ipc: AddressSanitizer: SEGV on unknown address #36502

issue Crypt-iQ opened this issue on October 11, 2026

Crypt-iQ commented at 5:42 PM on October 11, 2026: contributor

Happens here when:

client creates block template
client calls destroy so the node drops the pointer to the template
client calls method on the template

I'm no ipc expert and have no idea if this has been discussed / disregarded somewhere else.

AddressSanitizer:DEADLYSIGNAL
=================================================================
==2545834==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x559bd0d09a82 bp 0x7f1f17dfe6b0 sp 0x7f1f17dfe640 T14)
==2545834==The signal is caused by a READ memory access.
==2545834==Hint: address points to the zero page.
    [#0](/github-metadata-backup-bitcoin-bitcoin/0/) 0x559bd0d09a82 in decltype(auto) mp::ProxyMethodTraits<ipc::capnp::messages::BlockTemplate::GetBlockParams, void>::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&) /root/bitcoin/src/ipc/libmultiprocess/include/mp/proxy.h:289:16
    [#1](/github-metadata-backup-bitcoin-bitcoin/1/) 0x559bd0d09a82 in decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&, mp::TypeList<>) const::'lambda'()::operator()() const /root/bitcoin/src/ipc/libmultiprocess/include/mp/proxy-types.h:534:24
    [#2](/github-metadata-backup-bitcoin-bitcoin/2/) 0x559bd0d09a82 in decltype(auto) mp::TryFinally<decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&, mp::TypeList<>) const::'lambda'(), decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&, mp::TypeList<>) const::'lambda0'()>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&&, decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&, mp::TypeList<>) const::'lambda0'()&&) /root/bitcoin/src/ipc/libmultiprocess/include/mp/util.h:240:37
    [#3](/github-metadata-backup-bitcoin-bitcoin/3/) 0x559bd0d09383 in decltype(auto) mp::ServerCall::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&, mp::TypeList<>) const /root/bitcoin/src/ipc/libmultiprocess/include/mp/proxy-types.h:532:16
    [#4](/github-metadata-backup-bitcoin-bitcoin/4/) 0x559bd0d09383 in void mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall>::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&, mp::TypeList<>) const /root/bitcoin/src/ipc/libmultiprocess/include/mp/proxy-types.h:574:33
    [#5](/github-metadata-backup-bitcoin-bitcoin/5/) 0x559bd0d08dc5 in std::enable_if<std::is_same<decltype(mp::Accessor<mp::mining_fields::Context, 17>::get(fp1.call_context.getParams())), mp::Context::Reader>::value, kj::Promise<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>::CallContext>>::type mp::PassField<mp::Accessor<mp::mining_fields::Context, 17>, mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>, mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall>, mp::TypeList<>>(mp::Priority<1>, mp::TypeList<>, mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&, mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall> const&, mp::TypeList<>&&)::'lambda'(mp::CancelMonitor&)::operator()(mp::CancelMonitor&)::'lambda2'()::operator()() const /root/bitcoin/src/ipc/libmultiprocess/include/mp/type-context.h:184:16
    [#6](/github-metadata-backup-bitcoin-bitcoin/6/) 0x559bd0d07184 in kj::Maybe<kj::Exception> kj::runCatchingExceptions<std::enable_if<std::is_same<decltype(mp::Accessor<mp::mining_fields::Context, 17>::get(fp1.call_context.getParams())), mp::Context::Reader>::value, kj::Promise<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>::CallContext>>::type mp::PassField<mp::Accessor<mp::mining_fields::Context, 17>, mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>, mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall>, mp::TypeList<>>(mp::Priority<1>, mp::TypeList<>, mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&, mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall> const&, mp::TypeList<>&&)::'lambda'(mp::CancelMonitor&)::operator()(mp::CancelMonitor&)::'lambda2'()>(mp::Accessor<mp::mining_fields::Context, 17>&&) /usr/include/kj/exception.h:371:5
    [#7](/github-metadata-backup-bitcoin-bitcoin/7/) 0x559bd0d05c2d in std::enable_if<std::is_same<decltype(mp::Accessor<mp::mining_fields::Context, 17>::get(fp1.call_context.getParams())), mp::Context::Reader>::value, kj::Promise<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>::CallContext>>::type mp::PassField<mp::Accessor<mp::mining_fields::Context, 17>, mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>, mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall>, mp::TypeList<>>(mp::Priority<1>, mp::TypeList<>, mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&, mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall> const&, mp::TypeList<>&&)::'lambda'(mp::CancelMonitor&)::operator()(mp::CancelMonitor&) /root/bitcoin/src/ipc/libmultiprocess/include/mp/type-context.h:184:16
    [#8](/github-metadata-backup-bitcoin-bitcoin/8/) 0x559bd0d03e83 in kj::Promise<mp::Accessor<mp::mining_fields::Context, 17>> mp::ProxyServer<mp::Thread>::post<capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>, std::enable_if<std::is_same<decltype(mp::Accessor<mp::mining_fields::Context, 17>::get(fp1.call_context.getParams())), mp::Context::Reader>::value, kj::Promise<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>::CallContext>>::type mp::PassField<mp::Accessor<mp::mining_fields::Context, 17>, mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>, mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall>, mp::TypeList<>>(mp::Priority<1>, mp::TypeList<>, mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&, mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall> const&, mp::TypeList<>&&)::'lambda'(mp::CancelMonitor&)>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&&)::'lambda'()::operator()()::'lambda'()::operator()()::'lambda0'()::operator()() const /root/bitcoin/src/ipc/libmultiprocess/include/mp/proxy-io.h:791:100
