bkpr: send a backtrace if we get a fatal db event.
What the developer wrote
Authored by Rusty Russell
bkpr: send a backtrace if we get a fatal db event.
Particularly useful if we do something outside a transaction if I mess
up the code, e.g:
```
bookkeeper: Attempting to prepare a db_stmt outside of a transaction: plugins/bkpr/recorder.c:591 (version v25.05-112-g4daf355-modded)
0x5caefda2414b send_backtrace
common/daemon.c:33
0x5caefda08a30 db_error
plugins/bkpr/db.c:133
0x5caefda4cb32 db_fatal
db/utils.c:322
0x5caefda4cc9e db_prepare_v2_
db/utils.c:103
0x5caefda0dcbe get_chain_events_by_id
plugins/bkpr/recorder.c:591
0x5caefda063ce json_edit_desc_payment_id
plugins/bkpr/bookkeeper.c:550
0x5caefda13ad3 ld_command_handle
plugins/libplugin.c:2185
0x5caefda13d27 ld_read_json_one
plugins/libplugin.c:2274
0x5caefda13dba ld_read_json
plugins/libplugin.c:2294
0x5caefdab5478 next_plan
ccan/ccan/io/io.c:60
0x5caefdab5949 do_plan
ccan/ccan/io/io.c:422
0x5caefdab5a06 io_ready
ccan/ccan/io/io.c:439
0x5caefdab7375 io_loop
ccan/ccan/io/poll.c:455
0x5caefda1420c plugin_main
plugins/libplugin.c:2507
0x5caefda07762 main
plugins/bkpr/bookkeeper.c:2048
0x79a7c522a1c9 __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
0x79a7c522a28a __libc_start_main_impl
../csu/libc-start.c:360
0x5caefda00374 ???
???:0
0xffffffffffffffff ???
???:0
Attempting to prepare a db_stmt outside of a transaction: plugins/bkpr/recorder.c:591
```
What changed, and why it matters
This change only adds a diagnostic backtrace printout when the bookkeeper plugin hits a fatal database error. It does not fix a vulnerability or change any security boundary; it is a debugging aid for developers.
No security action required; treat as normal diagnostic improvement. Continue to monitor the underlying fatal db event causes separately if they indicate bugs.
Security signals we found
fatal-error path now emits a backtrace before terminating
no change to transaction semantics, authorization, or input validation
no memory-safety, cryptographic, or network-security changes
Evidence from the diff
The commit modifies plugins/bkpr/db.c so that the db_error handler, on fatal errors, calls send_backtrace(msg) before invoking plugin_err. It also adds matching stubs in two unit-test files. The change is purely observability/diagnostics and does not alter transaction handling, error handling outcome, or any trust assumption.
Changed components
plugins/bkpr/db.cplugins/bkpr/test/run-bkpr_db.cplugins/bkpr/test/run-recorder.cInspect captured patch +13 / −2
diff --git a/plugins/bkpr/db.c b/plugins/bkpr/db.c
index cee68bef..48b9fe67 100644
--- a/plugins/bkpr/db.c
+++ b/plugins/bkpr/db.c
@@ -1,5 +1,7 @@
#include "config.h"
#include <ccan/array_size/array_size.h>
+#include <ccan/tal/str/str.h>
+#include <common/daemon.h>
#include <db/bindings.h>
#include <db/common.h>
#include <db/exec.h>
@@ -148,8 +150,11 @@ static bool db_migrate(struct plugin *p, struct db *db)
static void db_error(struct plugin *plugin, bool fatal, const char *fmt, va_list ap)
{
- if (fatal)
- plugin_errv(plugin, fmt, ap);
+ if (fatal) {
+ const char *msg = tal_vfmt(tmpctx, fmt, ap);
+ send_backtrace(msg);
+ plugin_err(plugin, "%s", msg);
+ }
else
plugin_logv(plugin, LOG_BROKEN, fmt, ap);
}
diff --git a/plugins/bkpr/test/run-bkpr_db.c b/plugins/bkpr/test/run-bkpr_db.c
index 46c3b4c9..e2ef6213 100644
--- a/plugins/bkpr/test/run-bkpr_db.c
+++ b/plugins/bkpr/test/run-bkpr_db.c
@@ -204,6 +204,9 @@ bool param_check(struct command *cmd UNNEEDED,
const char *buffer UNNEEDED,
const jsmntok_t tokens[] UNNEEDED, ...)
{ fprintf(stderr, "param_check called!\n"); abort(); }
+/* Generated stub for send_backtrace */
+void send_backtrace(const char *why UNNEEDED)
+{ fprintf(stderr, "send_backtrace called!\n"); abort(); }
/* Generated stub for toks_alloc */
jsmntok_t *toks_alloc(const tal_t *ctx UNNEEDED)
{ fprintf(stderr, "toks_alloc called!\n"); abort(); }
diff --git a/plugins/bkpr/test/run-recorder.c b/plugins/bkpr/test/run-recorder.c
index b1d5c9b9..7b7e9aa6 100644
--- a/plugins/bkpr/test/run-recorder.c
+++ b/plugins/bkpr/test/run-recorder.c
@@ -210,6 +210,9 @@ bool param_check(struct command *cmd UNNEEDED,
const char *buffer UNNEEDED,
const jsmntok_t tokens[] UNNEEDED, ...)
{ fprintf(stderr, "param_check called!\n"); abort(); }
+/* Generated stub for send_backtrace */
+void send_backtrace(const char *why UNNEEDED)
+{ fprintf(stderr, "send_backtrace called!\n"); abort(); }
/* Generated stub for toks_alloc */
jsmntok_t *toks_alloc(const tal_t *ctx UNNEEDED)
{ fprintf(stderr, "toks_alloc called!\n"); abort(); }
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.