ipc: data race on `m_block_template` members #36515

issue Crypt-iQ opened this issue on October 13, 2026
Crypt-iQ commented at 8:08 PM on October 13, 2026: contributor
If a client submits a command to one worker thread that writes to m_block_template via submitSolution while a client submits a separate command to another worker thread that reads via any of the reading methods like getBlockHeader, a data race occurs.
I'm not sure if this is intended behavior or if well-behaved clients would submit commands like this for separate worker threads?
<details> <summary>TSAN log (truncated)</summary>
==================
WARNING: ThreadSanitizer: data race (pid=190100)
  Read of size 8 at 0x72440004a740 by thread T15:
    [#0](/bitcoin-bitcoin/0/) __tsan_memcpy <null> (bitcoin-node+0xe1732) (BuildId: dce8763323dcca1ed6853b91e36635be0d835a86)
    [#1](/bitcoin-bitcoin/1/) node::(anonymous namespace)::BlockTemplateImpl::getBlockHeader() /root/yield/bitcoin/src/node/interfaces.cpp:894:16 (bitcoin-node+0x2e9104) (BuildId: dce8763323dcca1ed6853b91e36635be0d835a86)
    [#2](/bitcoin-bitcoin/2/) decltype(auto) mp::ProxyMethodTraits<ipc::capnp::messages::BlockTemplate::GetBlockHeaderParams, void>::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockHeaderParams, ipc::capnp::messages::BlockTemplate::GetBlockHeaderResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockHeaderParams, ipc::capnp::messages::BlockTemplate::GetBlockHeaderResults>>&) /root/yield/bitcoin/src/ipc/libmultiprocess/include/mp/proxy.h:300:16 (bitcoin-node+0x9d7ca8) (BuildId: dce8763323dcca1ed6853b91e36635be0d835a86)
    [#3](/bitcoin-bitcoin/3/) decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockHeaderParams, ipc::capnp::messages::BlockTemplate::GetBlockHeaderResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockHeaderParams, ipc::capnp::messages::BlockTemplate::GetBlockHeaderResults>>&, mp::TypeList<>) const::'lambda'()::operator()() const /root/yield/bitcoin/src/ipc/libmultiprocess/include/mp/proxy-types.h:534:24 (bitcoin-node+0x9d7ca8)
    [#4](/bitcoin-bitcoin/4/) decltype(auto) mp::TryFinally<decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockHeaderParams, ipc::capnp::messages::BlockTemplate::GetBlockHeaderResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockHeaderParams, ipc::capnp::messages::BlockTemplate::GetBlockHeaderResults>>&, mp::TypeList<>) const::'lambda'(), decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockHeaderParams, ipc::capnp::messages::BlockTemplate::GetBlockHeaderResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockHeaderParams, ipc::capnp::messages::BlockTemplate::GetBlockHeaderResults>>&, mp::TypeList<>) const::'lambda0'()>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockHeaderParams, ipc::capnp::messages::BlockTemplate::GetBlockHeaderResults>>&&, decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockHeaderParams, ipc::capnp::messages::BlockTemplate::GetBlockHeaderResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockHeaderParams, ipc::capnp::messages::BlockTemplate::GetBlockHeaderResults>>&, mp::TypeList<>) const::'lambda0'()&&) /root/yield/bitcoin/src/ipc/libmultiprocess/include/mp/util.h:260:37 (bitcoin-node+0x9d7ca8)

  Previous write of size 4 at 0x72440004a740 by thread T14:
    [#0](/bitcoin-bitcoin/0/) node::AddMerkleRootAndCoinbase(CBlock&, std::shared_ptr<CTransaction const>, unsigned int, unsigned int, unsigned int) /root/yield/bitcoin/src/node/miner.cpp:363:20 (bitcoin-node+0x30c19b) (BuildId: dce8763323dcca1ed6853b91e36635be0d835a86)
    [#1](/bitcoin-bitcoin/1/) node::(anonymous namespace)::BlockTemplateImpl::submitSolution(unsigned int, unsigned int, unsigned int, std::shared_ptr<CTransaction const>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) /root/yield/bitcoin/src/node/interfaces.cpp:925:9 (bitcoin-node+0x2e9be6) (BuildId: dce8763323dcca1ed6853b91e36635be0d835a86)
    [#2](/bitcoin-bitcoin/2/) decltype(auto) mp::ProxyMethodTraits<ipc::capnp::messages::BlockTemplate::SubmitSolutionParams, void>::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::SubmitSolutionParams, ipc::capnp::messages::BlockTemplate::SubmitSolutionResults>>, unsigned int, unsigned int, unsigned int, std::shared_ptr<CTransaction const>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::SubmitSolutionParams, ipc::capnp::messages::BlockTemplate::SubmitSolutionResults>>&, unsigned int&&, unsigned int&&, unsigned int&&, std::shared_ptr<CTransaction const>&&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) /root/yield/bitcoin/src/ipc/libmultiprocess/include/mp/proxy.h:300:16 (bitcoin-node+0xa59d33) (BuildId: dce8763323dcca1ed6853b91e36635be0d835a86)
    [#3](/bitcoin-bitcoin/3/) decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::SubmitSolutionParams, ipc::capnp::messages::BlockTemplate::SubmitSolutionResults>>, unsigned int, unsigned int, unsigned int, std::shared_ptr<CTransaction const>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::SubmitSolutionParams, ipc::capnp::messages::BlockTemplate::SubmitSolutionResults>>&, mp::TypeList<>, unsigned int&&, unsigned int&&, unsigned int&&, std::shared_ptr<CTransaction const>&&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) const::'lambda'()::operator()() const /root/yield/bitcoin/src/ipc/libmultiprocess/include/mp/proxy-types.h:534:24 (bitcoin-node+0xa598dc) (BuildId: dce8763323dcca1ed6853b91e36635be0d835a86)
    [#4](/bitcoin-bitcoin/4/) decltype(auto) mp::TryFinally<decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::SubmitSolutionParams, ipc::capnp::messages::BlockTemplate::SubmitSolutionResults>>, unsigned int, unsigned int, unsigned int, std::shared_ptr<CTransaction const>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::SubmitSolutionParams, ipc::capnp::messages::BlockTemplate::SubmitSolutionResults>>&, mp::TypeList<>, unsigned int&&, unsigned int&&, unsigned int&&, std::shared_ptr<CTransaction const>&&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) const::'lambda'(), decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::SubmitSolutionParams, ipc::capnp::messages::BlockTemplate::SubmitSolutionResults>>, unsigned int, unsigned int, unsigned int, std::shared_ptr<CTransaction const>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::SubmitSolutionParams, ipc::capnp::messages::BlockTemplate::SubmitSolutionResults>>&, mp::TypeList<>, unsigned int&&, unsigned int&&, unsigned int&&, std::shared_ptr<CTransaction const>&&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) const::'lambda0'()>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::SubmitSolutionParams, ipc::capnp::messages::BlockTemplate::SubmitSolutionResults>>&&, decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::SubmitSolutionParams, ipc::capnp::messages::BlockTemplate::SubmitSolutionResults>>, unsigned int, unsigned int, unsigned int, std::shared_ptr<CTransaction const>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::SubmitSolutionParams, ipc::capnp::messages::BlockTemplate::SubmitSolutionResults>>&, mp::TypeList<>, unsigned int&&, unsigned int&&, unsigned int&&, std::shared_ptr<CTransaction const>&&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) const::'lambda0'()&&) /root/yield/bitcoin/src/ipc/libmultiprocess/include/mp/util.h:260:37 (bitcoin-node+0xa598dc)
</details>
My LLM found this while running fuzzamoto.
Crypt-iQ renamed this:
~~ipc: data race on m_block_template members~~
ipc: data race on `m_block_template` members
on Oct 13, 2026
fanquake commented at 10:23 PM on October 13, 2026: member

cc @Sjors @ryanofsky
Contributors
Crypt-iQ
fanquake
Linked (view graph)
#1 JSON-RPC support for mobile devices ("ultra-lightweight" clients)#2 Long-term, safe, store-of-value #3 Encrypt wallet #4 Export/Import wallet in a human readable, future-proof format