gdb) print *or_circ
$2 = {_base = {magic = 2561392719, n_conn = 0x0,

n_conn_id_digest = '\0' <repeats 19 times>, n_circ_id = 0, n_port = 0,
n_addr = 0, package_window = 1000, deliver_window = 1000, onionskin = 0x0,
timestamp_created = 1178614989, timestamp_dirty = 0, state = 3 '\003',
purpose = 1 '\001', marked_for_close = 0, marked_for_close_file = 0x0,
next = 0xaad3db8}, p_circ_id = 22806, p_conn = 0x8472d18,

n_streams = 0xb0d3b80, resolving_streams = 0x0, p_crypto = 0xa17b558,
n_crypto = 0x82d4998, p_digest = 0xab09f08, n_digest = 0xa2a6180,
rend_splice = 0x0, rend_token = '\0' <repeats 19 times>,
handshake_digest = "%ë\221\034\232\030Íã\037ê#øùYÝ6i\223;¬",
is_first_hop = 1}

comment:2 Changed 12 years ago by seeess

(gdb) print *conn
Cannot access memory at address 0x0
(gdb) print *or_circ->n_streams
$3 = {_base = {magic = 162882128, type = 24 '\030', state = 231 'ç',

purpose = 185 '¹', wants_to_read = 0, wants_to_write = 0,
hold_open_until_flushed = 0, inbuf_reached_eof = 1, edge_has_sent_end = 0,
or_is_obsolete = 0, chosen_exit_optional = 0, s = -1431655766,
conn_array_index = -1431655766, read_event = 0xaaaaaaaa,
write_event = 0xaaaaaaaa, inbuf = 0xaaaaaaaa, outbuf = 0xaaaaaaaa,
outbuf_flushlen = 2863311530, timestamp_lastread = -1431655766,
timestamp_lastwritten = -1431655766, timestamp_created = -1431655766,
addr = 2863311530, port = 43690, marked_for_close = 43690,
marked_for_close_file = 0xaaaaaaaa <Address 0xaaaaaaaa out of bounds>,
address = 0xaaaaaaaa <Address 0xaaaaaaaa out of bounds>},

next_stream = 0x0, cpath_layer = 0x0, package_window = 500,
deliver_window = 500, chosen_exit_name = 0x0, socks_request = 0x0,
on_circuit = 0xa6ae020, address_ttl = 0, stream_id = 55739, end_reason = 11,
global_identifier = 2962, n_read = 0, n_written = 0, bridge_for_conn = 0x0,
rend_query = '\0' <repeats 16 times>, num_socks_retries = 0 '\0'}

comment:3 Changed 12 years ago by arma

Fixed in r10154 and r10155. Thanks!

comment:4 Changed 12 years ago by arma

flyspray2trac: bug closed.

comment:5 Changed 7 years ago by nickm

Component: Tor RelayTor
Note: See TracTickets for help on using tickets.