    [#9](/github-metadata-backup-bitcoin-bitcoin/9/) 0x559bd0d03e83 in kj::Maybe<kj::Exception> kj::runCatchingExceptions<kj::Promise<mp::Accessor<mp::mining_fields::Context, 17>> mp::ProxyServer<mp::Thread>::post<capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>, std::enable_if<std::is_same<decltype(mp::Accessor<mp::mining_fields::Context, 17>::get(fp1.call_context.getParams())), mp::Context::Reader>::value, kj::Promise<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>::CallContext>>::type mp::PassField<mp::Accessor<mp::mining_fields::Context, 17>, mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>, mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall>, mp::TypeList<>>(mp::Priority<1>, mp::TypeList<>, mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&, mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall> const&, mp::TypeList<>&&)::'lambda'(mp::CancelMonitor&)>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&&)::'lambda'()::operator()()::'lambda'()::operator()()::'lambda0'()>(mp::Accessor<mp::mining_fields::Context, 17>&&) /usr/include/kj/exception.h:371:5
    [#10](/github-metadata-backup-bitcoin-bitcoin/10/) 0x559bd0d03244 in kj::Promise<mp::Accessor<mp::mining_fields::Context, 17>> mp::ProxyServer<mp::Thread>::post<capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>, std::enable_if<std::is_same<decltype(mp::Accessor<mp::mining_fields::Context, 17>::get(fp1.call_context.getParams())), mp::Context::Reader>::value, kj::Promise<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>::CallContext>>::type mp::PassField<mp::Accessor<mp::mining_fields::Context, 17>, mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>, mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall>, mp::TypeList<>>(mp::Priority<1>, mp::TypeList<>, mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&, mp::ServerRet<mp::Accessor<mp::mining_fields::Result, 18>, mp::ServerCall> const&, mp::TypeList<>&&)::'lambda'(mp::CancelMonitor&)>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&&)::'lambda'()::operator()()::'lambda'()::operator()() /root/bitcoin/src/ipc/libmultiprocess/include/mp/proxy-io.h:791:48
    [#11](/github-metadata-backup-bitcoin-bitcoin/11/) 0x559bd09ff32c in kj::Function<void ()>::operator()() /usr/include/kj/function.h:119:12
    [#12](/github-metadata-backup-bitcoin-bitcoin/12/) 0x559bd09ff32c in void mp::Unlock<mp::Lock, kj::Function<void ()>&>(mp::Lock&, kj::Function<void ()>&) /root/bitcoin/src/ipc/libmultiprocess/include/mp/util.h:216:5
    [#13](/github-metadata-backup-bitcoin-bitcoin/13/) 0x559bd1353632 in void mp::Waiter::wait<mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0::operator()() const::'lambda'()>(mp::Lock&, mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0::operator()() const::'lambda'())::'lambda'()::operator()() const /root/bitcoin/src/ipc/libmultiprocess/include/mp/proxy-io.h:411:17
    [#14](/github-metadata-backup-bitcoin-bitcoin/14/) 0x559bd1353632 in void std::condition_variable::wait<void mp::Waiter::wait<mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0::operator()() const::'lambda'()>(mp::Lock&, mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0::operator()() const::'lambda'())::'lambda'()>(std::unique_lock<std::mutex>&, mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0::operator()() const::'lambda'()) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/condition_variable:104:10
    [#15](/github-metadata-backup-bitcoin-bitcoin/15/) 0x559bd1353632 in void mp::Waiter::wait<mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0::operator()() const::'lambda'()>(mp::Lock&, mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0::operator()() const::'lambda'()) /root/bitcoin/src/ipc/libmultiprocess/include/mp/proxy-io.h:402:14
    [#16](/github-metadata-backup-bitcoin-bitcoin/16/) 0x559bd1353632 in mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0::operator()() const /root/bitcoin/src/ipc/libmultiprocess/src/mp/proxy.cpp:457:34
    [#17](/github-metadata-backup-bitcoin-bitcoin/17/) 0x559bd1353632 in void std::__invoke_impl<void, mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0>(std::__invoke_other, mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0&&) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/invoke.h:61:14
    [#18](/github-metadata-backup-bitcoin-bitcoin/18/) 0x559bd1353632 in std::__invoke_result<mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0>::type std::__invoke<mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0>(mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0&&) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/invoke.h:96:14
    [#19](/github-metadata-backup-bitcoin-bitcoin/19/) 0x559bd1353632 in void std::thread::_Invoker<std::tuple<mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0>>::_M_invoke<0ul>(std::_Index_tuple<0ul>) /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/std_thread.h:301:13
    [#20](/github-metadata-backup-bitcoin-bitcoin/20/) 0x559bd1353632 in std::thread::_Invoker<std::tuple<mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0>>::operator()() /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/std_thread.h:308:11
    [#21](/github-metadata-backup-bitcoin-bitcoin/21/) 0x559bd1353632 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<mp::ProxyServer<mp::ThreadMap>::makeThread(capnp::CallContext<mp::ThreadMap::MakeThreadParams, mp::ThreadMap::MakeThreadResults>)::$_0>>>::_M_run() /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/std_thread.h:253:13
    [#22](/github-metadata-backup-bitcoin-bitcoin/22/) 0x7f1f2b4e1223  (/lib/x86_64-linux-gnu/libstdc++.so.6+0xe1223) (BuildId: 133b71e0013695cc7832680a74edb51008c4fc4c)
    [#23](/github-metadata-backup-bitcoin-bitcoin/23/) 0x559bcff85eca in asan_thread_start(void*) asan_interceptors.cpp.o
    [#24](/github-metadata-backup-bitcoin-bitcoin/24/) 0x7f1f2b16fb7a  (/lib/x86_64-linux-gnu/libc.so.6+0x92b7a) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
    [#25](/github-metadata-backup-bitcoin-bitcoin/25/) 0x7f1f2b1ed7f7  (/lib/x86_64-linux-gnu/libc.so.6+0x1107f7) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)

