test: cover orphan reconsideration interruptibility #36262

pull ViniciusCestarii wants to merge 1 commits into bitcoin:master from ViniciusCestarii:test-orphan_reconsideration_interruptible changing 1 files +69 −0
  1. ViniciusCestarii commented at 3:03 PM on September 15, 2026: contributor

    Add test checking that ProcessOrphanTx reconsiders at most one orphan per ProcessMessages(). This test prevents regression of CVE-2024-52914 which currently no existing test checks.

    The test kills 2 mutants found with https://github.com/ViniciusCestarii/mutant-harness:

    1. Remove return true after an orphan is accepted
    --- a/src/net_processing.cpp
    +++ b/src/net_processing.cpp
    @@ -3494,7 +3494,6 @@ bool PeerManagerImpl::ProcessOrphanTx(Peer& peer)
             if (result.m_result_type == MempoolAcceptResult::ResultType::VALID) {
                 LogDebug(BCLog::TXPACKAGES, "   accepted orphan tx %s (wtxid=%s)\n", orphanHash.ToString(), orphan_wtxid.ToString());
                 ProcessValidTx(peer.m_id, porphanTx, result.m_replaced_transactions);
    -            return true;
             } else if (state.GetResult() != TxValidationResult::TX_MISSING_INPUTS) {
    
    1. Remove return true after an orphan is rejected for a reason other than TX_MISSING_INPUTS
    --- a/src/net_processing.cpp
    +++ b/src/net_processing.cpp
    @@ -3508,7 +3508,6 @@ bool PeerManagerImpl::ProcessOrphanTx(Peer& peer)
              state.GetResult() != TxValidationResult::TX_RESULT_UNSET)) {
                     ProcessInvalidTx(peer.m_id, porphanTx, state, /*first_time_failure=*/false);
                 }
    -            return true;
             }
         }
    
  2. DrahtBot added the label Tests on Sep 15, 2026
  3. DrahtBot commented at 3:03 PM on September 15, 2026: contributor

    <!--e57a25ab6845829454e8d69fc972939a-->

    The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

    <!--006a51241073e994b41acfe9ec718e94-->

    External sites

    <!--021abf342d371248e50ceaed478a90ca-->

    Reviews

    See the guideline and AI policy for information on the review process.

    Type Reviewers
    ACK instagibbs, fametrano
    Concept ACK enirox001

    If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

    <!--5faf32d7da4f0f540f40219e4f7537a3-->

  4. DrahtBot added the label CI failed on Sep 15, 2026
  5. DrahtBot commented at 4:04 PM on September 15, 2026: contributor

    <!--85328a0da195eb286784d51f73fa0af9-->

    🚧 At least one of the CI tasks failed. <sub>Task macOS-cross to arm64: https://github.com/bitcoin/bitcoin/actions/runs/34985864523/job/104437664650</sub> <sub>LLM reason (✨ experimental): CI failed because the build stopped on a Clang -Wthread-safety-analysis error (mutex g_msgproc_mutex not held exclusively) in denialofservice_tests.cpp.</sub>

    <details><summary>Hints</summary>

    Try to run the tests locally, according to the documentation. However, a CI failure may still happen due to a number of reasons, for example:

    • Possibly due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.

    • A sanitizer issue, which can only be found by compiling with the sanitizer and running the affected test.

    • An intermittent issue.

    Leave a comment here, if you need help tracking down a confusing failure.

    </details>

  6. ViniciusCestarii marked this as a draft on Sep 15, 2026
  7. ViniciusCestarii force-pushed on Sep 15, 2026
  8. ViniciusCestarii marked this as ready for review on Sep 15, 2026
  9. DrahtBot removed the label CI failed on Sep 15, 2026
  10. instagibbs commented at 1:14 PM on September 16, 2026: member

    concept ACK

  11. enirox001 commented at 7:53 AM on September 21, 2026: contributor

    Concept ACK

  12. fametrano commented at 11:52 AM on October 2, 2026: contributor

    tACK 1ad8b857fa76ec5c8173fe41db2fcdd998bf3e9d

    I built test_bitcoin at this commit and ran the new test 20 times; it passed every time and does not depend on timing. It fails with both mutants from the description, and with both return trues removed together, which brings back the pre-#15644 behaviour of handling every orphan in one call. It also catches dropping if (processed_orphan) return true; in ProcessMessages.

    One related mutant survives: removing if (m_txdownloadman.HaveMoreWork(peer.m_id)) fMoreWork = true; from ProcessMessages. Orphan processing then starts only on the peer's next poll, up to 100 ms later. The two suggestions below kill it, and the test still passes. This is a delay, not the CVE, so it is optional.

  13. in src/test/denialofservice_tests.cpp:484 in 1ad8b857fa
     479 | +
     480 | +    const auto send_tx{[&](const CTransactionRef& tx) EXCLUSIVE_LOCKS_REQUIRED(NetEventsInterface::g_msgproc_mutex) {
     481 | +        connman.FlushSendBuffer(peer); // Drop messages we sent, the transport is shared with the fake peer.
     482 | +        BOOST_REQUIRE(connman.ReceiveMsgFrom(peer, NetMsg::Make(NetMsgType::TX, TX_WITH_WITNESS(*tx))));
     483 | +        peer.fPauseSend = false;
     484 | +        connman.ProcessMessagesOnce(peer);
    


    fametrano commented at 11:52 AM on October 2, 2026:

    Return the result, so the test can check it when the parent is sent.

            return connman.ProcessMessagesOnce(peer);
    

    ViniciusCestarii commented at 12:50 PM on October 2, 2026:

    Thanks for the suggestion. Applied on aba1cd975c1e5d3db7bb65d1e6c9cd7d918b2be4

  14. in src/test/denialofservice_tests.cpp:498 in 1ad8b857fa
     493 | +    }
     494 | +    BOOST_CHECK_EQUAL(peerman.GetOrphanTransactions().size(), num_children);
     495 | +    BOOST_CHECK_EQUAL(mempool.size(), 0U);
     496 | +
     497 | +    // Accepting the parent schedules all children for reconsideration.
     498 | +    send_tx(parent);
    


    fametrano commented at 11:52 AM on October 2, 2026:

    This fails if ProcessMessages stops signalling more work once the parent is accepted.

        BOOST_CHECK(send_tx(parent));
    

    ViniciusCestarii commented at 12:50 PM on October 2, 2026:

    Thanks for the suggestion. Applied on aba1cd975c1e5d3db7bb65d1e6c9cd7d918b2be4

  15. DrahtBot requested review from instagibbs on Oct 2, 2026
  16. DrahtBot requested review from enirox001 on Oct 2, 2026
  17. ViniciusCestarii force-pushed on Oct 2, 2026
  18. ViniciusCestarii commented at 12:53 PM on October 2, 2026: contributor

    Thanks for the reviews! Force-pushed aba1cd975c1e5d3db7bb65d1e6c9cd7d918b2be4 adding the suggestions on #36262#pullrequestreview-5391424947

  19. in src/test/denialofservice_tests.cpp:491 in aba1cd975c
     486 | +
     487 | +    // Children arrive first and become orphans. Half of them have an invalid signature.
     488 | +    for (int i{0}; i < num_children; ++i) {
     489 | +        auto child{CreateValidMempoolTransaction(parent, i, /*input_height=*/101, coinbaseKey, script, 4 * COIN, /*submit=*/false)};
     490 | +        // The P2PK scriptSig ends with the sighash byte, changing it invalidates the signature.
     491 | +        if (i % 2) child.vin[0].scriptSig.back() = SIGHASH_ALL | SIGHASH_ANYONECANPAY;
    


    instagibbs commented at 1:19 PM on October 2, 2026:

    nit: you could make the children 0-fee, to avoid having to mutate scripts/witnesss


    ViniciusCestarii commented at 3:04 PM on October 2, 2026:

    Good point, it reads cleaner. Done on aba1cd975c1e5d3db7bb65d1e6c9cd7d918b2be4

  20. instagibbs approved
  21. instagibbs commented at 1:19 PM on October 2, 2026: member

    ACK aba1cd975c1e5d3db7bb65d1e6c9cd7d918b2be4

  22. DrahtBot requested review from fametrano on Oct 2, 2026
  23. test: cover orphan reconsideration interruptibility 16bff77a5a
  24. ViniciusCestarii force-pushed on Oct 2, 2026
  25. ViniciusCestarii commented at 3:05 PM on October 2, 2026: contributor

    Thanks @instagibbs for the review! Force-pushed aba1cd975c1e5d3db7bb65d1e6c9cd7d918b2be4 addressing #36262 (review)

  26. fametrano commented at 3:26 PM on October 2, 2026: contributor

    tACK 16bff77a5aaf7a9740b859f74b8898cee6de5588

    Re-tested: the test passes 20/20, and the HaveMoreWork mutant that survived before now fails at BOOST_CHECK(send_tx(parent)). With the 0-fee children, three orphans are accepted and three rejected for "min relay fee not met".

  27. sedited merged this on Oct 5, 2026
  28. sedited closed this on Oct 5, 2026


github-metadata-mirror

This is a metadata mirror of the GitHub repository bitcoin/bitcoin. This site is not affiliated with GitHub. Content is generated from a GitHub metadata backup.
generated: 2026-10-21 19:51 UTC

This site is hosted by @0xB10C
More mirrored repositories can be found on mirror.b10c.me