Moderate 59 Bitcoin Committed Feb 11, 2026 · 22:38 UTC

pytest: reproduce crash when node disconnects between hooks:

eaf6fabf View source ↗

Public commit record

What the developer wrote

Authored by Rusty Russell

73/100 · Adequate

pytest: reproduce crash when node disconnects between hooks:

```
lightningd-2 2026-02-09T00:41:35.196Z TRACE lightningd: Plugin peer_connected_logger_a.py returned from peer_connected hook call
lightningd-2 2026-02-09T00:41:35.196Z TRACE lightningd: Calling peer_connected hook of plugin peer_connected_logger_b.py
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: FATAL SIGNAL 11 (version v25.12-257-g2a5fbd1-modded)
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: common/daemon.c:46 (send_backtrace) 0x5b2abd7f29bd
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: common/daemon.c:83 (crashdump) 0x5b2abd7f2a0c
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0 ((null)) 0x75950d84532f
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/peer_control.c:1333 (peer_connected_serialize) 0x5b2abd79c964
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/plugin_hook.c:359 (plugin_hook_call_next) 0x5b2abd7ae14a
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/plugin_hook.c:299 (plugin_hook_callback) 0x5b2abd7ae38f
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/plugin.c:701 (plugin_response_handle) 0x5b2abd7a7e28
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/plugin.c:790 (plugin_read_json) 0x5b2abd7ace9c
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:60 (next_plan) 0x5b2abd81dada
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:422 (do_plan) 0x5b2abd81def6
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:439 (io_ready) 0x5b2abd81dfb3
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ccan/ccan/io/poll.c:470 (io_loop) 0x5b2abd81f0db
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/io_loop_with_timers.c:22 (io_loop_with_timers) 0x5b2abd77c13b
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/lightningd.c:1495 (main) 0x5b2abd781c6a
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ../sysdeps/nptl/libc_start_call_main.h:58 (__libc_start_call_main) 0x75950d82a1c9
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ../csu/libc-start.c:360 (__libc_start_main_impl) 0x75950d82a28a
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x5b2abd752964
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0xffffffffffffffff
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context

The short version

What changed, and why it matters

This commit adds a new test that reproduces a crash in Core Lightning. The crash happens when a peer disconnects while the lightning node is still waiting for a plugin's 'peer_connected' hook to finish. The test is currently marked as expected to fail, meaning the underlying bug has not been fixed yet in this commit. It is a reproduction test, not a fix.

Recommended action

Treat this as a known unfixed crash bug. A developer should fix the null-deref/use-after-free in peer_connected_serialize before the affected code reaches a release. Network operators should avoid chaining slow peer_connected hook plugins or exposing nodes to untrusted peers that can disconnect at will until a fix is available.

Security signals we found

NULL pointer dereference or use-after-free in peer_connected_serialize when peer disconnects during chained peer_connected hooks

Daemon crash (SIGSEGV / FATAL SIGNAL 11) in peer_control.c

Race condition between peer disconnection and plugin hook serialization

Test-only commit: no production code change, only reproduction

Technical analysis

Evidence from the diff

The commit introduces a pytest test, test_plugin_connected_hook_disconnect_crash, and modifies a test plugin (peer_connected_logger_a.py) to optionally sleep until a file appears. The test sets up a node with two peer_connected hook plugins, connects a peer, makes the first plugin block, disconnects the peer by stopping it, then unblocks the first plugin. The expected outcome is a crash (SIGSEGV) in peer_connected_serialize in lightningd/peer_control.c when the second hook is invoked after the peer has disconnected. The test is marked xfail(strict=True), confirming it reproduces an unfixed bug.

Changed components

lightningd/peer_control.clightningd/plugin_hook.ctests/test_plugin.pytests/plugins/peer_connected_logger_a.py

Inspect captured patch +31 / −0

diff --git a/tests/plugins/peer_connected_logger_a.py b/tests/plugins/peer_connected_logger_a.py
index 5ded2306..484bb5f2 100755
--- a/tests/plugins/peer_connected_logger_a.py
+++ b/tests/plugins/peer_connected_logger_a.py
@@ -4,6 +4,8 @@
 """
 
 from pyln.client import Plugin
+import os
+import time
 
 plugin = Plugin()
 
@@ -11,7 +13,12 @@ plugin = Plugin()
 @plugin.hook('peer_connected')
 def on_connected(peer, plugin, **kwargs):
     print(f"peer_connected_logger_a {peer['id']} {peer}")
+    if plugin.get_option("logger_a_sleep") is True:
+        # Block until file appears
+        while not os.path.exists("unsleep"):
+            time.sleep(0.25)
     return {'result': 'continue'}
 
 
+plugin.add_option("logger_a_sleep", False, 'Block until unsleep file exists', opt_type='bool')
 plugin.run()
diff --git a/tests/test_plugin.py b/tests/test_plugin.py
index 12a9d6e5..b40cb515 100644
--- a/tests/test_plugin.py
+++ b/tests/test_plugin.py
@@ -514,6 +514,30 @@ def test_plugin_connected_hook_chaining(node_factory):
     assert not l1.daemon.is_in_log(f"peer_connected_logger_b {l3id}")
 
 
+@pytest.mark.xfail(strict=True)
+def test_plugin_connected_hook_disconnect_crash(node_factory, executor):
+    """A peer disconnnects between plugin hook invocations"""
+    opts = [{},
+            {'plugin':
+             [os.path.join(os.getcwd(),
+                           'tests/plugins/peer_connected_logger_a.py'),
+              os.path.join(os.getcwd(),
+                           'tests/plugins/peer_connected_logger_b.py')],
+             'logger_a_sleep': True},
+            ]
+
+    l1, l2 = node_factory.get_nodes(2, opts=opts)
+    executor.submit(l1.rpc.connect, l2.info['id'], 'localhost', l2.port)
+    l2.daemon.wait_for_log(f'plugin-peer_connected_logger_a.py: peer_connected_logger_a {l1.info["id"]}')
+    l1.stop()
+
+    # Now make first plugin continue...
+    open(os.path.join(l2.daemon.lightning_dir, TEST_NETWORK, "unsleep"), "w").close()
+
+    # Should get log from second
+    l2.daemon.wait_for_log(f'plugin-peer_connected_logger_b.py: peer_connected_logger_b {l1.info["id"]}')
+
+
 def test_peer_connected_remote_addr(node_factory):
     """This tests the optional tlv `remote_addr` being passed to a plugin.

Risk score

Why this scored 59/100

Our methodology →

Potential impact 18/30

Exploitability 12/25

Stealth signal 8/15

Affected reach 10/15

Confidence 7/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 59/100

Community notes

Related watches

Revert "doc: require Homebrew GNU make and gpatch on macOS"

Revert "tests: drop obsolete x-prefix in compacter-slow.sh"

doc: require Homebrew GNU make and gpatch on macOS