connectd: drop excess gossipd messages.
What the developer wrote
Authored by Rusty Russell
connectd: drop excess gossipd messages.
We haven't seen the "excessive queue length" backtrace since we fixed gossipd,
so it's safe to drop excess messages without worrying about losing gossip.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This change adds a safety valve in Core Lightning's connection handler: if the internal message queue to the gossip subsystem grows beyond 500,000 messages, incoming gossip messages are silently dropped instead of being queued indefinitely. The commit message frames this as a cleanup now that an earlier gossip bug is fixed, but the patch itself is a hardening measure against memory exhaustion from a backed-up queue.
Treat as a defensive hardening commit. Review whether the 500,000 threshold is appropriate for production memory limits, confirm the 250,000 warning is implemented elsewhere or add it, and monitor for any unintended loss of gossip synchronization under heavy load.
Security signals we found
Unbounded queue growth bounded by explicit high-water mark
Potential memory exhaustion / DoS vector mitigated by dropping excess messages
Comment references prior 'excessive queue length' backtrace indicating historical queue pressure
Patch is partial: warning threshold mentioned but not implemented in the visible diff
Evidence from the diff
In connectd/multiplex.c, handle_gossip_in() now checks daemon_conn_queue_length(peer->daemon->gossipd) and returns early if it exceeds 500,000. Previously every incoming gossip message was unconditionally wrapped and queued for gossipd. This caps unbounded queue growth and prevents connectd from accumulating memory when gossipd cannot keep up or stalls. The 250,000/500,000 thresholds are mentioned in a comment but the warning at 250,000 is not implemented in this diff.
Changed components
connectd/multiplex.cdaemon-to-gossipd message queueincoming gossip message forwarding pathInspect captured patch +7 / −1
diff --git a/connectd/multiplex.c b/connectd/multiplex.c
index b95bd751..8740905b 100644
--- a/connectd/multiplex.c
+++ b/connectd/multiplex.c
@@ -742,7 +742,13 @@ static void handle_pong_in(struct peer *peer, const u8 *msg)
/* Forward to gossipd */
static void handle_gossip_in(struct peer *peer, const u8 *msg)
{
- u8 *gmsg = towire_gossipd_recv_gossip(NULL, &peer->id, msg);
+ u8 *gmsg;
+
+ /* We warn at 250000, drop at 500000 */
+ if (daemon_conn_queue_length(peer->daemon->gossipd) > 500000)
+ return;
+
+ gmsg = towire_gossipd_recv_gossip(NULL, &peer->id, msg);
/* gossipd doesn't log IO, so we log it here. */
status_peer_io(LOG_IO_IN, &peer->id, msg);
Why this scored 39/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.