==2545834==Register values:
rax = 0x0000000000000000  rbx = 0x00007f1f17dfe640  rcx = 0x00000a100000c1c5  rdx = 0xf8f8f8f8f8f8f8f8  
rdi = 0x0000508000060e28  rsi = 0x0000000000000000  rbp = 0x00007f1f17dfe6b0  rsp = 0x00007f1f17dfe640  
 r8 = 0x00007fffffffff01   r9 = 0x0000000000000f01  r10 = 0x00007fffffffff01  r11 = 0x1f7dac617a25ab01  
r12 = 0x00007f1f16d0dd00  r13 = 0x00007f1f16d0dd20  r14 = 0x00000fe3e2da1ba0  r15 = 0x00007f1f16f24d20  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/bitcoin/src/ipc/libmultiprocess/include/mp/proxy.h:289:16 in decltype(auto) mp::ProxyMethodTraits<ipc::capnp::messages::BlockTemplate::GetBlockParams, void>::invoke<mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>>(mp::ServerInvokeContext<mp::ProxyServer<ipc::capnp::messages::BlockTemplate>, capnp::CallContext<ipc::capnp::messages::BlockTemplate::GetBlockParams, ipc::capnp::messages::BlockTemplate::GetBlockResults>>&)
Thread T14 created by T2 (b-capnp-loop) here:
    [#0](/github-metadata-backup-bitcoin-bitcoin/0/) 0x559bcff6da85 in pthread_create (/root/bitcoin/build_ipc/bin/bitcoin-node+0x2dda85) (BuildId: d11cfc3a8fa13678be17dcb575c9c843f8b2555e)
    [#1](/github-metadata-backup-bitcoin-bitcoin/1/) 0x7f1f2b4e12f8 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State>>, void (*)()) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xe12f8) (BuildId: 133b71e0013695cc7832680a74edb51008c4fc4c)
    [#2](/github-metadata-backup-bitcoin-bitcoin/2/) 0x559bd1343a21 in mp::ThreadMap::Server::dispatchCallInternal(unsigned short, capnp::CallContext<capnp::AnyPointer, capnp::AnyPointer>) /root/bitcoin/build_ipc/src/ipc/libmultiprocess/include/mp/proxy.capnp.c++:701:9
    [#3](/github-metadata-backup-bitcoin-bitcoin/3/) 0x559bd1343a21 in mp::ThreadMap::Server::dispatchCall(unsigned long, unsigned short, capnp::CallContext<capnp::AnyPointer, capnp::AnyPointer>) /root/bitcoin/build_ipc/src/ipc/libmultiprocess/include/mp/proxy.capnp.c++:690:14
    [#4](/github-metadata-backup-bitcoin-bitcoin/4/) 0x559bd1343a21 in virtual thunk to mp::ThreadMap::Server::dispatchCall(unsigned long, unsigned short, capnp::CallContext<capnp::AnyPointer, capnp::AnyPointer>) /root/bitcoin/build_ipc/src/ipc/libmultiprocess/include/mp/proxy.capnp.c++

