[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #8746 [Tor]: Tor tries to kill nonexistent proxy PID on second SIGINT
#8746: Tor tries to kill nonexistent proxy PID on second SIGINT
-------------------------+-------------------------------------------------
Reporter: dcf | Owner: nickm
Type: defect | Status: needs_review
Priority: normal | Milestone: Tor: 0.2.5.x-final
Component: Tor | Version:
Resolution: | Keywords: tor-client, pt, 024-deferrable,
Actual Points: | 025-triaged
Points: | Parent ID:
-------------------------+-------------------------------------------------
Comment (by yawning):
Assuming the branch in `set_waitpid_callback()` is taken and the
`tor_free(old_ent)` call suggested by athena is there, it's probably
fairly reasonable to assume that there could very well be a different
`process_handle_t` that holds a reference to `old_en`t.
Some time later when `tor_destroy_process_handle(other_handle, 1)` is
called (I don't know if it ever will, but we're already in "our invariants
have been violated" territory), the code path where asn suggests a free
will be invoked with `ent` being the dangling pointer because the
hashtable entry for the pid at that point is either missing (the callback
fired and the replacement entry got removed from the table) or is the new
entry.
Either leave it as is (leaks a trivial amount memory when impossible
things happen), add a `tor_free()` only in `clear_waitpid_callback()` (may
leak a trivial amount of memory, if the previous process handle is never
destroyed), or add asserts in both branches because both conditions are
invariants.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8746#comment:17>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs