Skip to content

Race condition in client library causes Snowflake to crash

The Guardian Project sent us a log from a crash they experienced on iOS:

2020-09-25 13:57:47.708095+0200 OnionBrowser[10594:4269818] 2020/09/25 11:57:47 ---- Handler: closed stream 3 ---
2020/09/25 11:57:47 WebRTC: closing DataChannel
2020-09-25 13:57:47.708375+0200 OnionBrowser[10594:4269818] 2020/09/25 11:57:47 WebRTC: closing DataChannel
2020/09/25 11:57:47 WebRTC: closing PeerConnection
2020-09-25 13:57:47.708709+0200 OnionBrowser[10594:4269818] 2020/09/25 11:57:47 WebRTC: closing PeerConnection
panic: send on closed channel

goroutine 32 [running]:
git.torproject.org/pluggable-transports/snowflake.git/client/lib.(*Peers).Collect(0x1301618c0, 0x130481f28, 0x2, 0x0)
	/Users/berhart/workspace/gp/IPtProxy/snowflake/client/lib/peers.go:65 +0x23c
git.torproject.org/pluggable-transports/snowflake.git/client/lib.connectLoop(0x105526be0, 0x1301618c0)
	/Users/berhart/workspace/gp/IPtProxy/snowflake/client/lib/snowflake.go:185 +0x30
created by git.torproject.org/pluggable-transports/snowflake.git/client/lib.Handler
	/Users/berhart/workspace/gp/IPtProxy/snowflake/client/lib/snowflake.go:156 +0xcc
(lldb)

On further investigation, this looks like it's caused by a race condition where p.snowflakeChan is closed before the <-snowflakes.Melted() case is triggered, causing Collect() to attempt a write to p.snowflakeChan after it closes.