From 33df09ce6b7ee3563c8a979045add160049169cd Mon Sep 17 00:00:00 2001
From: Waldemar Zimpel <w.zimpel@dev.utilizer.de>
Date: Tue, 8 Jul 2025 20:52:49 +0200
Subject: [PATCH] Fix: "Bug: Duplicate call to circuit_mark_for_close()"

Second attempt

Closes issues #41106, #40951
---
 changes/bug41106      |  5 +++++
 src/core/or/command.c |  5 +++--
 src/core/or/relay.c   | 28 ++++++++--------------------
 3 files changed, 16 insertions(+), 22 deletions(-)
 create mode 100644 changes/bug41106

diff --git a/changes/bug41106 b/changes/bug41106
new file mode 100644
index 0000000000..ec789d4d14
--- /dev/null
+++ b/changes/bug41106
@@ -0,0 +1,5 @@
+  o Minor bugfixes (circuit handling):
+    - Prevent circuit_mark_for_close() from
+      being called twice on the same circuit.
+      Second fix attempt
+      Fixes bug 41106; bugfix on 0.4.8.17
diff --git a/src/core/or/command.c b/src/core/or/command.c
index 6e85311c86..4caa0fc437 100644
--- a/src/core/or/command.c
+++ b/src/core/or/command.c
@@ -476,7 +476,7 @@ command_process_relay_cell(cell_t *cell, channel_t *chan)
 {
   const or_options_t *options = get_options();
   circuit_t *circ;
-  int direction;
+  int direction, reason;
   uint32_t orig_delivered_bw = 0;
   uint32_t orig_overhead_bw = 0;
 
@@ -566,7 +566,7 @@ command_process_relay_cell(cell_t *cell, channel_t *chan)
     }
   }
 
-  if (circuit_receive_relay_cell(cell, circ, direction) < 0) {
+  if ((reason = circuit_receive_relay_cell(cell, circ, direction)) < 0) {
     log_fn(LOG_DEBUG,LD_PROTOCOL,"circuit_receive_relay_cell "
            "(%s) failed. Closing.",
            direction==CELL_DIRECTION_OUT?"forward":"backward");
@@ -574,6 +574,7 @@ command_process_relay_cell(cell_t *cell, channel_t *chan)
     if (CIRCUIT_IS_ORIGIN(circ)) {
       control_event_circ_bandwidth_used_for_circ(TO_ORIGIN_CIRCUIT(circ));
     }
+    circuit_mark_for_close(circ, -reason);
   }
 
   if (CIRCUIT_IS_ORIGIN(circ)) {
diff --git a/src/core/or/relay.c b/src/core/or/relay.c
index a6321f180f..af8c72abab 100644
--- a/src/core/or/relay.c
+++ b/src/core/or/relay.c
@@ -227,9 +227,6 @@ circuit_update_channel_usage(circuit_t *circ, cell_t *cell)
  *  - If not recognized, then we need to relay it: append it to the appropriate
  *    cell_queue on <b>circ</b>.
  *
- * If a reason exists to close <b>circ</b>, circuit_mark_for_close()
- * is called in this function, so the caller doesn't have to do it.
- *
  * Return -<b>reason</b> on failure, else 0.
  */
 int
@@ -252,8 +249,7 @@ circuit_receive_relay_cell(cell_t *cell, circuit_t *circ,
       < 0) {
     log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
            "relay crypt failed. Dropping connection.");
-    reason = -END_CIRC_REASON_INTERNAL;
-    goto error;
+    return -END_CIRC_REASON_INTERNAL;
   }
 
   circuit_update_channel_usage(circ, cell);
@@ -284,7 +280,7 @@ circuit_receive_relay_cell(cell_t *cell, circuit_t *circ,
         log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
                "connection_edge_process_relay_cell (away from origin) "
                "failed.");
-        goto error;
+        return reason;
       }
     } else if (cell_direction == CELL_DIRECTION_IN) {
       ++stats_n_relay_cells_delivered;
@@ -299,7 +295,7 @@ circuit_receive_relay_cell(cell_t *cell, circuit_t *circ,
           log_warn(LD_OR,
                    "connection_edge_process_relay_cell (at origin) failed.");
         }
-        goto error;
+        return reason;
       }
     }
     return 0;
@@ -322,8 +318,7 @@ circuit_receive_relay_cell(cell_t *cell, circuit_t *circ,
      * XXX: Shouldn't they always die? */
     if (circ->purpose == CIRCUIT_PURPOSE_PATH_BIAS_TESTING) {
       TO_ORIGIN_CIRCUIT(circ)->path_state = PATH_STATE_USE_FAILED;
-      reason = -END_CIRC_REASON_TORPROTOCOL;
-      goto error;
+      return -END_CIRC_REASON_TORPROTOCOL;
     } else {
       return 0;
     }
@@ -343,14 +338,13 @@ circuit_receive_relay_cell(cell_t *cell, circuit_t *circ,
                                                CELL_DIRECTION_IN)) < 0) {
         log_warn(LD_REND, "Error relaying cell across rendezvous; closing "
                  "circuits");
-        goto error;
+        return reason;
       }
       return 0;
     }
     if (BUG(CIRCUIT_IS_ORIGIN(circ))) {
       /* Should be impossible at this point. */
-      reason = -END_CIRC_REASON_TORPROTOCOL;
-      goto error;
+      return -END_CIRC_REASON_TORPROTOCOL;
     }
     or_circuit_t *or_circ = TO_OR_CIRCUIT(circ);
     if (++or_circ->n_cells_discarded_at_end == 1) {
@@ -359,8 +353,7 @@ circuit_receive_relay_cell(cell_t *cell, circuit_t *circ,
              "Didn't recognize a cell, but circ stops here! Closing circuit. "
              "It was created %ld seconds ago.", (long)seconds_open);
     }
-    reason = -END_CIRC_REASON_TORPROTOCOL;
-    goto error;
+    return -END_CIRC_REASON_TORPROTOCOL;
   }
 
   log_debug(LD_OR,"Passing on unrecognized cell.");
@@ -370,14 +363,9 @@ circuit_receive_relay_cell(cell_t *cell, circuit_t *circ,
                                   * the cells. */
 
   if (append_cell_to_circuit_queue(circ, chan, cell, cell_direction, 0) < 0) {
-    reason = -END_CIRC_REASON_RESOURCELIMIT;
-    goto error;
+    return -END_CIRC_REASON_RESOURCELIMIT;
   }
   return 0;
-
-error:
-  circuit_mark_for_close(circ, -reason);
-  return reason;
 }
 
 /** Package a relay cell from an edge:
-- 
2.47.2