Re: [tor-bugs] #32564 [Core Tor/Tor]: Assertion pol->magic failed

[Tor Bug Tracker & Wiki]

#32564: Assertion pol->magic failed
-+---
 Reporter:  Logforme |  Owner:  (none)
 Type:  defect   | Status:  needs_information
 Priority:  Medium   |  Milestone:  Tor: unspecified
Component:  Core Tor/Tor |Version:  Tor: 0.4.1.6
 Severity:  Normal   | Resolution:
 Keywords:  assert, crash, backport  |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+---
Changes (by nickm):

 * priority:  High => Medium
 * keywords:  assert, crash, backport, 044-should, 044-must => assert,
 crash, backport
 * milestone:  Tor: 0.4.4.x-final => Tor: unspecified


Comment:

 This doesn't seem to be happening a lot and it is still needs_info; we
 can't do it in 044 without knowing that it is still happening and getting
 the above info solved.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #32564 [Core Tor/Tor]: Assertion pol->magic failed

[Tor Bug Tracker & Wiki]

#32564: Assertion pol->magic failed
--+
 Reporter:  Logforme  |  Owner:  (none)
 Type:  defect| Status:
  |  needs_information
 Priority:  High  |  Milestone:  Tor:
  |  0.4.4.x-final
Component:  Core Tor/Tor  |Version:  Tor:
  |  0.4.1.6
 Severity:  Normal| Resolution:
 Keywords:  assert crash backport 044-should  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+
Changes (by teor):

 * keywords:  assert crash backport 043-must => assert crash backport
 044-should


Comment:

 This ticket is in 0.4.4, so I can't be 043-should.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #32564 [Core Tor/Tor]: Assertion pol->magic failed

[Tor Bug Tracker & Wiki]

#32564: Assertion pol->magic failed
+--
 Reporter:  Logforme|  Owner:  (none)
 Type:  defect  | Status:
|  needs_information
 Priority:  High|  Milestone:  Tor:
|  0.4.4.x-final
Component:  Core Tor/Tor|Version:  Tor: 0.4.1.6
 Severity:  Normal  | Resolution:
 Keywords:  assert crash backport 043-must  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by dgoulet):

 * milestone:  Tor: 0.4.3.x-final => Tor: 0.4.4.x-final


Comment:

 Until we can get more information, deferring to 044.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #32564 [Core Tor/Tor]: Assertion pol->magic failed

[Tor Bug Tracker & Wiki]

#32564: Assertion pol->magic failed
+--
 Reporter:  Logforme|  Owner:  (none)
 Type:  defect  | Status:
|  needs_information
 Priority:  High|  Milestone:  Tor:
|  0.4.3.x-final
Component:  Core Tor/Tor|Version:  Tor: 0.4.1.6
 Severity:  Normal  | Resolution:
 Keywords:  assert crash backport 043-must  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by nickm):

 * status:  assigned => needs_information


Comment:

 Unless somebody else has insight here, I'm going to have to hope that the
 diagnostic patch in #33290 finds something.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #32564 [Core Tor/Tor]: Assertion pol->magic failed

[Tor Bug Tracker & Wiki]

#32564: Assertion pol->magic failed
+--
 Reporter:  Logforme|  Owner:  (none)
 Type:  defect  | Status:  assigned
 Priority:  High|  Milestone:  Tor:
|  0.4.3.x-final
Component:  Core Tor/Tor|Version:  Tor: 0.4.1.6
 Severity:  Normal  | Resolution:
 Keywords:  assert crash backport 043-must  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by nickm):

 * owner:  nickm => (none)


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #32564 [Core Tor/Tor]: Assertion pol->magic failed

[Tor Bug Tracker & Wiki]

#32564: Assertion pol->magic failed
+--
 Reporter:  Logforme|  Owner:  nickm
 Type:  defect  | Status:  assigned
 Priority:  High|  Milestone:  Tor:
|  0.4.3.x-final
Component:  Core Tor/Tor|Version:  Tor: 0.4.1.6
 Severity:  Normal  | Resolution:
 Keywords:  assert crash backport 043-must  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--

Comment (by nickm):

 So, there is only one kind of `circuitmux_policy_circ_data_t` in 0.4.1.x,
 so we don't need to worry about the case where this is another kind of
 data.  The pointer here is either:

   * An invalid pointer that is not pointing to an ewma_policy_circ_data_t.
   * A stale pointer that used to point to an ewma_policy_circ_data_t which
 has been freed.
   * A pointer that points to an ewma_policy_circ_data_t which has gotten
 corrupt.

