common: reintroduce "ignored" primary tag.
What the developer wrote
Authored by Rusty Russell
common: reintroduce "ignored" primary tag.
Prior to 23.05, we used this tag to mark onchain to-self inputs we didn't
wait for (because they were too small). This fixes migration if that happened
(and we are debating whether we should re-introduce this!).
```
lightningd: FATAL SIGNAL 6 (version v25.09rc2)
0x100c8683 send_backtrace
common/daemon.c:33
0x100c876f crashdump
common/daemon.c:78
0x7fffb2080493 ???
???:0
0x7fffb1ab0cac ???
__pthread_kill_implementation+0x1bc:0
0x7fffb1a48a5b ???
__GI_raise+0x2b:0
0x7fffb1a2a3db ???
__GI_abort+0x153:0
0x100935b7 migrate_from_account_db
wallet/account_migration.c:424
0x10093ff7 db_migrate
wallet/db.c:1139
0x10096763 db_setup
wallet/db.c:1185
0x100a1bcb wallet_new
wallet/wallet.c:223
0x1004485f main
lightningd/lightningd.c:1311
0x7fffb1a2aba3 ???
__libc_start_call_main+0x93:0
0x7fffb1a2adeb ???
__libc_start_main_alias_1+0x1ab:0
0xffffffffffffffff ???
???:0
lightningd: Died with signal 6
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Fixes: https://github.com/ElementsProject/lightning/issues/8484
What changed, and why it matters
This commit fixes a crash that could occur when upgrading an older Core Lightning node. If the node had previously marked certain tiny on-chain payments as 'ignored' (a label used before version 23.05), the newer software's database migration code did not recognize that label and would abort startup with a fatal error. The patch re-adds the 'ignored' tag so the migration can complete normally. It is a bug fix for a denial-of-service-on-startup condition, not an exploitable vulnerability that a remote attacker could trigger.
Apply the patch before releasing v25.09. No additional hardening is required beyond restoring the tag; however, consider adding a migration test that exercises all historical coin-movement tags to prevent future regressions when tags are removed.
Security signals we found
Abort/crash during database migration
Reintroduction of previously removed enum/tag to prevent fatal startup failure
No input validation or memory-safety defect; root cause is missing enum case
Evidence from the diff
The patch reintroduces the MVT_IGNORED coin-movement tag (enum value 27) that existed prior to v23.05 but was removed in later code. The account_migration path calls mvt_tag_in_db(), which abort()s on unknown tags. A node whose wallet database contains an on-chain to-self input tagged ‘ignored’ therefore crashes at startup during db_migrate(). The fix adds the tag back to the string table, primary-tag bitmask, enum definition, schema enumerations, and the bookkeeper’s switch statement so migration succeeds. The supplied stack trace confirms an abort inside migrate_from_account_db().
Changed components
wallet/account_migration.ccommon/coin_mvt.ccommon/coin_mvt.hplugins/bkpr/account.cdoc/schemas/listchainmoves.jsoncontrib/msggen/msggen/schema.jsonInspect captured patch +13 / −2
diff --git a/common/coin_mvt.c b/common/coin_mvt.c
index 4a306334..4e9ec871 100644
--- a/common/coin_mvt.c
+++ b/common/coin_mvt.c
@@ -36,6 +36,7 @@ static const char *mvt_tags[] = {
"penalty_adj",
"journal_entry",
"foreign",
+ "ignored",
};
#define PRIMARY_TAG_BITS ((1ULL << MVT_DEPOSIT) | \
@@ -59,7 +60,8 @@ static const char *mvt_tags[] = {
(1ULL << MVT_LEASE_FEE) | \
(1ULL << MVT_PENALTY_ADJ) | \
(1ULL << MVT_JOURNAL) | \
- (1ULL << MVT_CHANNEL_PROPOSED))
+ (1ULL << MVT_CHANNEL_PROPOSED) | \
+ (1ULL << MVT_IGNORED))
static enum mvt_tag mvt_tag_in_db(enum mvt_tag mvt_tag)
{
@@ -145,6 +147,9 @@ static enum mvt_tag mvt_tag_in_db(enum mvt_tag mvt_tag)
case MVT_FOREIGN:
BUILD_ASSERT(MVT_FOREIGN == 26);
return mvt_tag;
+ case MVT_IGNORED:
+ BUILD_ASSERT(MVT_IGNORED == 27);
+ return mvt_tag;
}
abort();
}
diff --git a/common/coin_mvt.h b/common/coin_mvt.h
index 50d3e2b1..e9a41b32 100644
--- a/common/coin_mvt.h
+++ b/common/coin_mvt.h
@@ -40,7 +40,8 @@ enum mvt_tag {
MVT_PENALTY_ADJ = 24,
MVT_JOURNAL = 25,
MVT_FOREIGN = 26,
-#define NUM_MVT_TAGS (MVT_FOREIGN + 1)
+ MVT_IGNORED = 27,
+#define NUM_MVT_TAGS (MVT_IGNORED + 1)
};
struct mvt_tags {
diff --git a/common/test/run-coin_mvt.c b/common/test/run-coin_mvt.c
index 6fbac51c..e7512c08 100644
--- a/common/test/run-coin_mvt.c
+++ b/common/test/run-coin_mvt.c
@@ -186,6 +186,8 @@ static bool mvt_tag_is_primary(enum mvt_tag tag)
return true;
case MVT_FOREIGN:
return false;
+ case MVT_IGNORED:
+ return true;
}
abort();
}
diff --git a/contrib/msggen/msggen/schema.json b/contrib/msggen/msggen/schema.json
index b948a0c3..69c33acf 100644
--- a/contrib/msggen/msggen/schema.json
+++ b/contrib/msggen/msggen/schema.json
@@ -16666,6 +16666,7 @@
"to_them",
"penalized",
"stolen",
+ "ignored",
"to_miner"
],
"description": [
diff --git a/doc/schemas/listchainmoves.json b/doc/schemas/listchainmoves.json
index d718b0b8..985105e9 100644
--- a/doc/schemas/listchainmoves.json
+++ b/doc/schemas/listchainmoves.json
@@ -114,6 +114,7 @@
"to_them",
"penalized",
"stolen",
+ "ignored",
"to_miner"
],
"description": [
diff --git a/plugins/bkpr/account.c b/plugins/bkpr/account.c
index e5001b88..6ff4f01c 100644
--- a/plugins/bkpr/account.c
+++ b/plugins/bkpr/account.c
@@ -218,6 +218,7 @@ void maybe_update_account(struct command *cmd,
case MVT_PENALTY_ADJ:
case MVT_JOURNAL:
case MVT_FOREIGN:
+ case MVT_IGNORED:
/* Ignored */
break;
}
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.