circuit_end_reason_to_control_string(): Bug: Unrecognized reason code 13

[cypherpunks]

Oct 16 18:22:53.000 [notice] Tor 0.2.4.3-alpha-dev (git-94a030990986e6c7) opening log file.
...
Oct 16 19:09:44.000 [warn] circuit_end_reason_to_control_string(): Bug: Unrecognized reason code 13
Oct 16 19:24:28.000 [warn] circuit_end_reason_to_control_string(): Bug: Unrecognized reason code 13
Oct 16 22:19:12.000 [warn] circuit_end_reason_to_control_string(): Bug: Unrecognized reason code 13
Oct 16 23:48:28.000 [warn] circuit_end_reason_to_control_string(): Bug: Unrecognized reason code 13

[andrea]

Hmm, it's just possible this is a channel-related issue, since a grep through the source seems to strongly suggest the only way for a 13 to get there is to be constructed arithmetically (it occurs as a numerical constant nowhere near any of the circuit code). The only likely point for that to happen is the bitwise or in circuit_truncated():

circuit_mark_for_close(TO_CIRCUIT(circ),

END_CIRC_REASON_FLAG_REMOTE|END_CIRC_REASON_CHANNEL_CLOSED|reason)

... which I would have touched to introduce END_CIRC_REASON_CHANNEL_CLOSED. I'll go back and see if I just renamed an existing code or actually introduced a new one without realizing there was something like that going on and whether it was possible for it to have this effect. If so, the reason in question must have been END_CIRC_REASON_RESOURCELIMIT (0x5), since END_CIRC_REASON_CHANNEL_CLOSED is 0x8 and the END_CIRC_REASON_FLAG_REMOTE flag will have been masked off by circuit_end_reason_to_control_string().

Additional observation: it seems wrong to issue an LD_BUG warning for a code that might have been passed from another node [1]; the problem could be in some other node, or it could even be an attack (good thing this wasn't a tor_assert()...). The circuit_end_reason_to_control_string() should probably issue different warning messages depending on END_CIRC_REASON_FLAG_REMOTE.

[1] From or.h:

684 / Bitwise-OR this with the argument to circuit_mark_for_close() or
685 * control_event_circuit_status() to indicate that the reason was
686 * passed through from a destroy or truncate cell. */
687 #define END_CIRC_REASON_FLAG_REMOTE 512
688

[andrea]

Without more information, though, it's going to be pretty tricky to track this down. I suppose I can proceed on the deduction that reason must have been END_CIRC_REASON_RESOURCELIMIT and try to figure out where that could have originated, but it'd be so much nicer to have a stack trace.

Could you breakpoint that warning message in circuit_end_reason_to_control_string() and get me one, please?

[andrea]

Looks like I just renamed END_CIRC_REASON_OR_CONN; relevant section of diff on src/or/or.h from 016c21d871a8fedcd07b7aaca43e47315013c1d4 right before the channel_t merge to 94a030990986e6c731141da3969aeae3ec0f5ea8 (current head) follows:

/* Reasons why we (or a remote OR) might close a circuit. See tor-spec.txt for

• documentation of these. */

-#define _END_CIRC_REASON_MIN 0
+#define END_CIRC_REASON_MIN_ 0

#define END_CIRC_REASON_NONE 0
#define END_CIRC_REASON_TORPROTOCOL 1
#define END_CIRC_REASON_INTERNAL 2

@@ -674,12 +674,12 @@ typedef enum {

#define END_CIRC_REASON_RESOURCELIMIT 5
#define END_CIRC_REASON_CONNECTFAILED 6
#define END_CIRC_REASON_OR_IDENTITY 7

-#define END_CIRC_REASON_OR_CONN_CLOSED 8
+#define END_CIRC_REASON_CHANNEL_CLOSED 8

#define END_CIRC_REASON_FINISHED 9
#define END_CIRC_REASON_TIMEOUT 10
#define END_CIRC_REASON_DESTROYED 11
#define END_CIRC_REASON_NOSUCHSERVICE 12

-#define _END_CIRC_REASON_MAX 12
+#define END_CIRC_REASON_MAX_ 12

In light of this it seems quite unlikely that this was introduced by channels.

[andrea]

Ah, here, the bitwise or is of quite recent origin:

https://trac.torproject.org/projects/tor/ticket/7129#comment:3

Looks like it got mal-merged; it became END_CIRC_REASON_FLAG_REMOTE|END_CIRC_REASON_CHANNEL_CLOSED|reason in the channels merge itself, since that change would have conflicted with the renaming of END_CIRC_REASON_OR_CONN_CLOSED. Guess I didn't need that stack trace after all.

[andrea]

*sigh* I fail X11 clipboard forever, it seems. That URL should have been ​https://gitweb.torproject.org/tor.git/commitdiff/10b43f4c46378c5d08aaba01ee00081c18002a44

[andrea]

Fix is in my bug7129 branch.

[nickm]

Merged it. See also 4164f481c81a6e352982 . Thanks!

[cypherpunks]

Press the 'reageer' button on nu.nl, TorBrowser will close and it tell me:

Tor Software Error - The Tor software encountered an internal bug. Please report the following error message to the Tor developers at bugs.torproject.org: "circuit_end_reason_to_control_string(): Bug: Unrecognized reason code 13

Also seems to happen when you right click it.

After updating to 4164f48.. from 94a0309.. You are currently running version "0.2.4.3-alpha-dev (git-4164f481c81a6e35)" of the Tor software.
TorBrowser still crashes, but the log doesn't tell me whats happening.

[andrea]

I think I'm really going to need a stack trace to come up with any other theories on this, then.

[cypherpunks]

Thanks sysrqb and velope!

#0 0x00007fbaa50d4433 in epoll_wait () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007fbaa5c207bc in ?? ()

from /home/soakednoodle/tor-browser_en-US/Lib/libevent-2.0.so.5

#2 0x00007fbaa5c0ebfe in event_base_loop ()

from /home/soakednoodle/tor-browser_en-US/Lib/libevent-2.0.so.5

#3 0x00007fbaa658beb0 in do_main_loop () at src/or/main.c:1986
#4 0x00007fbaa658d6af in tor_main (argc=<optimized out>, argv=0x7fffd0b56d48)

at src/or/main.c:2698

#5 0x00007fbaa500176d in libc_start_main ()

from /lib/x86_64-linux-gnu/libc.so.6

#6 0x00007fbaa6587fdd in _start ()

[sysrqb]

Replying to cypherpunks:

Press the 'reageer' button on nu.nl, TorBrowser will close and it tell me:

Tor Software Error - The Tor software encountered an internal bug. Please report the following error message to the Tor developers at bugs.torproject.org: "circuit_end_reason_to_control_string(): Bug: Unrecognized reason code 13

Also seems to happen when you right click it.

After updating to 4164f48.. from 94a0309.. You are currently running version "0.2.4.3-alpha-dev (git-4164f481c81a6e35)" of the Tor software.
TorBrowser still crashes, but the log doesn't tell me whats happening.

Please see #7142. This bug is fixed.

[nickm]

ok, closing