From ba9b0319b00692038e5d4aa2eff7cf5d6947e659 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Wed, 29 May 2019 11:25:47 -0400 Subject: [PATCH 1/2] Shutdown libevent _after_ the subsystems. This is necessary since shutting down libevent frees some pointer that the subsystems want to free themselves. A longer term solution will be to turn the evloop module into a subsystem itself, but for now it is best to do the minimal fix. Fixes bug 30629; bugfix on 0.4.1.1-alpha. --- src/app/main/shutdown.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/app/main/shutdown.c b/src/app/main/shutdown.c index e4dcaa1324..cc0091a9ab 100644 --- a/src/app/main/shutdown.c +++ b/src/app/main/shutdown.c @@ -157,10 +157,11 @@ tor_free_all(int postfork) if (!postfork) { release_lockfile(); } - tor_libevent_free_all(); subsystems_shutdown(); + tor_libevent_free_all(); + /* Stuff in util.c and address.c*/ if (!postfork) { esc_router_info(NULL); From 8f3430fc28be9ac16909fd02e0d48aad4ccc128e Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Thu, 30 May 2019 12:58:12 -0400 Subject: [PATCH 2/2] changes file for 30629 --- changes/bug30629 | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 changes/bug30629 diff --git a/changes/bug30629 b/changes/bug30629 new file mode 100644 index 0000000000..59fa96ee68 --- /dev/null +++ b/changes/bug30629 @@ -0,0 +1,6 @@ + o Minor bugfixes (shutdown, libevent, memory safety): + - Avoid use-after-free bugs when shutting down, by making sure that we + shut down libevent only after shutting down all of its users. We + believe these are harmless in practice, since they only occur on the + shutdown path, and do not involve any attacker-controlled data. Fixes + bug 30629; bugfix on 0.4.1.1-alpha.