Commit b9ff3543 authored by David Goulet's avatar David Goulet 🐼
Browse files

conflux: Fix inflated OOO queue accounting after teardown 



In conflux_free_(), we clear the OOOQ but the total allocation cost was not
decremented (total_ooo_q_bytes).

This lead to the value being over inflated even after teardown which ultimately
craete fake memory pressure on a relay leading to OOM to fire more frequently.

Reported via Hackerone. TROVE-2026-010.

Fixes #41251

Signed-off-by: David Goulet's avatarDavid Goulet <dgoulet@torproject.org>
parent 719da562

src/core/or/conflux.c

+21 −0
Original line number Diff line number Diff line
@@ -198,6 +198,27 @@ conflux_handle_oom(size_t bytes_to_remove) 
  return 0;

}



/** Free all cells in the ooo_q of the given cfx which updates the

 * total_ooo_q_bytes.

 *

 * Must be called before freeing the queue itself. */

void

conflux_clear_ooo_q(conflux_t *cfx)

{

  tor_assert(cfx);

  tor_assert(cfx->ooo_q);



  size_t cost = smartlist_len(cfx->ooo_q) * sizeof(cell_t);

  if (BUG(cost > total_ooo_q_bytes)) {

    total_ooo_q_bytes = 0;

  } else {

    total_ooo_q_bytes -= cost;

  }



  SMARTLIST_FOREACH(cfx->ooo_q, conflux_cell_t *, cell, tor_free(cell));

  smartlist_clear(cfx->ooo_q);

}



/**

 * Returns true if a circuit has package window space to send, and is

 * not blocked locally.

src/core/or/conflux.h

+1 −0
Original line number Diff line number Diff line
@@ -45,6 +45,7 @@ typedef struct { 
size_t conflux_handle_oom(size_t bytes_to_remove);

uint64_t conflux_get_total_bytes_allocation(void);

uint64_t conflux_get_circ_bytes_allocation(const circuit_t *circ);

void conflux_clear_ooo_q(conflux_t *cfx);



void conflux_update_rtt(conflux_t *cfx, circuit_t *circ, uint64_t rtt_usec);

src/core/or/conflux_pool.c

+1 −1
Original line number Diff line number Diff line
@@ -196,7 +196,7 @@ conflux_free_(conflux_t *cfx) 
  } SMARTLIST_FOREACH_END(leg);

  smartlist_free(cfx->legs);



  SMARTLIST_FOREACH(cfx->ooo_q, conflux_cell_t *, cell, tor_free(cell));

  conflux_clear_ooo_q(cfx);

  smartlist_free(cfx->ooo_q);



  memwipe(cfx->nonce, 0, sizeof(cfx->nonce));