[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #15901 [Tor]: apparent memory corruption -- very difficult to isolate
#15901: apparent memory corruption -- very difficult to isolate
---------------------------+--------------------------------
Reporter: starlight | Owner:
Type: defect | Status: new
Priority: critical | Milestone: Tor: 0.2.7.x-final
Component: Tor | Version: Tor: 0.2.6.10
Resolution: | Keywords:
Actual Points: | Parent ID:
Points: |
---------------------------+--------------------------------
Comment (by starlight):
I thought about that. Figure I'll just start the
mprotect() at a rounded-up page boundary and end
it, likewise, at a rounded-down page boundary.
The consensus document is about 340 pages so
statistically that's good-enough to catch it.
Takes about three-to-four weeks after a
`rm cached-*` restart for memory to arrange
itself such that the bug hits the WIP
consensus document. I now realize that
the signature validation of the consensus
is acting as a honeypot for detecting the
memory access bug. Probably happens all
the time but doesn't break anything else
in an obvious way.
Here's some more core-file analysis. I'm
beginning to suspect that the low-order two
bytes of a pointer are being overwritten.
{{{
corruption value "n rHDXjA" or endian-adjusted 0x416A58444872206E
load3 from core file, large segment near end, heap per "size -A"
"load3 67067904 1_____________6"
(gdb) find 0x00007f__98000000, 0x00007f__9bff6000, 0x416A58444872206E
0x7___9ba35d44 FBIPartyTrain 1 of 10
0x7___9bc423cc FBIPartyTrain 2
0x7___9bda5b62 FBIPartyTrain 3
0x7___9bf0004b FBIPartyTrain 4
warning: Unable to access 15534 bytes of target memory at 0x7___9bff2353,
halting search.
load49 from core file, large segment near end, heap per "size -A"
"load49 299806720 1_____________6"
(gdb) find 0x00007f__aa638000, 0x00007f__bc423000, 0x416A58444872206E
0x7___bb52c0b4 FBIPartyTrain 5
0x7___bb52f4f0 * ToughMudder 6 of 10 seg offset 0x10EF74F0 of
284128496, 94.7%
0x7___bb71be2e FBIPartyTrain 7
0x7___bb85ee2a FBIPartyTrain 8
0x7___bb9cc864 FBIPartyTrain 9
0x7___bbbab2c1 FBIPartyTrain 10
warning: Unable to access 15416 bytes of target memory at 0x7___bc41f3c9,
halting search.c
display with
(gdb) x/32c 0x7___bb52f4f0-16
}}}
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/15901#comment:24>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs