bkpr: limp along if we lost our db.
What the developer wrote
Authored by Rusty Russell
bkpr: limp along if we lost our db.
We can't really do decent bookkeeping any more, but don't crash!
```
bookkeeper: plugins/bkpr/recorder.c:178: find_txo_chain: Assertion `acct->open_event_db_id' failed.
bookkeeper: FATAL SIGNAL 6 (version v25.12)
0xaaaab7d51a7f send_backtrace
common/daemon.c:38
0xaaaab7d51b2b crashdump
common/daemon.c:83
0xffff8c0b07cf ???
???:0
0xffff8bdf7608 __pthread_kill_implementation
./nptl/pthread_kill.c:44
0xffff8bdacb3b __GI_raise
../sysdeps/posix/raise.c:26
0xffff8bd97dff __GI_abort
./stdlib/abort.c:79
0xffff8bda5cbf __assert_fail_base
./assert/assert.c:96
0xffff8bda5d2f __assert_fail
./assert/assert.c:105
0xaaaab7d41fd7 find_txo_chain
plugins/bkpr/recorder.c:178
0xaaaab7d421fb account_onchain_closeheight
plugins/bkpr/recorder.c:291
0xaaaab7d37687 do_account_close_checks
plugins/bkpr/bookkeeper.c:884
0xaaaab7d38203 parse_and_log_chain_move
plugins/bkpr/bookkeeper.c:1261
0xaaaab7d3871f listchainmoves_done
plugins/bkpr/bookkeeper.c:171
0xaaaab7d4811f handle_rpc_reply
plugins/libplugin.c:1073
0xaaaab7d4827b rpc_conn_read_response
plugins/libplugin.c:1377
0xaaaab7d889a7 next_plan
ccan/ccan/io/io.c:60
0xaaaab7d88f7b do_plan
ccan/ccan/io/io.c:422
0xaaaab7d89053 io_ready
ccan/ccan/io/io.c:439
```
Fixes: https://github.com/ElementsProject/lightning/issues/8854
Changelog-Fixed: Plugins: `bkpr_listbalances` no longer crashes if we lost our db, then do emergencyrecover and close a channel.
Reported-by: https://github.com/enaples
What changed, and why it matters
This commit fixes a crash in Core Lightning's bookkeeper plugin. After a user loses their main database and runs emergency recovery, then closes a channel, the bookkeeper plugin would hit an internal assertion and crash the whole node. The fix makes the plugin log a warning and continue running instead of crashing.
Apply the patch. Users who have run emergencyrecover and then close channels should upgrade to avoid bookkeeper crashes. No immediate remote exploitability, but the crash is disruptive.
Security signals we found
Denial-of-service condition triggered by missing database state after recovery
Assertion failure in plugin leading to fatal signal and node crash
Fix removes assert() on nullable pointer and adds graceful degradation
Evidence from the diff
In plugins/bkpr/recorder.c, find_txo_chain() asserted that acct->open_event_db_id was non-NULL. After emergencyrecover, the bookkeeper database can be missing the original account open event, making this pointer NULL and triggering SIGABRT. The patch replaces the assertion with a NULL check that logs a BROKEN-level message and returns false, allowing the plugin to limp along. A previously expected-to-fail test is now enabled and updated to accept the new log message.
Changed components
plugins/bkpr/recorder.cbookkeeper pluginbkpr_listbalances RPC pathInspect captured patch +9 / −3
diff --git a/plugins/bkpr/recorder.c b/plugins/bkpr/recorder.c
index 82c3498c..4b5170f6 100644
--- a/plugins/bkpr/recorder.c
+++ b/plugins/bkpr/recorder.c
@@ -175,7 +175,14 @@ bool find_txo_chain(const tal_t *ctx,
bool is_complete = true;
const char *start_acct_name;
- assert(acct->open_event_db_id);
+ /* If we have lost our database and used recovery, this can be
+ * NULL. That's the least of our problems though! */
+ if (!acct->open_event_db_id) {
+ plugin_log(cmd->plugin, LOG_BROKEN,
+ "Cannot find the open_event for %s: did we lose our db?",
+ acct->name);
+ return false;
+ }
open_ev = find_chain_event_by_id(ctx, bkpr, cmd,
*acct->open_event_db_id);
diff --git a/tests/test_misc.py b/tests/test_misc.py
index c2e4f0ec..9e5416fd 100644
--- a/tests/test_misc.py
+++ b/tests/test_misc.py
@@ -3136,13 +3136,12 @@ def test_emergencyrecoverpenaltytxn(node_factory, bitcoind):
@unittest.skipIf(os.getenv('TEST_DB_PROVIDER', 'sqlite3') != 'sqlite3', "deletes database, which is assumed sqlite3")
-@pytest.mark.xfail(strict=True)
def test_emergencyrecover(node_factory, bitcoind):
"""
Test emergencyrecover
"""
l1, l2 = node_factory.get_nodes(2, opts=[{'may_reconnect': True,
- 'broken_log': 'ERROR: Unknown commitment #.*, recovering our funds'},
+ 'broken_log': 'ERROR: Unknown commitment #.*, recovering our funds|plugin-bookkeeper: Cannot find the open_event for '},
{'may_reconnect': True}])
l1.rpc.connect(l2.info['id'], 'localhost', l2.port)
Why this scored 44/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.