GitLab

Hello,

I've been doing various tests to prop271 by using it with tor browser.

I started digging more into circuit_find_circuits_to_upgrade_from_guard_wait() and particularly the circuits_pending_other_guards smartlist to understand better how this feature works in little-t-tor.

While inspecting the elements of circuits_pending_other_guards I noticed that some of those circuits were zombies that were already freed, probably because they were closed but not removed from the smartlist.

The only time we change membership of that list is in circuit_set_state():

 if (circ->state == CIRCUIT_STATE_GUARD_WAIT) {
    smartlist_remove(circuits_pending_other_guards, circ);
  }
  if (state == CIRCUIT_STATE_GUARD_WAIT) {
    smartlist_add(circuits_pending_other_guards, circ);
  }

We should probably consider removing circuits from that list when they marked for close as well, so that the list does not stay permanently populated. Also see how membership in the similar smartlist circuits_pending_chans is maintained.