CCAN: update to upstream after kimi audit. - #9396
Open
rustyrussell wants to merge 5 commits into
Open
Conversation
rustyrussell
marked this pull request as draft
August 11, 2026 02:55
Lots of changes, so I've summarized the individual upstream commits.
May alter (fix!) CLN behavior:
* 6b4e62ec tal/path: path_simplify() ".." handling
* 4ceeef2b io: don't busy-spin with exclusive conn + pending always plan
* 64822afc io: listener fds O_NONBLOCK
* b02c1147, 2f04573d, 42486358 pipecmd: _exit, pre-fork fd leak, EINTR
* f7062e12, 6da9c78d fdpass: reject-path fd leak, errno sign
* 339b359a breakpoint: blocked-SIGTRAP + fork staleness (--dev-debugger only)
* 018a4977 take: keep labelarr in sync in taken() (debug builds would give wrong taken() error)
* 28f7c3fe check_type: hard-fail (would cause build-time failure)
The rest are not patterns used by CLN, or only happen on allocation failure (which always causes immediate exit):
* 4122d490 tal/str: count regex capture groups via re_nsub, not text scan. No such complex regexes used.
* 5b6fca2c tal: allow tal_steal() to rescue an object being destroyed; we don't do this.
* tal: 9da96c88 (CCAN_LIST_DEBUG only), ca38d33a (notifier edge), 328d96ff (needs type-mismatched tal_expand), 39d1a0a0 (harmless thinko), df66b082
(path_readlink unused), 80416994 (UB never dereferenced), 0e926004 (doc), 3217faca (zero st_size; no /proc reads in CLN), 5d86e1fe (doc)
* c0c9797f str: strcount empty needle - both CLN call sites pass constant non-empty needles
* htable: af8ff95e (init_sized unused), d3da4521 (32-bit), ba8c4ad2 (needs billions of entries)
* opt: 6c3faecc (bare '-' argv), dae5f5f4 (attribute/doc; CLN passes real args)
* timer: f7b21467 (36k years at default granularity), 1127eb30 (needs failing custom allocator - CLN aborts on OOM)
* mem: 351072ac (memcchr unused), dde9474c (fallback memrchr - glibc/musl provide it), 228161d9 (test), f5b48d0f (doc)
* json_out: f14769e3, e9893f9e, d0401012, c91ae47b - all OOM/encoding-error paths; CLN aborts on OOM
* membuf: 4ee105f0 (UB, correct results anyway), 4b2d55b8 (2^62-element buffers)
* rune: cc63dceb (rune_dup unused), 51257cd9 (CLN fieldnames are alnum), fb4dbfa6 (needs embedded-NUL field values)
* strset/strmap iterator rework: b5dcf30e, 19b73d88, 51c4da92, c127ff33 - additive API + recursion fix; CLN's maps are far too small to hit deep
trees
* crypto: 1c377ffb (32-bit only), 344ba97c (needs 8160-byte HKDF requests), b4316b44 (default SHACHAIN_BITS=64 immune)
* f2b445b3 str/base32: CLN's one call site passes an exact-size buffer
* intmap 1a1bb440 (sintmap unused), bitmap ab052a14 (2^61 bits), likely 8cfa5f8c (likely_stats unused), take e30e011d (only take_cleanup() on exit), rbuf 748a0692 (rbuf_fill unused), ptr_valid x4 (unused), cdump x3 (cdump_extract unused)
* asort: 0d54244f, a13c9b97, d878b036 - fallback/build-hygiene only; CLN on glibc takes the qsort_r path and already compiled
* Doc-only: 2b988863, 3e034139, 8fee253f, e3155f93, 6e830d68, 172ae94c, cbbd603e, 6f0b1b03
* Test-only: 46acc9b6, 9df9809e, 4c23c54c
* 5b2773b2 build_assert: _Static_assert - compile-time only; all 138 CLN uses are constants (same 138-use build check applies as check_type)
* 01fbf784 container_of: NULL+0 UB fix - behavior identical
* 0421034f cppmagic sentinel, 43cfe853 ilog ilog64 - portability/performance only
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
rustyrussell
force-pushed
the