 But I can't find plausible vectors for any of these things to happen.
 Because of the infrequency of this bug, I am almost tempted to suspect
 faulty memory, but that should always be a last-resort hypothesis.

 The best I can figure out here right now is to add a diagnostic patch.
 I'll open a child ticket.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #32564 [Core Tor/Tor]: Assertion pol->magic failed

[Tor Bug Tracker & Wiki]

#32564: Assertion pol->magic failed
+--
 Reporter:  Logforme|  Owner:  nickm
 Type:  defect  | Status:  assigned
 Priority:  High|  Milestone:  Tor:
|  0.4.3.x-final
Component:  Core Tor/Tor|Version:  Tor: 0.4.1.6
 Severity:  Normal  | Resolution:
 Keywords:  assert crash backport 043-must  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by nickm):

 * owner:  (none) => nickm
 * status:  new => assigned


Comment:

 I'll try to figure out what's going on here.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #32564 [Core Tor/Tor]: Assertion pol->magic failed

[Tor Bug Tracker & Wiki]

#32564: Assertion pol->magic failed
+--
 Reporter:  Logforme|  Owner:  (none)
 Type:  defect  | Status:  new
 Priority:  High|  Milestone:  Tor:
|  0.4.3.x-final
Component:  Core Tor/Tor|Version:  Tor: 0.4.1.6
 Severity:  Normal  | Resolution:
 Keywords:  assert crash backport 043-must  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by ahf):

 * keywords:  assert crash backport => assert crash backport 043-must


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #32564 [Core Tor/Tor]: Assertion pol->magic failed

[Tor Bug Tracker & Wiki]

#32564: Assertion pol->magic failed
---+
 Reporter:  Logforme   |  Owner:  (none)
 Type:  defect | Status:  new
 Priority:  High   |  Milestone:  Tor: 0.4.3.x-final
Component:  Core Tor/Tor   |Version:  Tor: 0.4.1.6
 Severity:  Normal | Resolution:
 Keywords:  assert crash backport  |  Actual Points:
Parent ID: | Points:
 Reviewer: |Sponsor:
---+
Changes (by nickm):

 * priority:  Medium => High
 * keywords:  assert => assert crash backport
 * milestone:   => Tor: 0.4.3.x-final


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #32564 [Core Tor/Tor]: Assertion pol->magic failed

[Tor Bug Tracker & Wiki]

#32564: Assertion pol->magic failed
--+--
 Reporter:  Logforme  |  Owner:  (none)
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Core Tor/Tor  |Version:  Tor: 0.4.1.6
 Severity:  Normal| Resolution:
 Keywords:  assert|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by dgoulet):

 So the only path into the EWMA subsystem I can find from
 `circuit_receive_relay_cell()` is through this path:

 * circuit_receive_relay_cell()
   * append_cell_to_circuit_queue()
 * update_circuit_on_cmux_()
   * circuitmux_set_num_cells()
 * circuitmux_make_circuit_inactive() _OR_
 * circuitmux_make_circuit_active()

 Both either call `notify_circ_inactive()` or `notify_circ_active()` which
 EWMA subsystem sets those function pointers.

 Which means that we have in the `chanid_circid_muxinfo_map` map an entry
 that has either things that were freed() or never initialized.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

[tor-bugs] #32564 [Core Tor/Tor]: Assertion pol->magic failed

[Tor Bug Tracker & Wiki]

#32564: Assertion pol->magic failed
--+--
 Reporter:  Logforme  |  Owner:  (none)
 Type:  defect| Status:  new
 Priority:  Medium|  Component:  Core Tor/Tor
  Version:  Tor: 0.4.1.6  |   Severity:  Normal
 Keywords:  assert|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
 Guard relay 855BC2DABE24C861CD887DB9B2E950424B49FC34 crashed with the
 following log:
 {{{
 Nov 21 00:18:01.000 [err] tor_assertion_failed_(): Bug:
 ../src/core/or/circuitmux_ewma.c:165: TO_EWMA_POL_CIRC_DATA: Assertion
 pol->magic == 0x761e7747U failed; aborting. (on Tor 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug: Assertion pol->magic == 0x761e7747U failed
 in TO_EWMA_POL_CIRC_DATA at ../src/core/or/circuitmux_ewma.c:165: . Stack
 trace: (on Tor 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:     /usr/bin/tor(log_backtrace_impl+0x47)
 [0x55d5e9f968e7] (on Tor 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:
 /usr/bin/tor(tor_assertion_failed_+0x147) [0x55d5e9f919c7] (on Tor 0.4.1.6
 )
 Nov 21 00:18:01.000 [err] Bug:     /usr/bin/tor(+0x8fe84) [0x55d5e9e14e84]
 (on Tor 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:     /usr/bin/tor(+0xb839f) [0x55d5e9e3d39f]
 (on Tor 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:
 /usr/bin/tor(circuit_receive_relay_cell+0x29a) [0x55d5e9e419fa] (on Tor
 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:
 /usr/bin/tor(command_process_cell+0x2fc) [0x55d5e9e23a1c] (on Tor 0.4.1.6
 )
 Nov 21 00:18:01.000 [err] Bug:
 /usr/bin/tor(channel_tls_handle_cell+0x333) [0x55d5e9e030d3] (on Tor
 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:     /usr/bin/tor(+0xa773f) [0x55d5e9e2c73f]
 (on Tor 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:
 /usr/bin/tor(connection_handle_read+0x990) [0x55d5e9df0500] (on Tor
 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:     /usr/bin/tor(+0x707ee) [0x55d5e9df57ee]
 (on Tor 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:     /usr/lib/x86_64-linux-
 gnu/libevent-2.0.so.5(event_base_loop+0x6a0) [0x7fb82bb5f5a0] (on Tor
 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:     /usr/bin/tor(do_main_loop+0x105)
 [0x55d5e9df6b25] (on Tor 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:     /usr/bin/tor(tor_run_main+0x1225)
 [0x55d5e9de4545] (on Tor 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:     /usr/bin/tor(tor_main+0x3a)
 [0x55d5e9de193a] (on Tor 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:     /usr/bin/tor(main+0x19)
 [0x55d5e9de14b9] (on Tor 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:     /lib/x86_64-linux-
 gnu/libc.so.6(__libc_start_main+0xf1) [0x7fb82a3b32e1] (on Tor 0.4.1.6 )
 Nov 21 00:18:01.000 [err] Bug:     /usr/bin/tor(_start+0x2a)
 [0x55d5e9de150a] (on Tor 0.4.1.6 )
 }}}

 After the relay automatically restarted the log had the following warning:
 {{{
 Nov 21 00:18:07.000 [warn] Incorrect ed25519 signature(s)
 }}}

 Possibly the same as #16423 according to Nick.

 Relay is one of two relays running on a Debian box. Memory and CPU usage
 are normal.

 Odd things about the relay:
 * 1. About a week ago I had log entries (rotated unfortunately) to the
 effect of not being able to apply consensus diffs (wrong hash) and
 eventually "no longer serving directory info to clients"
 * 2. Lately the two relays has seen an upswing in traffic. Sometimes their
 combined BW hits my ISPs ceiling.
 * 3. Over time the memory usages of the relays grows. Initially they are
 around 700MB. Once they use most of the RAM (4GB) I reboot the machine.
 When the assert happened the RAM usage was nowhere near that.
 * 4. I run my home brewed monitoring software that uses "SETEVENT BW" and
 calls "GETINFO orconn-status ns/id/ status/fresh-relay-descs"
 every 10 minutes.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs