[tor-bugs] #2933 [Tor Client]: Error from libevent: evdns.c:1360: Assertion req != port->pending_replies failed in server_port_flush

[Tor Bug Tracker & Wiki]

#2933: Error from libevent: evdns.c:1360: Assertion req != port->pending_replies
failed in server_port_flush
------------------------+---------------------------------------------------
 Reporter:  mr-4        |          Owner:                     
     Type:  defect      |         Status:  needs_review       
 Priority:  normal      |      Milestone:                     
Component:  Tor Client  |        Version:  Tor: 0.2.2.24-alpha
 Keywords:              |         Parent:                     
   Points:              |   Actualpoints:                     
------------------------+---------------------------------------------------
Changes (by nickm):

  * status:  new => needs_review


Comment:

 Hm.  I'm not currently able to figure out whether this is a Tor bug or a
 libevent bug.  Let's try to deal with it here, though, since this is a
 bugtracker and there's more here already.

 So looking at the code, it's calling the assert because it tries to call
 server_request_free() to remove a request, that request should be removed
 from any evdns_server_port that it's on (that is to say, the current port
 counts).

 So there's some data corruption going on here.  Let's see what it could
 be...

 Okay, this part of server_request_free looks suspicious:
 {{{
                         if (req->next_pending)
                                 req->port->pending_replies =
 req->next_pending;
                         else
                                 req->port->pending_replies = NULL;
 }}}

 pending_replies is a circular list, so req->next_pending should always be
 set if req is on the list.  Instead , the check should probably be
 something like this:
 {{{
                         if (req->next_pending && req->next_pending != req)
                                 req->port->pending_replies =
 req->next_pending;
                         else
                                 req->port->pending_replies = NULL;
 }}}

 I'm attaching a patch to apply to libevent.  With this patch, do you get
 a) no error, b) the same error, c) a different error?

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2933#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online