[tor-bugs] #3367 [Tor Client]: Tor 0.2.3.x segfaults on SIGNAL TERM (was: Tor 0.2.3.x segfaults on exit)

[Tor Bug Tracker & Wiki]

#3367: Tor 0.2.3.x segfaults on SIGNAL TERM
------------------------+---------------------------------------------------
 Reporter:  rransom     |          Owner:  rransom           
     Type:  defect      |         Status:  new               
 Priority:  major       |      Milestone:  Tor: 0.2.3.x-final
Component:  Tor Client  |        Version:                    
 Keywords:              |         Parent:                    
   Points:              |   Actualpoints:                    
------------------------+---------------------------------------------------

Comment(by rransom):

 {{{
 (gdb) bt
 #0  0x0000000000450f65 in flush_buf (s=11, buf=0x0, sz=0,
     buf_flushlen=0x8026d20f0) at buffers.c:828
 #1  0x0000000000476168 in connection_handle_write (conn=0x8026d20c0,
 force=1)
     at connection.c:3257
 #2  0x0000000000487b2b in handle_control_signal (conn=0x8026d20c0,
 len=Variable "len" is not available.
 )
     at control.c:1282
 #3  0x000000000048a69f in connection_control_process_inbuf
 (conn=0x8026d20c0)
     at control.c:3171
 #4  0x000000000047553d in connection_handle_read_cb (bufev=Variable
 "bufev" is not available.
 )
     at connection.c:2955
 #5  0x0000000800ab1a8b in bufferevent_run_deferred_callbacks_locked ()
    from /usr/local/lib/event2/libevent-2.0.so.5
 #6  0x0000000800aaa2c1 in event_base_loop ()
    from /usr/local/lib/event2/libevent-2.0.so.5
 #7  0x0000000000409e33 in do_main_loop () at main.c:1789
 #8  0x000000000040a0c5 in tor_main (argc=3, argv=Variable "argv" is not
 available.
 ) at main.c:2464
 #9  0x0000000000408d0e in _start ()
 }}}

 I ended Tor by sending the `SIGNAL TERM` control-port command, which is
 exactly how Vidalia would have ended my Tor instance on Windows.

 I just sent `SIGNAL TERM` again, with the `SIGNAL` control-port event
 enabled, and Tor segfaulted before my control-port client received the
 `250 OK` response:
 {{{
 signal term
 % Connection to mytorctl closed by foreign host.
 }}}

 As you can see from the backtrace, I configured Tor with `--enable-
 bufferevents`.  This crash occurred on branch
 `git://git.torproject.org/rransom/tor.git loud-hs-serv-pk-operations`
 (closest to commit 9ac2f63e0f3f1fd333b23ee6e6c02ae7cf0f71d2 (‘Unbreak the
 build’) on master).

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3367#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online