Skip to content

lightningd: check rpc names collisions with builtin commands - #9416

Open
Lagrang3 wants to merge 1 commit into
ElementsProject:masterfrom
Lagrang3:lightningd-rpc-collision
Open

lightningd: check rpc names collisions with builtin commands#9416
Lagrang3 wants to merge 1 commit into
ElementsProject:masterfrom
Lagrang3:lightningd-rpc-collision

Conversation

@Lagrang3

Copy link
Copy Markdown
Collaborator

We crashed if the name collision happened to be a builtin command.

lightningd: FATAL SIGNAL 11 (version v26.06-241-gb35b848-modded)
0x5573cd532b2c send_backtrace
	common/daemon.c:38
0x5573cd532bb6 crashdump
	common/daemon.c:83
0x7fe1fd4ccdef ???
	./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x5573cd4d51a4 plugin_rpcmethod_add
	lightningd/plugin.c:1396
0x5573cd4d5268 plugin_rpcmethods_add
	lightningd/plugin.c:1423
0x5573cd4d57ef plugin_parse_getmanifest_response
	lightningd/plugin.c:1805
0x5573cd4d68db plugin_manifest_cb
	lightningd/plugin.c:1827
0x5573cd4d2316 plugin_response_handle
	lightningd/plugin.c:692
0x5573cd4d7443 plugin_read_json
	lightningd/plugin.c:781
0x5573cd56fd01 next_plan
	ccan/ccan/io/io.c:60
0x5573cd57018c do_plan
	ccan/ccan/io/io.c:422
0x5573cd570245 io_ready
	ccan/ccan/io/io.c:439
0x5573cd571be3 io_loop
	ccan/ccan/io/poll.c:471
0x5573cd4a5a99 io_loop_with_timers
	lightningd/io_loop_with_timers.c:22
0x5573cd4d61d1 plugins_init
	lightningd/plugin.c:2063
0x5573cd4aad6c main
	lightningd/lightningd.c:1269
0x7fe1fd4b6ca7 __libc_start_call_main
	../sysdeps/nptl/libc_start_call_main.h:58
0x7fe1fd4b6d64 __libc_start_main_impl
	../csu/libc-start.c:360
0x5573cd47a120 ???
	_start+0x20:0
0xffffffffffffffff ???
	???:0

Changelog-Fixed: lightningd: checks for rpc name collisions with builtin commands before registering plugin

We crashed if the name collision happened to be a builtin command.

```
lightningd: FATAL SIGNAL 11 (version v26.06-241-gb35b848-modded)
0x5573cd532b2c send_backtrace
	common/daemon.c:38
0x5573cd532bb6 crashdump
	common/daemon.c:83
0x7fe1fd4ccdef ???
	./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x5573cd4d51a4 plugin_rpcmethod_add
	lightningd/plugin.c:1396
0x5573cd4d5268 plugin_rpcmethods_add
	lightningd/plugin.c:1423
0x5573cd4d57ef plugin_parse_getmanifest_response
	lightningd/plugin.c:1805
0x5573cd4d68db plugin_manifest_cb
	lightningd/plugin.c:1827
0x5573cd4d2316 plugin_response_handle
	lightningd/plugin.c:692
0x5573cd4d7443 plugin_read_json
	lightningd/plugin.c:781
0x5573cd56fd01 next_plan
	ccan/ccan/io/io.c:60
0x5573cd57018c do_plan
	ccan/ccan/io/io.c:422
0x5573cd570245 io_ready
	ccan/ccan/io/io.c:439
0x5573cd571be3 io_loop
	ccan/ccan/io/poll.c:471
0x5573cd4a5a99 io_loop_with_timers
	lightningd/io_loop_with_timers.c:22
0x5573cd4d61d1 plugins_init
	lightningd/plugin.c:2063
0x5573cd4aad6c main
	lightningd/lightningd.c:1269
0x7fe1fd4b6ca7 __libc_start_call_main
	../sysdeps/nptl/libc_start_call_main.h:58
0x7fe1fd4b6d64 __libc_start_main_impl
	../csu/libc-start.c:360
0x5573cd47a120 ???
	_start+0x20:0
0xffffffffffffffff ???
	???:0
```

Changelog-Fixed: lightningd: checks for rpc name collisions with builtin commands before registering plugin

Reported-by: Vincenzo Palazzo (Bitcoin Security Council finding 2026-08-11)

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
@Lagrang3
Lagrang3 force-pushed the lightningd-rpc-collision branch from 6268f1d to 0003922 Compare August 13, 2026 11:40

@nGoline nGoline left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lightningd/jsonrpc.c:1347: the p == NULL branch you're now handling is also reached with no collision at all. command_add() has already inserted command->name into rpc->cmdmap when json_escape_unescape_len() fails, and this path tal_free()s the cmd_and_usage without strmap_del() and before tal_add_destructor2() is set, so the map keeps a freed key and a freed value.

That unescape rejects \uXXXX, which jsmn accepts, so any plugin with a non-ASCII character in an rpcmethod usage/description gets there (pyln avoids it only via ensure_ascii=False). Before this patch it crashed in plugin_rpcmethod_add; with the patch the node boots and the first help segfaults at lightningd/jsonrpc.c:432 in json_add_help_command on cmd->command->depr_start.

	cmd->usage = json_escape_unescape_len(cmd, usage, strlen(usage));
	if (!cmd->usage) {
		strmap_del(&rpc->cmdmap, command->name, NULL);
		tal_free(cmd);
		return false;
	}

Verified: without it, a plugin declaring usage "arg Á" kills the node on help; with it, the plugin is rejected, the name is absent from help, and the node stays up.

lightningd/plugin.c:1402 — on that same path the new message says a builtin owns
the name when nothing does. Worth having jsonrpc_command_add() report which failure it was.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants