common: fix dangling memory allocation in `daemon_conn_new_()`
What the developer wrote
Authored by Chandra Pratap
common: fix dangling memory allocation in `daemon_conn_new_()`
Changelog-Fixed: Use the correct context in `daemon_conn_new_()`
by allocating `struct daemon_conn` with `ctx` instead of `NULL`.
This ensures proper ownership and cleanup of `daemon_conn` objects,
avoiding memory leaks.
What changed, and why it matters
This commit fixes a one-line memory-management bug in Core Lightning. A helper function that creates internal connection objects was allocating them with no owner (NULL context) instead of using the caller-provided owner. That meant the objects could become 'dangling' allocations that are not automatically freed when their parent object is destroyed, leading to memory leaks. The fix passes the intended owner context into the allocation function so cleanup happens correctly.
Apply the patch. Review all call sites of daemon_conn_new_() to confirm the supplied ctx is appropriate and that no code relied on the previous root-context allocation behavior. Consider running static analysis or valgrind/ASan tests focused on daemon_conn lifetimes.
Security signals we found
Memory leak / dangling allocation due to incorrect tal context
Use-after-free risk if callers later free or re-parent the object inconsistently
Resource exhaustion potential under repeated daemon connection creation
Evidence from the diff
In common/daemon_conn.c, daemon_conn_new_() changed struct daemon_conn *dc = tal(NULL, struct daemon_conn); to tal(ctx, struct daemon_conn);. The function already accepted a const tal_t *ctx parent context but ignored it, allocating the struct off the NULL/root context. In Core Lightning’s tal allocator, allocations under a parent are freed when the parent is freed; root-context allocations persist until explicitly freed. Using NULL therefore breaks intended ownership and can leak struct daemon_conn instances when the caller expects the object to be cleaned up with its parent. The patch restores the intended ownership model.
Changed components
common/daemon_conn.cdaemon_conn_new_()struct daemon_conn lifetime managementInspect captured patch +1 / −1
diff --git a/common/daemon_conn.c b/common/daemon_conn.c
index e775544c..aad01e93 100644
--- a/common/daemon_conn.c
+++ b/common/daemon_conn.c
@@ -143,7 +143,7 @@ struct daemon_conn *daemon_conn_new_(const tal_t *ctx, int fd,
void (*outq_empty)(void *),
void *arg)
{
- struct daemon_conn *dc = tal(NULL, struct daemon_conn);
+ struct daemon_conn *dc = tal(ctx, struct daemon_conn);
dc->recv = recv;
dc->outq_empty = outq_empty;
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.