ccan-after-audit
branch
from
August 21, 2026 01:19
6fbfdf1 to
3ffd6df
Compare
The addition of GitHub CI to CCAN, especially 32 bit builds and MacOS tests lead to more refinement (mostly in tests), so this catches up to that. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
rustyrussell
force-pushed
the
ccan-after-audit
branch
from
September 10, 2026 11:47
3ffd6df to
061346a
Compare
rustyrussell
marked this pull request as ready for review
September 10, 2026 11:47
rustyrussell
force-pushed
the
ccan-after-audit
branch
from
September 10, 2026 11:47
061346a to
e5ca337
Compare
Two more commits, which fix warnings:
```
In file included from ccan/ccan/strmap/strmap.h:5,
from ./common/memleak.h:4,
from lightningd/channel_gossip.c:5:
lightningd/channel_gossip.c: In function ‘broadcast_new_gossip’:
ccan/ccan/build_assert/build_assert.h:56:17: error: anonymous struct declared inside parameter list will not be visible outside of this definition or declaration [-Werror]
56 | (sizeof(struct { _Static_assert(cond, "BUILD_ASSERT_OR_ZERO"); char c; }) - 1)
| ^~~~~~
ccan/ccan/typesafe_cb/typesafe_cb.h:35:46: note: in definition of macro ‘typesafe_cb_cast’
35 | oktype), \
| ^~~~~~
./lightningd/subd.h:184:19: note: in expansion of macro ‘typesafe_cb_preargs’
184 | typesafe_cb_preargs(void, void *, \
| ^~~~~~~~~~~~~~~~~~~
lightningd/channel_gossip.c:415:9: note: in expansion of macro ‘subd_req’
415 | subd_req(ld->gossip, ld->gossip,
| ^~~~~~~~
ccan/ccan/cast/cast.h:47:14: note: in expansion of macro ‘BUILD_ASSERT_OR_ZERO’
47 | (0 ? BUILD_ASSERT_OR_ZERO(cast_const_compat1((expr), type)) : \
| ^~~~~~~~~~~~~~~~~~~~
lightningd/channel_gossip.c:417:42: note: in expansion of macro ‘cast_const’
417 | -1, 0, addgossip_reply, cast_const(char *, desc));
| ^~~~~~~~~~
cc1: all warnings being treated as errors
```
And
```
ccan/ccan/cdump/cdump.c: In function ‘tok_take_conglom’:
ccan/ccan/cdump/cdump.c:272:35: error: ‘%.*s’ directive argument is null [-Werror=format-overflow=]
272 | "Line %u: '%.*s': %s\n",
| ^~~~
cc1: all warnings being treated as errors
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
rustyrussell
force-pushed
the
ccan-after-audit
branch
from
September 14, 2026 01:05
e5ca337 to
adbb764
Compare
In practice, this is behind a branch where it can't occur: gcc-13 doesn't
mind, but gcc-12 does.
```
In function ‘handle_fee_and_ppm’,
inlined from ‘continue_splice.part.0’ at plugins/spender/splice.c:1669:12:
plugins/spender/splice.c:1415:38: error: ‘funding_wallet_index’ may be used uninitialized [-Werror=maybe-uninitialized]
1415 | && splice_cmd->states[funding_wallet_index]->state != SPLICE_CMD_PENDING) {
| ^
plugins/spender/splice.c: In function ‘continue_splice.part.0’:
plugins/spender/splice.c:1394:16: note: ‘funding_wallet_index’ was declared here
1394 | size_t funding_wallet_index;
| ^~~~~~~~~~~~~~~~~~~~
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Our own common/utils.h COMPILER_WANTS_INIT was promoted to a proper CCAN helper, but slightly generalized with another arg to indicate the initializer to use, rather than assuming "0". So fix up the handful of users. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lots of changes, so I've summarized the individual upstream commits.
May alter (fix!) CLN behavior:
The rest are not patterns used by CLN, or only happen on allocation failure (which always causes immediate exit):
Added two more for warning fixes:
Changelog-None