lightningd: fix crash in channel_control.
What the developer wrote
Authored by Rusty Russell
lightningd: fix crash in channel_control.
I got a NULL deref on `infcopy->remote_funding = *inflight->funding->splice_remote_funding`
at once point in testing, so this should prevent that from happening,
yet still allow us to catch it in CI if it happens again.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit fixes a programming bug where Core Lightning could crash because it tried to use a missing piece of data (a NULL pointer) when preparing information about an in-progress channel funding transaction. The fix adds a safety check: if the expected data is missing, it logs a backtrace for debugging and skips that entry instead of crashing. The crash appears to have been triggered during internal testing of a newer feature (splicing), and the patch is defensive rather than a complete fix for why the data might be missing.
Treat as a stability bug fix rather than a security vulnerability. Review whether splice_remote_funding being NULL indicates an inconsistent channel state that should be rejected earlier or logged at higher severity. Monitor CI backtraces to identify the root cause.
Security signals we found
NULL pointer dereference crash fixed
Defensive guard added around pointer dereference
Backtrace logging added for missing expected state
Splicing-related code path affected
Crash observed in testing, not reported as exploitable
Evidence from the diff
In peer_start_channeld(), the code iterates over channel inflights and copies inflight->funding->splice_remote_funding without checking whether it is non-NULL. The commit adds a NULL guard: if splice_remote_funding is absent, it calls send_backtrace() and continues. This prevents a NULL pointer dereference crash. The commit message notes the crash was observed during testing and that the backtrace is intended to help catch the condition in CI. The patch is partial because it does not address the root cause of why splice_remote_funding may be NULL.
Changed components
lightningd/channel_control.cpeer_start_channeld()channel inflight / splice funding handlingInspect captured patch +6 / −0
diff --git a/lightningd/channel_control.c b/lightningd/channel_control.c
index fd41ac47..d82b1909 100644
--- a/lightningd/channel_control.c
+++ b/lightningd/channel_control.c
@@ -3,6 +3,7 @@
#include <ccan/cast/cast.h>
#include <ccan/tal/str/str.h>
#include <channeld/channeld_wiregen.h>
+#include <common/daemon.h>
#include <common/json_command.h>
#include <common/psbt_open.h>
#include <common/shutdown_scriptpubkey.h>
@@ -1818,6 +1819,11 @@ bool peer_start_channeld(struct channel *channel,
if (inflight->splice_locked_memonly)
continue;
+ if (!inflight->funding->splice_remote_funding) {
+ send_backtrace("Inflight has no splice_remote_funding?!");
+ continue;
+ }
+
infcopy = tal(inflights, struct inflight);
infcopy->remote_funding = *inflight->funding->splice_remote_funding;
Why this scored 30/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.