depends: fix IPC listeners on macOS dying when accepting a dead socket #35796

xyzconstant commented at 12:22 AM on July 25, 2026: contributor

This PR adds a depends patch to fix a Cap'n Proto bug present in macOS that throws the following exception after accepting a disconnected client:

mp/proxy.cpp:48: error: Uncaught exception in daemonized task.; exception = kj/async-io-unix.c++:1365: failed: setsocketopt(IPPROTO_TCP, TCP_NODELAY): Invalid argument

This goes uncaught killing libmultiprocess's accept loop (mp::ListenConnections()) in the process.

Root cause

After accept(), kj unconditionally calls setsockopt(TCP_NODELAY) on the connection socket. For Unix sockets, kj handles the usual "not supported" error codes, however, on macOS EINVAL is returned when the client has already disconnected and kj only tolerates that code when built for FreeBSD. The unexpected error then goes uncaught in the accept loop, causing the listener to stop accepting new connections.

See https://github.com/bitcoin-core/libmultiprocess/issues/319 for more details and instructions on how to reproduce it in Bitcoin Core using socat.

Fix

The patch is based on the EINVAL handling from capnproto/capnproto@7df5bd078, which is only available on the not yet released v2 branch. It's applied to capnp.mk as a temporary workaround until capnproto/capnproto#2748 is available in a v1 release.

DrahtBot added the label Build system on Jul 25, 2026

DrahtBot commented at 12:22 AM on July 25, 2026: contributor

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35796.

Reviews

See the guideline and AI policy for information on the review process.

Type	Reviewers
ACK	hebasto, ryanofsky

If your review is incorrectly listed, please copy-paste <code></code> into the comment that the bot should ignore.

hebasto commented at 7:33 AM on July 25, 2026: member

Is there a related upstream issue?

xyzconstant commented at 3:57 PM on July 25, 2026: contributor

re: #35796#pullrequestreview-4778841077

There's this one I opened in libmultiprocess https://github.com/bitcoin-core/libmultiprocess/issues/319

Sjors commented at 10:47 AM on July 27, 2026: member

This is a patch to capnp.mk‎, so "upstream" means capnpp here. My understanding from https://github.com/bitcoin-core/libmultiprocess/issues/319 is that it's been fixed in v2, but not back-ported (yet) to v1.

hebasto commented at 11:01 AM on July 27, 2026: member

This is a patch to capnp.mk‎, so "upstream" means capnpp here.

Exactly.

My understanding from bitcoin-core/libmultiprocess#319 is that it's been fixed in v2, but not back-ported (yet) to v1.

Based on the EINVAL handling from https://github.com/capnproto/capnproto/commit/7df5bd078

Upstream https://github.com/capnproto/capnproto/commit/7df5bd078 has a much larger diff than the patch in this PR. Because of this, it would be good to see a PR that backports the fix to the master branch in capnproto/capnproto first.

xyzconstant commented at 6:27 PM on July 27, 2026: contributor

This is a patch to capnp.mk‎, so "upstream" means capnpp here. My understanding from bitcoin-core/libmultiprocess#319 is that it's been fixed in v2, but not back-ported (yet) to v1.

Oh thanks for the clarification.

xyzconstant commented at 6:37 PM on July 27, 2026: contributor

This is a patch to capnp.mk‎, so "upstream" means capnpp here.

Exactly.

Sorry, I got it wrong. As @Sjors said, it's only merged in v2. There wasn't an issue or PR in there backporting it to v1.

My understanding from bitcoin-core/libmultiprocess#319 is that it's been fixed in v2, but not back-ported (yet) to v1.

Based on the EINVAL handling from capnproto/capnproto@7df5bd078

Upstream capnproto/capnproto@7df5bd078 has a much larger diff than the patch in this PR. Because of this, it would be good to see a PR that backports the fix to the master branch in capnproto/capnproto first.

I just opened capnproto/capnproto#2748, which backports the complete upstream commit and is not as minimal as the depends patch in this PR (only the EINVAL check).

xyzconstant commented at 8:26 PM on July 28, 2026: contributor

I just opened capnproto/capnproto#2748, which backports the complete upstream commit and is not as minimal as the depends patch in this PR (only the EINVAL check).

The backport has just been merged on upstream.

fanquake commented at 11:10 AM on August 7, 2026: member

cc @ryanofsky

hebasto commented at 11:18 AM on August 7, 2026: member

I just opened capnproto/capnproto#2748, which backports the complete upstream commit and is not as minimal as the depends patch in this PR (only the EINVAL check).

What is the rationale for skipping the other non-test changes?

ryanofsky approved

ryanofsky commented at 4:57 PM on August 24, 2026: contributor

Code review ACK 6da460d7843c6ff1415c90f1076f7fbb82515828. This is a simple fix just adding __APPLE__ to an #if statement to prevent immediately disconnecting IPC clients on macos from preventing new connections getting accepted.

