Skip to content

Conversation

ismaelsadeeq
Copy link
Member

This PR fixes an unsigned integer overflow in the addPackageTxs method of the BlockAssembler.

The overflow is a rare edge case that might occur on master when a miner reserves 2000 WU and wants to create an block to be empty.

i.e, by starting with -blockmaxweight=2000, -blockreservedweight=2000, or just blockmaxweight=2000, and then calling the mining interface createNewBlock with blockReservedWeight set to 2000.

Instead of bailing out after going through transactions equivalent to MAX_CONSECUTIVE_FAILURES, the loop never breaks until all mempool transactions are visited.

See #33421 (comment)

The fix avoids the overflow by using addition instead adding BLOCK_FULL_ENOUGH_WEIGHT_DELTA to the block weight and comparing it with m_options.nBlockMaxWeight.

Another alternative that preserves the same structure is to use static_cast. See c9530cf.

This fix can be tested by cherry-picking the commits from #33421 without the static cast fix and running:

echo "AQAAAAAAA
AAnJycnAAAAAAAAAAAAAAAAAA" | base64 --decode > miner.crash

FUZZ=block_template_cache ./build_fuzz/bin/fuzz miner.crash

This is part of a larger inconsistency in how size/weight is represented in the codebase. It may be worth defining a dedicated type for size/weight.

@DrahtBot
Copy link
Contributor

DrahtBot commented Sep 24, 2025

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/33475.

Reviews

See the guideline for information on the review process.

Type Reviewers
ACK glozow, furszy
Concept ACK luke-jr

If your review is incorrectly listed, please react with 👎 to this comment and the bot will ignore it on the next update.

Conflicts

Reviewers, this pull request conflicts with the following ones:

  • #33421 (node: add BlockTemplateCache by ismaelsadeeq)
  • #28676 (Cluster mempool implementation by sdaftuar)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

Copy link
Member

@glozow glozow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice, utACK b807dfc

@glozow glozow added the Bug label Sep 24, 2025
Copy link
Member

@furszy furszy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code ACK b807dfc

Copy link
Member

@luke-jr luke-jr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

utACK

luke-jr pushed a commit to bitcoinknots/bitcoin that referenced this pull request Sep 25, 2025
@fanquake fanquake merged commit 05d984b into bitcoin:master Sep 25, 2025
20 checks passed
fanquake pushed a commit to fanquake/bitcoin that referenced this pull request Sep 25, 2025
@fanquake
Copy link
Member

Backported to 30.x in #33473.

@ismaelsadeeq ismaelsadeeq deleted the 09-2025-miner-infinite-loop-fix branch September 25, 2025 12:29
@DrahtBot DrahtBot mentioned this pull request Sep 25, 2025
8 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants