From f516c9ca99e4c3ef1bfeb3693e622befdd7954d2 Mon Sep 17 00:00:00 2001
From: cypherpunks <cypherpunks@torproject.org>
Date: Tue, 21 Jun 2016 13:03:38 +0000
Subject: [PATCH 1/3] Use the return value for choosing intervals

---
 src/or/main.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/or/main.c b/src/or/main.c
index 5fa3869ff8..41167408cb 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -2071,14 +2071,19 @@ heartbeat_callback(time_t now, const or_options_t *options)
     return PERIODIC_EVENT_NO_UPDATE;
   }
 
-  /* Write the heartbeat message */
+  /* Skip the first one. */
   if (first) {
-    first = 0; /* Skip the first one. */
-  } else {
-    log_heartbeat(now);
+    first = 0;
+    return options->HeartbeatPeriod;
   }
 
-  return options->HeartbeatPeriod;
+  /* Write the heartbeat message */
+  int r = log_heartbeat(now);
+  if (r == 0) {
+    return options->HeartbeatPeriod;
+  }
+
+  return PERIODIC_EVENT_NO_UPDATE;
 }
 
 #define CDM_CLEAN_CALLBACK_INTERVAL 600

From 9de12397cf4882e83f199616d52ec9c90e0d6d8e Mon Sep 17 00:00:00 2001
From: Isis Lovecruft <isis@torproject.org>
Date: Wed, 12 Jul 2017 02:40:24 +0000
Subject: [PATCH 2/3] If writing a heartbeat message fails, retry after
 MIN_HEARTBEAT_PERIOD.

 * FIXES #19476.
---
 src/or/config.c |  4 ----
 src/or/config.h |  4 ++++
 src/or/main.c   | 12 ++++++++----
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/src/or/config.c b/src/or/config.c
index 5b5bb9049b..5da871d1e2 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -2804,10 +2804,6 @@ compute_publishserverdescriptor(or_options_t *options)
  * will generate too many circuits and potentially overload the network. */
 #define MIN_CIRCUIT_STREAM_TIMEOUT 10
 
-/** Lowest allowable value for HeartbeatPeriod; if this is too low, we might
- * expose more information than we're comfortable with. */
-#define MIN_HEARTBEAT_PERIOD (30*60)
-
 /** Lowest recommended value for CircuitBuildTimeout; if it is set too low
  * and LearnCircuitBuildTimeout is off, the failure rate for circuit
  * construction may be very high.  In that case, if it is set below this
diff --git a/src/or/config.h b/src/or/config.h
index 27aec7fe3d..3cfa7c4e5b 100644
--- a/src/or/config.h
+++ b/src/or/config.h
@@ -18,6 +18,10 @@
 #define KERNEL_MAY_SUPPORT_IPFW
 #endif
 
+/** Lowest allowable value for HeartbeatPeriod; if this is too low, we might
+ * expose more information than we're comfortable with. */
+#define MIN_HEARTBEAT_PERIOD (30*60)
+
 MOCK_DECL(const char*, get_dirportfrontpage, (void));
 MOCK_DECL(const or_options_t *, get_options, (void));
 MOCK_DECL(or_options_t *, get_options_mutable, (void));
diff --git a/src/or/main.c b/src/or/main.c
index 41167408cb..f7b9cc8a1c 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -2060,6 +2060,9 @@ check_fw_helper_app_callback(time_t now, const or_options_t *options)
 
 /**
  * Periodic callback: write the heartbeat message in the logs.
+ *
+ * If writing the heartbeat message to the logs fails for some reason, retry
+ * again after <b>MIN_HEARTBEAT_PERIOD</b> seconds.
  */
 static int
 heartbeat_callback(time_t now, const or_options_t *options)
@@ -2078,12 +2081,13 @@ heartbeat_callback(time_t now, const or_options_t *options)
   }
 
   /* Write the heartbeat message */
-  int r = log_heartbeat(now);
-  if (r == 0) {
+  if (log_heartbeat(now) == 0) {
     return options->HeartbeatPeriod;
+  } else {
+    /* If we couldn't write the heartbeat log message, try again in the minimum
+     * interval of time. */
+    return MIN_HEARTBEAT_PERIOD;
   }
-
-  return PERIODIC_EVENT_NO_UPDATE;
 }
 
 #define CDM_CLEAN_CALLBACK_INTERVAL 600

From 175451d032026f1e1cbf45dfa55a408d5d4abeed Mon Sep 17 00:00:00 2001
From: Isis Lovecruft <isis@torproject.org>
Date: Wed, 12 Jul 2017 02:47:43 +0000
Subject: [PATCH 3/3] Add changes file for #19476.

---
 changes/bug19476 | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 changes/bug19476

diff --git a/changes/bug19476 b/changes/bug19476
new file mode 100644
index 0000000000..25a0578686
--- /dev/null
+++ b/changes/bug19476
@@ -0,0 +1,3 @@
+ o Minor changes:
+   - If we fail to write a heartbeat message, schedule a retry for the minimum
+     heartbeat interval number of seconds in the future. Fixes bug 19476.