I don't get the sense that this bug is very likely to happen in practice, but it seems pretty easy to fix. It would also be reasonable to apply the entire patch from https://github.com/capnproto/capnproto/pull/2748 instead of just part of it as hebasto suggested #35796 (comment).

depends: fix IPC listeners on macOS dying when accepting a dead socket

After `accept()`, kj unconditionally calls `setsockopt(TCP_NODELAY)` on the
connection socket. For Unix sockets, kj handles the usual "not supported"
error codes, however, on macOS EINVAL is returned when the client has already
disconnected and kj only tolerates that code when built for FreeBSD.
The unexpected error then goes uncaught in the accept loop, causing the
listener to stop accepting new connections.

See https://github.com/bitcoin-core/libmultiprocess/issues/319 for more details.

Patch is the upstream commit https://github.com/capnproto/capnproto/commit/85d8e47f,
the 1.x backport of https://github.com/capnproto/capnproto/commit/7df5bd078
(https://github.com/capnproto/capnproto/pull/2748).

e07224f2d5

xyzconstant force-pushed on Aug 25, 2026

xyzconstant commented at 12:08 AM on August 25, 2026: contributor

@hebasto Sorry, I just saw your comment. There wasn't a real reason. I just tried to keep the patch as small as possible.

Also, I just updated the patch to include the entire upstream commit capnproto/capnproto@85d8e47f now that it is backported.

fanquake requested review from ryanofsky on Sep 7, 2026

fanquake commented at 10:42 AM on September 7, 2026: member

cc @Sjors

hebasto approved

hebasto commented at 11:34 AM on September 7, 2026: member

ACK e07224f2d5543b207320dad008a6f240bab28301, I have reviewed the code and it looks OK.

hebasto commented at 7:55 AM on September 8, 2026: member

My Guix build:

