Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Tor browser crashes when using bridges #331851

Closed
ClockGen opened this issue Aug 2, 2024 · 6 comments
Closed

Tor browser crashes when using bridges #331851

ClockGen opened this issue Aug 2, 2024 · 6 comments
Labels
0.kind: bug Something is broken

Comments

@ClockGen
Copy link

ClockGen commented Aug 2, 2024

Describe the bug

After a recent nixos-unstable update tor-browser no longer works with bridges enabled.
Even with a clean profile (I deleted ~/.tor browser) it still happens.

When running tor browser with any mode that uses bridges, it immediately crashes upon connecting with this message:

screenshot

Tor log contains the following lines:

[NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
[NOTICE] Opening Socks listener on /run/user/1000/Tor-12/socks.socket
[NOTICE] Opened Socks listener connection (ready) on /run/user/1000/Tor-12/socks.socket
[WARN] Managed proxy "/nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/PluggableTransports/lyrebird" process terminated with status code 139
[ERR] tor_assertion_failed_(): Bug: src/feature/client/transports.c:519: proxy_prepare_for_restart: Assertion mp->conf_state == PT_PROTO_COMPLETED failed; aborting. (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug: Tor 0.4.8.12 (git-2beaa7557c3c93ec): Assertion mp->conf_state == PT_PROTO_COMPLETED failed in proxy_prepare_for_restart at src/feature/client/transports.c:519: . Stack trace: (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/tor(log_backtrace_impl+0x57) [0x55eb138e5dc7] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/tor(tor_assertion_failed_+0x148) [0x55eb138f0de8] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/tor(+0xc37d2) [0x55eb138c37d2] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/tor(+0xc5117) [0x55eb138c5117] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/tor(process_notify_event_exit+0x4b) [0x55eb138faa8b] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/tor(notify_pending_waitpid_callbacks+0xe9) [0x55eb138fc419] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/libevent-2.1.so.7(+0x1fcda) [0x7f103301fcda] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/libevent-2.1.so.7(event_base_loop+0x4d7) [0x7f10330204f7] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/tor(do_main_loop+0xdd) [0x55eb1386c6ed] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/tor(tor_run_main+0x1d5) [0x55eb13867fe5] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/tor(tor_main+0x49) [0x55eb138643f9] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/tor(main+0x19) [0x55eb13863fd9] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/0wydilnf1c9vznywsvxqnaing4wraaxp-glibc-2.39-52/lib/libc.so.6(+0x2a14e) [0x7f103341814e] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/0wydilnf1c9vznywsvxqnaing4wraaxp-glibc-2.39-52/lib/libc.so.6(__libc_start_main+0x89) [0x7f1033418209] (on Tor 0.4.8.12 2beaa7557c3c93ec)
[ERR] Bug:     /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/tor(_start+0x2a) [0x55eb1386402a] (on Tor 0.4.8.12 2beaa7557c3c93ec)

Standalone version of tor-browser works fine. Older built version from unstable channel (approximately a week ago) also works fine.

Investigating further, I see that pluggable transport executable, packaged with tor-browser, crashes. I tried running it manually (by just executing /nix/store/v14f72p99w227ysvx14b1wrkdcc53fxp-tor-browser-13.5.1/share/tor-browser/TorBrowser/Tor/PluggableTransports/lyrebird without any arguments), which instantly crashes on launch:

fish: Job 1, './lyrebird' terminated by signal SIGSEGV (Address boundary error)

That also happens to the other two PTs available.

Note that this happens even in a clean nixos installation in a VM.

To make sure, I tested tor-browser from my older, working nixos build:

[ERROR]: lyrebird - must be run as a managed transport

The executable didn't crash and launched correctly.

Steps To Reproduce

Steps to reproduce the behavior:

  1. Launch tor-browser
  2. Enable bridges by either using "select a built-in bridge" or "Add new bridges"
  3. Try to connect

Expected behavior

Tor-browser working with bridges.

Notify maintainers

@felschr
@panicgh
@joachifm
@hax404

Metadata

Please run nix-shell -p nix-info --run "nix-info -m" and paste the result.

 - system: `"x86_64-linux"`
 - host os: `Linux 6.9.12, NixOS, 24.11 (Vicuna), 24.11pre660624.9f918d616c53`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.18.5`
 - channels(root): `"nixos"`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixos`

Add a 👍 reaction to issues you find important.
@ClockGen ClockGen added the 0.kind: bug Something is broken label Aug 2, 2024
@jcumming
Copy link
Contributor

jcumming commented Aug 3, 2024

Kernel reports segfault:

[25487.804539] lyrebird[36436]: segfault at 4002e0 ip 00007fd05b15f8e8 sp 00007ffc977d2090 error 7 in ld-linux-x86-64.so.2[7fd05b141000+28000] likely on CPU 7 (core 3, socket 0)
[25487.804548] Code: ff 00 00 00 00 0f 85 48 07 00 00 e8 72 26 ff ff 48 89 85 60 fd ff ff 48 8b 85 98 fd ff ff 48 8b 80 e8 00 00 00 48 85 c0 74 04 <4c> 89 70 08 41 c7 46 18 01 00 00 00 e8 97 2d fe ff 48 8b bd 98 fd

@felschr
Copy link
Member

felschr commented Aug 11, 2024

Can you check if it's still an issue with 13.5.2? I at least can't reproduce it on that version.

@jcumming
Copy link
Contributor

Still crashes when bridges are enabled for me. Works without bridges though.

2024-08-11 16:56:28.417 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2024-08-11 16:56:31.218 [NOTICE] Opening Socks listener on /run/user/1000/Tor/socks.socket
2024-08-11 16:56:31.218 [NOTICE] Opened Socks listener connection (ready) on /run/user/1000/Tor/socks.socket
2024-08-11 16:56:31.349 [WARN] Managed proxy "/nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/PluggableTransports/lyrebird" process terminated with status code 139
2024-08-11 16:56:31.349 [ERR] tor_assertion_failed_(): Bug: src/feature/client/transports.c:519: proxy_prepare_for_restart: Assertion mp->conf_state == PT_PROTO_COMPLETED failed; aborting. (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.350 [ERR] Bug: Tor 0.4.8.12 (git-2beaa7557c3c93ec): Assertion mp->conf_state == PT_PROTO_COMPLETED failed in proxy_prepare_for_restart at src/feature/client/transports.c:519: . Stack trace: (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.350 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/tor(log_backtrace_impl+0x57) [0x559069ce5dc7] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.350 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/tor(tor_assertion_failed_+0x148) [0x559069cf0de8] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.350 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/tor(+0xc37d2) [0x559069cc37d2] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.350 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/tor(+0xc5117) [0x559069cc5117] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.350 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/tor(process_notify_event_exit+0x4b) [0x559069cfaa8b] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.350 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/tor(notify_pending_waitpid_callbacks+0xe9) [0x559069cfc419] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.351 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/libevent-2.1.so.7(+0x1fcda) [0x7f47d741fcda] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.351 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/libevent-2.1.so.7(event_base_loop+0x4d7) [0x7f47d74204f7] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.351 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/tor(do_main_loop+0xdd) [0x559069c6c6ed] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.351 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/tor(tor_run_main+0x1d5) [0x559069c67fe5] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.351 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/tor(tor_main+0x49) [0x559069c643f9] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.351 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/tor(main+0x19) [0x559069c63fd9] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.351 [ERR] Bug:     /nix/store/0wydilnf1c9vznywsvxqnaing4wraaxp-glibc-2.39-52/lib/libc.so.6(+0x2a14e) [0x7f47d663314e] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.351 [ERR] Bug:     /nix/store/0wydilnf1c9vznywsvxqnaing4wraaxp-glibc-2.39-52/lib/libc.so.6(__libc_start_main+0x89) [0x7f47d6633209] (on Tor 0.4.8.12 2beaa7557c3c93ec)
2024-08-11 16:56:31.351 [ERR] Bug:     /nix/store/6r8hg9w0xa38n60yxfwfd6q9nf29nxm4-tor-browser-13.5.2/share/tor-browser/TorBrowser/Tor/tor(_start+0x2a) [0x559069c6402a] (on Tor 0.4.8.12 2beaa7557c3c93ec)

@jcumming
Copy link
Contributor

Kinda looks like this assertion firing:

https://gitlab.torproject.org/tpo/core/tor/-/issues/40895

@felschr
Copy link
Member

felschr commented Aug 11, 2024

Can you check if it's still an issue with 13.5.2? I at least can't reproduce it on that version.

Oh, I was testing on 24.05. On nixos-unstable I can reproduce the issue.

I'm not really familiar with debugging segfaults, here is valgrind's output:

❯ valgrind result/share/tor-browser/TorBrowser/Tor/PluggableTransports/lyrebird
==275863== Memcheck, a memory error detector
==275863== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==275863== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info
==275863== Command: result/share/tor-browser/TorBrowser/Tor/PluggableTransports/lyrebird
==275863==
==275863==
==275863== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==275863==  Bad permissions for mapped region at address 0x4002E0
==275863==    at 0x401F8E8: dl_main (in /nix/store/0wydilnf1c9vznywsvxqnaing4wraaxp-glibc-2.39-52/lib/ld-linux-x86-64.so.2)
==275863==    by 0x401C4A2: _dl_sysdep_start (in /nix/store/0wydilnf1c9vznywsvxqnaing4wraaxp-glibc-2.39-52/lib/ld-linux-x86-64.so.2)
==275863==    by 0x401DD1D: _dl_start (in /nix/store/0wydilnf1c9vznywsvxqnaing4wraaxp-glibc-2.39-52/lib/ld-linux-x86-64.so.2)
==275863==    by 0x401CAB7: ??? (in /nix/store/0wydilnf1c9vznywsvxqnaing4wraaxp-glibc-2.39-52/lib/ld-linux-x86-64.so.2)
==275863==
==275863== HEAP SUMMARY:
==275863==     in use at exit: 0 bytes in 0 blocks
==275863==   total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==275863==
==275863== All heap blocks were freed -- no leaks are possible
==275863==
==275863== For lists of detected and suppressed errors, rerun with: -s
==275863== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
zsh: segmentation fault (core dumped)  valgrind result/share/tor-browser/TorBrowser/Tor/PluggableTransports/lyrebird

@danjujan
Copy link
Contributor

danjujan commented Aug 27, 2024 •
edited
Loading

I bisected this to 80be926 using this little reproducer.

#!/usr/bin/env bash
nix shell -I nixpkgs=. .#tor-browser -c bash -c '$(''dirname $(which tor-browser)'')/../share/tor-browser/TorBrowser/Tor/PluggableTransports/lyrebird --help || false'

#332617 seems to fix this.

@felschr felschr closed this as completed Sep 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
0.kind: bug Something is broken
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@jcumming @felschr @ClockGen @danjujan