Opened 12 years ago

Last modified 7 years ago

#427 closed defect (Fixed)

circuituse.c:540: circuit_detach_stream: Assertion 0 failed

Reported by: xiando Owned by: arma
Priority: Low Milestone:
Component: Core Tor/Tor Version: 0.2.0.0-alpha-dev
Severity: Keywords:
Cc: xiando, arma, nickm Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Tor crashed, died.

Checked out revision 10167.

/var/log/tor/tor.log
May 15 03:59:59.726 [warn] eventdns rejected address [scrubbed]: error 1.
May 15 03:59:59.726 [err] circuit_detach_stream(): Bug: edge conn not in circuit's list?
May 15 03:59:59.726 [err] Bug: circuituse.c:540: circuit_detach_stream: Assertion 0 failed; aborting.

(gdb) bt
#0 0x40254c91 in kill () from /lib/libc.so.6
#1 0x401dec85 in pthread_kill () from /lib/libpthread.so.0
#2 0x401decc6 in raise () from /lib/libpthread.so.0
#3 0x40254a64 in raise () from /lib/libc.so.6
#4 0x40255f9c in abort () from /lib/libc.so.6
#5 0x0805bc68 in circuit_detach_stream (circ=0x80dcb4c, conn=0x6) at circuituse.c:489
#6 0x0808d6f8 in dns_cancel_pending_resolve (

address=0x8ed6398 "g378727577666a797e78687a6769756e747e337a6a6e6a72737371457a68726a337772776a77w7ixtnei.palengam.com") at dns.c:835

#7 0x0808e45b in dns_resolve (exitconn=0x8bffd58) at dns.c:1239
#8 0x08074ab2 in connection_exit_begin_conn (cell=0xbffff5c0, circ=0x8cf1880) at connection_edge.c:2235
#9 0x0809c7ef in connection_edge_process_relay_cell (cell=0xbffff5c0, circ=0x8cf1880, conn=0x0, layer_hint=0x0) at relay.c:1028
#10 0x0809cfb0 in circuit_receive_relay_cell (cell=0xbffff5c0, circ=0x8cf1880, cell_direction=2) at relay.c:171
#11 0x0805e04d in command_process_cell (cell=0xbffff5c0, conn=0x87a5e00) at command.c:331
#12 0x080770ae in connection_or_process_inbuf (conn=0x87a5e00) at connection_or.c:780
#13 0x0806c4a6 in connection_process_inbuf (conn=Variable "conn" is not available.
) at connection.c:2394
#14 0x0806ebd9 in connection_handle_read (conn=0x87a5e00) at connection.c:1579
#15 0x08095d68 in conn_read_callback (fd=166, event=2, _conn=0x87a5e00) at main.c:482
#16 0x400442f0 in event_base_loop () from /usr/lib/libevent-1.3b.so.1
#17 0x4003e000 in ?? ()
#18 0x4003e000 in ?? ()
#19 0x03b67565 in ?? ()
#20 0x08110408 in ?? ()
#21 0xbffffb0a in ?? ()
#22 0x081103dc in ?? ()
#23 0xbffffb00 in ?? ()
#24 0x00000000 in ?? ()
#25 0x00000000 in ?? ()
#26 0x40053034 in selectops () from /usr/lib/libevent-1.3b.so.1
#27 0x081103e8 in ?? ()
#28 0x00000001 in ?? ()
#29 0x00000000 in ?? ()
#30 0x0804a228 in ?? ()
#31 0x4649141f in ?? ()
#32 0x000afc9a in ?? ()
#33 0x00000000 in ?? ()
#34 0x000f4238 in ?? ()
#35 0x00000001 in ?? ()
#36 0x4005315c in ?? () from /usr/lib/libevent-1.3b.so.1
#37 0x00000000 in ?? ()
#38 0x40348f80 in ?? ()
#39 0xbffffca8 in ?? ()
#40 0x40044597 in event_loop () from /usr/lib/libevent-1.3b.so.1
#41 0x00000000 in ?? ()
#42 0x00000000 in ?? ()
#43 0x080958bb in tor_main (argc=50, argv=0xa0012) at main.c:1359
Previous frame inner to this frame (corrupt stack?)
(gdb)

[Automatically added by flyspray2trac: Operating System: Other Linux]

Child Tickets

Change History (5)

comment:1 Changed 12 years ago by nickm

The component "g378727577666a797e78687a6769756e747e337a6a6e6a72737371457a68726a337772776a77w7ixtnei" is longer than
64 characters. Are we being fuzzed?

I smell a backport candidate.

comment:2 Changed 12 years ago by nickm

Actually, this error doesn't exist in 0.1.2.14. Good.

comment:3 Changed 12 years ago by nickm

Fixed in r10399.

comment:4 Changed 12 years ago by nickm

flyspray2trac: bug closed.

comment:5 Changed 7 years ago by nickm

Component: Tor RelayTor
Note: See TracTickets for help on using tickets.