[tor-bugs] #6029 [Tor Relay]: relay crash in libcrypto (tor_tls_handshake)

[Tor Bug Tracker & Wiki]

#6029: relay crash in libcrypto (tor_tls_handshake)
-----------------------+----------------------------------------------------
 Reporter:  ln5        |          Owner:                     
     Type:  defect     |         Status:  new                
 Priority:  major      |      Milestone:  Tor: 0.2.3.x-final 
Component:  Tor Relay  |        Version:  Tor: 0.2.3.15-alpha
 Keywords:             |         Parent:                     
   Points:             |   Actualpoints:                     
-----------------------+----------------------------------------------------

Comment(by ln5):

 Replying to [comment:2 nickm]:
 > If the crash isn't always in the same place, I'd suspect a memory
 corruption issue.

 Forgot to mention that.

 First two crashes, before rebuilding with symbols and w/o gcc hardening
 options:

 May 31 04:24:44 tor kernel: [9547180.260104] tor[32318]: segfault at
 7f328fff8000 ip 00007f32b876e5d8 sp 00007fffd3eaac60 error 4 in
 libcrypto.so.1.0.0[7f32b86f8000+1b2000]
 Jun  1 02:24:13 tor kernel: [9626147.616888] tor[20728]: segfault at
 7fc521325000 ip 00007fc53f4fd5dd sp 00007fffc4c89130 error 4 in
 libcrypto.so.1.0.0[7fc53f487000+1b2000]

 Same offset in libcrypto.so.


 In the last crash, I unfortunately don't know where libcrypto was
 loaded (when running tor in gdb).  Strangely enough, nm -g
 libcrypto.so shows nothing with a higher offset than '0000000000179320
 R RSA_version'.  I don't understand this.

 I will 'continue' in gdb after the next crash and hopefully get the
 kernel segfault printout.


 I just realised that this machine is a bit unhappy about something
 related to TCP.  The kernel said

     WARNING: at /build/buildd/linux-2.6.32/net/ipv4/tcp_input.c:2919
 tcp_fastretrans_alert+0x3f9/0xd90()

 yesterday (not at the time of a tor crash).  Maybe I should i) check
 RAM and ii) benchmark TCP throughput excluding tor before we spend
 more time on this.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/6029#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online