$ uname -m && find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
aarch64
4ce2984ef8c51a6e602b5738e0b3c5d5274d4824a5bbdf99641580ac2a3bbdff  guix-build-e07224f2d554/output/aarch64-linux-gnu/SHA256SUMS.part
4c05e82ff7d204c49c2a164bf91d65a40d72bcdee9975f5c18d7e640076ff257  guix-build-e07224f2d554/output/aarch64-linux-gnu/bitcoin-e07224f2d554-aarch64-linux-gnu-debug.tar.gz
60c7fa169c606e5473737ad01ea55711c4a9c25607652c3d8b73c2cb9e8bfa4d  guix-build-e07224f2d554/output/aarch64-linux-gnu/bitcoin-e07224f2d554-aarch64-linux-gnu.tar.gz
ab8c7ba8313983203d1e06f1213132bd797ff61dad78245b9d3d47345cef2b24  guix-build-e07224f2d554/output/arm-linux-gnueabihf/SHA256SUMS.part
e102fab2e461990e17886f7d00e619813e503c8b4e7d27d892961feac3d62782  guix-build-e07224f2d554/output/arm-linux-gnueabihf/bitcoin-e07224f2d554-arm-linux-gnueabihf-debug.tar.gz
81c66a0ca82568b7bf5bad1b19320647324ad339866543fa82c6f1cc9d1e2eaf  guix-build-e07224f2d554/output/arm-linux-gnueabihf/bitcoin-e07224f2d554-arm-linux-gnueabihf.tar.gz
f5ac5afb3a4fad80ceb83799dc83b6d4318ad386fe03a13af9ca691d19425bd6  guix-build-e07224f2d554/output/arm64-apple-darwin/SHA256SUMS.part
01a5eb5948426ca1e6385fa6254a52fa3636fb24d47464ed9b996d8d1ac4831b  guix-build-e07224f2d554/output/arm64-apple-darwin/bitcoin-e07224f2d554-arm64-apple-darwin-codesigning.tar.gz
4cb1d6a099a2d7234eff64ac302c3b800d7919f7599239eff68f0400650ac134  guix-build-e07224f2d554/output/arm64-apple-darwin/bitcoin-e07224f2d554-arm64-apple-darwin-unsigned.tar.gz
ac9e809b93d2288337708e142c5d0e6a2d49c8b93552c3d027da968e08df5b53  guix-build-e07224f2d554/output/arm64-apple-darwin/bitcoin-e07224f2d554-arm64-apple-darwin-unsigned.zip
fb18f6104a362d2aadc84496930c30c9860b0c4b0d16999c22a3882d461d4518  guix-build-e07224f2d554/output/dist-archive/bitcoin-e07224f2d554.tar.gz
b4c5802f2cb57ec17e9a53dedddfce5eb6e26da997a60eec270f34075c7a4581  guix-build-e07224f2d554/output/powerpc64-linux-gnu/SHA256SUMS.part
7a24d7eb60be5ce331f4c65d32f28b7ed03fba58bdf945df5e3146f203b83654  guix-build-e07224f2d554/output/powerpc64-linux-gnu/bitcoin-e07224f2d554-powerpc64-linux-gnu-debug.tar.gz
0c0ba1b7da3b05fc7e968c0e3c4881a3e3df9e7e75896fccddab9ad7e2e8c012  guix-build-e07224f2d554/output/powerpc64-linux-gnu/bitcoin-e07224f2d554-powerpc64-linux-gnu.tar.gz
b6e671a9067e0a39632f675ff1f4580800f0eee1d10d75a71dd6c44f01179bea  guix-build-e07224f2d554/output/riscv64-linux-gnu/SHA256SUMS.part
a73d477096eddbb1cbf018960dbb4d2544c30076fdedae3a159d5d84e4f5a5f6  guix-build-e07224f2d554/output/riscv64-linux-gnu/bitcoin-e07224f2d554-riscv64-linux-gnu-debug.tar.gz
8a4306ec8cccbbdc2770e07d38f5a61564e2817b565f96fbda23035cd5a1b3a2  guix-build-e07224f2d554/output/riscv64-linux-gnu/bitcoin-e07224f2d554-riscv64-linux-gnu.tar.gz
f62e87dbfcf3df8ebb5885040cf06baba53682f63cb271a646c37fddaa135e69  guix-build-e07224f2d554/output/x86_64-apple-darwin/SHA256SUMS.part
c5883ab2cd5c822434bc1d5b86533421b8f47fbd233ae87c2d4010c30f90aeb0  guix-build-e07224f2d554/output/x86_64-apple-darwin/bitcoin-e07224f2d554-x86_64-apple-darwin-codesigning.tar.gz
ea1c411ffd92c05c6433033cba1c09a3b44b6ff9a8c46a7524d26c001932ef58  guix-build-e07224f2d554/output/x86_64-apple-darwin/bitcoin-e07224f2d554-x86_64-apple-darwin-unsigned.tar.gz
ebbdf928f020cb44c110fdd7192945d4005a7708dd9201f18def2eb74975af4b  guix-build-e07224f2d554/output/x86_64-apple-darwin/bitcoin-e07224f2d554-x86_64-apple-darwin-unsigned.zip
91bb91ced37f1a659fde1fc5c26343b36967659d7e70dabc7fd058a5f580a6a3  guix-build-e07224f2d554/output/x86_64-linux-gnu/SHA256SUMS.part
1e4c9b1e019209eae1df8630682f824248c0ef3dbe7e5e1aba5a2e2a4a11ebff  guix-build-e07224f2d554/output/x86_64-linux-gnu/bitcoin-e07224f2d554-x86_64-linux-gnu-debug.tar.gz
15511d6a57a0fd087ed3901f7838123f1824b869ac735c3d66d0ccc2c5936b05  guix-build-e07224f2d554/output/x86_64-linux-gnu/bitcoin-e07224f2d554-x86_64-linux-gnu.tar.gz
3cec51e9f7c0ebffc74977cef6b120bba94468938d3468141913ee9ae4fba84e  guix-build-e07224f2d554/output/x86_64-w64-mingw32/SHA256SUMS.part
585465bcf9c3e466739200ac4bea31748b6a45acadc3ce326533cf3e9592dff8  guix-build-e07224f2d554/output/x86_64-w64-mingw32/bitcoin-e07224f2d554-win64-codesigning.tar.gz
8b58dd62ac35fe1dd709cd0366b1b6ebe383f18ae852f3ac05da20e7466b821d  guix-build-e07224f2d554/output/x86_64-w64-mingw32/bitcoin-e07224f2d554-win64-debug.zip
65c15d78d49206de979e7e790fa0a465bf09357ffc5645e0dded8611088964a6  guix-build-e07224f2d554/output/x86_64-w64-mingw32/bitcoin-e07224f2d554-win64-setup-unsigned.exe
e38f17fda27c13aa7aebb44a30f8469ed3e07e600fbc57663ad5ce0a3b26ea15  guix-build-e07224f2d554/output/x86_64-w64-mingw32/bitcoin-e07224f2d554-win64-unsigned.zip

ryanofsky approved

ryanofsky commented at 4:25 PM on September 8, 2026: contributor

Code review ACK e07224f2d5543b207320dad008a6f240bab28301. Confirmed patch matches what was committed upstream (https://github.com/capnproto/capnproto/commit/85d8e47fcb156afc3d95ed9033ba470d6189cbff).

c=$(head -n1 depends/patches/capnp/macos_accept_dead_socket.patch | cut -d' ' -f2)
(cd ~/work/capnproto && git branch -a --contains "$c")
git diff --no-index <(cd ~/work/capnproto && git format-patch -n1 --stdout "$c") depends/patches/capnp/macos_accept_dead_socket.patch

fanquake merged this on Sep 9, 2026

fanquake closed this on Sep 9, 2026