[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #9296 [Tor]: seg fault in cell_queue_append()
#9296: seg fault in cell_queue_append()
-----------------------+----------------------------------------------------
Reporter: arma | Owner:
Type: defect | Status: new
Priority: normal | Milestone: Tor: 0.2.5.x-final
Component: Tor | Version:
Keywords: tor-relay | Parent:
Points: | Actualpoints:
-----------------------+----------------------------------------------------
moria1 running git master (e1d3b444) seg faults reliably, soon after
startup.
{{{
#0 0x000000000042181f in cell_queue_append (queue=0x56e9cf8,
cell=0x7fffad841db0, wide_circ_ids=1, use_stats=0) at
src/or/relay.c:2141
#1 cell_queue_append_packed_copy (queue=0x56e9cf8, cell=0x7fffad841db0,
wide_circ_ids=1, use_stats=0) at src/or/relay.c:2181
#2 0x000000000048003d in circuitmux_append_destroy_cell (chan=0x56e9b70,
cmux=0x56e9cd0, circ_id=2147507178, reason=<value optimized out>)
at src/or/circuitmux.c:1874
#3 0x000000000046ae09 in channel_send_destroy (circ_id=2147507178,
chan=0x56e9b70, reason=<value optimized out>) at src/or/channel.c:2687
#4 0x000000000047f39c in circuit_mark_for_close_ (circ=0x53d7170,
reason=0,
line=1250, file=0x53f9fb "src/or/circuituse.c")
at src/or/circuitlist.c:1568
#5 0x0000000000478db8 in circuit_send_next_onion_skin (circ=0x53d7170)
at src/or/circuitbuild.c:808
#6 0x000000000042595a in connection_edge_process_relay_cell (
cell=0x7fffad842970, circ=0x53d7170, conn=<value optimized out>,
layer_hint=<value optimized out>) at src/or/relay.c:1443
#7 0x00000000004264a0 in circuit_receive_relay_cell (cell=0x7fffad842970,
circ=0x53d7170, cell_direction=CELL_DIRECTION_IN) at
src/or/relay.c:226
#8 0x000000000048d9ae in command_process_relay_cell (chan=0x56e9b70,
cell=0x7fffad842970) at src/or/command.c:462
#9 command_process_cell (chan=0x56e9b70, cell=0x7fffad842970)
at src/or/command.c:148
#10 0x000000000047249b in channel_tls_handle_cell (cell=0x7fffad842970,
conn=0x56e9dd0) at src/or/channeltls.c:924
#11 0x00000000004af256 in connection_or_process_cells_from_inbuf (
conn=0x56e9dd0) at src/or/connection_or.c:1972
#12 0x00000000004a4008 in connection_handle_read_impl (conn=0x56e9dd0)
at src/or/connection.c:2949
#13 connection_handle_read (conn=0x56e9dd0) at src/or/connection.c:2990
#14 0x000000000040c076 in conn_read_callback (fd=<value optimized out>,
event=8112, _conn=0x1) at src/or/main.c:716
#15 0x00007f5b3a481344 in event_base_loop () from
/usr/lib/libevent-1.4.so.2
#16 0x0000000000409e81 in do_main_loop () at src/or/main.c:1996
#17 0x000000000040a1dd in tor_main (argc=<value optimized out>,
argv=<value optimized out>) at src/or/main.c:2720
#18 0x00007f5b39732c8d in __libc_start_main (main=<value optimized out>,
argc=<value optimized out>, ubp_av=<value optimized out>,
init=<value optimized out>, fini=<value optimized out>,
rtld_fini=<value optimized out>, stack_end=0x7fffad8430b8)
at libc-start.c:228
#19 0x0000000000408789 in _start ()
}}}
{{{
(gdb) print *queue
$1 = {head = {sqh_first = 0x362c323700000000, sqh_last = 0x1799620},
n = 24820072, insertion_times = 0x17bd00424603d237}
}}}
First noticed on #9286 (unrelated), and you can see another very similar
backtrace over there.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9296>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs