From 80e3dc47272c9ba423d40ce367fb99d39c3150ec Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Wed, 12 Feb 2020 14:17:19 -0500 Subject: [PATCH 1/2] Use more memory poisoning and better asserts around ewma code Attempt to diagnose 32464; fixes 33290. --- changes/ticket33290 | 4 ++++ src/core/or/circuitmux.c | 8 ++++++-- src/core/or/circuitmux_ewma.c | 11 ++++++++--- 3 files changed, 18 insertions(+), 5 deletions(-) create mode 100644 changes/ticket33290 diff --git a/changes/ticket33290 b/changes/ticket33290 new file mode 100644 index 0000000000..882764020e --- /dev/null +++ b/changes/ticket33290 @@ -0,0 +1,4 @@ + o Minor features (diagnostic): + - Improve assertions and add some memory-poisoning code to try to track + down possible causes of a rare crash (32564) in the EWMA code. + Closes ticket 33290. diff --git a/src/core/or/circuitmux.c b/src/core/or/circuitmux.c index b2628bec3f..72f6ba662b 100644 --- a/src/core/or/circuitmux.c +++ b/src/core/or/circuitmux.c @@ -79,6 +79,8 @@ #include "core/or/destroy_cell_queue_st.h" #include "core/or/or_circuit_st.h" +#include "lib/crypt_ops/crypto_util.h" + /* * Private typedefs for circuitmux.c */ @@ -973,7 +975,10 @@ circuitmux_detach_circuit,(circuitmux_t *cmux, circuit_t *circ)) /* Now remove it from the map */ HT_REMOVE(chanid_circid_muxinfo_map, cmux->chanid_circid_map, hashent); - /* Free the hash entry */ + /* Wipe and free the hash entry */ + // This isn't sensitive, but we want to be sure to know if we're accessing + // this accidentally. + memwipe(hashent, 0xef, sizeof(hashent)); tor_free(hashent); } } @@ -1334,4 +1339,3 @@ circuitmux_compare_muxes, (circuitmux_t *cmux_1, circuitmux_t *cmux_2)) return 0; } } - diff --git a/src/core/or/circuitmux_ewma.c b/src/core/or/circuitmux_ewma.c index 3f83c3fd5a..606b755e28 100644 --- a/src/core/or/circuitmux_ewma.c +++ b/src/core/or/circuitmux_ewma.c @@ -147,7 +147,9 @@ TO_EWMA_POL_DATA(circuitmux_policy_data_t *pol) { if (!pol) return NULL; else { - tor_assert(pol->magic == EWMA_POL_DATA_MAGIC); + tor_assertf(pol->magic == EWMA_POL_DATA_MAGIC, + "Mismatch: %"PRIu32" != %"PRIu32, + pol->magic, EWMA_POL_DATA_MAGIC); return DOWNCAST(ewma_policy_data_t, pol); } } @@ -162,7 +164,9 @@ TO_EWMA_POL_CIRC_DATA(circuitmux_policy_circ_data_t *pol) { if (!pol) return NULL; else { - tor_assert(pol->magic == EWMA_POL_CIRC_DATA_MAGIC); + tor_assertf(pol->magic == EWMA_POL_CIRC_DATA_MAGIC, + "Mismatch: %"PRIu32" != %"PRIu32, + pol->magic, EWMA_POL_CIRC_DATA_MAGIC); return DOWNCAST(ewma_policy_circ_data_t, pol); } } @@ -295,6 +299,7 @@ ewma_free_cmux_data(circuitmux_t *cmux, pol = TO_EWMA_POL_DATA(pol_data); smartlist_free(pol->active_circuit_pqueue); + pol->base_.magic = 0xDEAD901C; tor_free(pol); } @@ -361,7 +366,7 @@ ewma_free_circ_data(circuitmux_t *cmux, if (!pol_circ_data) return; cdata = TO_EWMA_POL_CIRC_DATA(pol_circ_data); - + cdata->base_.magic = 0xDEADC14C; tor_free(cdata); } From fff1054d17c8e869c38d4ca1c68ed74a7e82e393 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Thu, 13 Feb 2020 09:11:35 -0500 Subject: [PATCH 2/2] Before freeing ewma objects, use memwipe instead of resetting magic. --- src/core/or/circuitmux_ewma.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/core/or/circuitmux_ewma.c b/src/core/or/circuitmux_ewma.c index 606b755e28..07f83af0f1 100644 --- a/src/core/or/circuitmux_ewma.c +++ b/src/core/or/circuitmux_ewma.c @@ -38,6 +38,7 @@ #include "core/or/circuitmux.h" #include "core/or/circuitmux_ewma.h" #include "lib/crypt_ops/crypto_rand.h" +#include "lib/crypt_ops/crypto_util.h" #include "feature/nodelist/networkstatus.h" #include "app/config/or_options_st.h" @@ -299,7 +300,7 @@ ewma_free_cmux_data(circuitmux_t *cmux, pol = TO_EWMA_POL_DATA(pol_data); smartlist_free(pol->active_circuit_pqueue); - pol->base_.magic = 0xDEAD901C; + memwipe(pol, 0xda, sizeof(ewma_policy_data_t)); tor_free(pol); } @@ -366,7 +367,7 @@ ewma_free_circ_data(circuitmux_t *cmux, if (!pol_circ_data) return; cdata = TO_EWMA_POL_CIRC_DATA(pol_circ_data); - cdata->base_.magic = 0xDEADC14C; + memwipe(cdata, 0xdc, sizeof(ewma_policy_circ_data_t)); tor_free(cdata); }