Thread T2 (b-capnp-loop) created by T0 here:
    [#0](/github-metadata-backup-bitcoin-bitcoin/0/) 0x559bcff6da85 in pthread_create (/root/bitcoin/build_ipc/bin/bitcoin-node+0x2dda85) (BuildId: d11cfc3a8fa13678be17dcb575c9c843f8b2555e)
    [#1](/github-metadata-backup-bitcoin-bitcoin/1/) 0x7f1f2b4e12f8 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State>>, void (*)()) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xe12f8) (BuildId: 133b71e0013695cc7832680a74edb51008c4fc4c)
    [#2](/github-metadata-backup-bitcoin-bitcoin/2/) 0x559bd09d5205 in ipc::capnp::(anonymous namespace)::CapnpProtocol::listen(int, interfaces::Init&, std::optional<unsigned long>) /root/bitcoin/src/ipc/capnp/protocol.cpp:88:9
    [#3](/github-metadata-backup-bitcoin-bitcoin/3/) 0x559bd09cda0e in ipc::(anonymous namespace)::IpcImpl::listenAddress(ipc::ListenAddress&) /root/bitcoin/src/ipc/interfaces.cpp:118:21
    [#4](/github-metadata-backup-bitcoin-bitcoin/4/) 0x559bcfffbc71 in AppInitMain(node::NodeContext&, interfaces::BlockAndHeaderTipInfo*) /root/bitcoin/src/init.cpp:1610:22
    [#5](/github-metadata-backup-bitcoin-bitcoin/5/) 0x559bcffcd660 in AppInit(node::NodeContext&) /root/bitcoin/src/bitcoind.cpp:244:43
    [#6](/github-metadata-backup-bitcoin-bitcoin/6/) 0x559bcffcd660 in main /root/bitcoin/src/bitcoind.cpp:286:10
    [#7](/github-metadata-backup-bitcoin-bitcoin/7/) 0x7f1f2b106ca7  (/lib/x86_64-linux-gnu/libc.so.6+0x29ca7) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)

==2545834==ABORTING

</details>

<details> <summary>LLM-generated diff to reproduce on a8b69bdeafdf7993ad42aa93a80d5fc938aef1cb:</summary>

--- a/test/functional/interface_ipc_mining.py
+++ b/test/functional/interface_ipc_mining.py
@@ -805,6 +805,22 @@
 
         asyncio.run(capnp.run(async_routine()))
 
+    def run_use_after_destroy_test(self):
+        """A BlockTemplate method called after destroy() must fail cleanly, not crash the node."""
+        self.log.info("Running use-after-destroy test")
+
+        async def async_routine():
+            ctx, mining = await make_mining_ctx(self)
+            template = (await mining.createNewBlock(ctx, self.default_block_create_options)).result
+            await template.destroy(ctx)
+            try:
+                await template.getBlock(ctx)
+            except capnp.lib.capnp.KjException:
+                pass
+
+        asyncio.run(capnp.run(async_routine()))
+        self.nodes[0].getblockcount()  # node must still be alive
+
     def run_test(self):
         self.miniwallet = MiniWallet(self.nodes[0])
         # Amount of time in milliseconds the test is allowed to wait or be idle before it should fail.
@@ -821,6 +837,7 @@
         self.run_block_max_weight_test()
         self.run_ipc_option_override_test()
         self.run_transaction_lookup_test()
+        self.run_use_after_destroy_test()
 
         # Needs to run last because it resets the chain.
         self.run_low_height_test()

</details>

Ran into this with fuzzamoto.

fanquake commented at 11:38 PM on October 11, 2026: member

cc @ryanofsky @Sjors
willcl-ark added the label IPC on Oct 15, 2026
ryanofsky commented at 5:26 AM on October 15, 2026: contributor

have no idea if this has been discussed / disregarded somewhere else.

Thanks for the report! This needs to be fixed in libmultiprocess so I opened an issue https://github.com/bitcoin-core/libmultiprocess/issues/378 there suggesting an approach. I'm pretty sure this is the first public report of this problem, though it's something I've known about and there was a nonpublic reports of it previously. Fixing this would not stop misbehaving IPC clients from being able to crash the node generally, but it would get rid of an easy way to crash the node that could also be triggered accidentally.
Crypt-iQ commented at 11:33 AM on October 15, 2026: contributor

Fixing this would not stop misbehaving IPC clients from being able to crash the node generally

Since IPC clients are privileged, I understand that crashes are no big deal? Is there a plan to fix all ways of a misbehaving IPC client being able to crash the node? If so, it would be nice (when they are all fixed) since it would let us run fuzzamoto + IPC continuously.
Sjors commented at 12:13 AM on October 16, 2026: member

Since IPC clients are privileged, I understand that crashes are no big deal?

They are not considered a vulnerability currently, since IPC support (at least for mining) is considered experimental. But they should be fixed.

it would let us run fuzzamoto + IPC continuously

That's another benefit of fixing these bugs as we find them.

It would be great if you can run it again after we fix the (currently) known crashes.
ryanofsky commented at 1:03 AM on October 16, 2026: contributor

Is there a plan to fix all ways of a misbehaving IPC client being able to crash the node?

I think we will probably have different stability guarantees and compatibility guarantees for different interfaces. For example #29409 is now providing separate Chain and UnstableChain interfaces (though the motivation for splitting that was more for compatibility than stability). I don't think it will be a goal to try to stop all IPC clients from being able to crash the node, because some for use-cases like GUI IPC clients controlling the node it might not be practical to try to protect the node from its GUI.

If so, it would be nice (when they are all fixed) since it would let us run fuzzamoto + IPC continuously.

This should definitely be a goal. Maybe we should add an -ipcbind safe or fuzztest option that blocks IPC method calls we know are not currently safe for fuzzing.
Crypt-iQ commented at 10:55 AM on October 28, 2026: contributor

It would be great if you can run it again after we fix the (currently) known crashes.

Yes will do

This should definitely be a goal. Maybe we should add an -ipcbind safe or fuzztest option that blocks IPC method calls we know are not currently safe for fuzzing.

Yes this would make it easier so the fuzzer doesn't get stuck on the to-be-fixed parts

Contributors

Labels

Linked (view graph)

#1 JSON-RPC support for mobile devices ("ultra-lightweight" clients)#2 Long-term, safe, store-of-value #3 Encrypt wallet #4 Export/Import wallet in a human readable, future-proof format #5 Make the version number the protocol version and not the client version #6 Treat wallet as a generic keystore #7 Block-header-only, faster startup client #8 RPC command to sign text with wallet private key #9 Fix for GUI on Macs and latest wxWidgets #10 Add address to listtransactions output #11 Nolisten patch #12 Monitor transactions and/or blocks #13 Messages with or about transactions #14 bitcoin: URI and/or bitcoin-request MIME type for click-to-pay #15 Option to specify external IP address #16 Mac UI issues #17 listaccounts method #18 Error when trying to send very precise amount #19 bitcoin(d) --help should output version number #20 JSON-RPC callback #21 Add time to category:move transactions #22 Update the list of hard-coded node IP addresses #23 CORS support #24 Gettransaction #25 sum(getaccounts) != getbalance