renepay plugin crash while paying an offer invoice

[vincenzopalazzo]

I have the following bol 12 invoice lno1qgsqvgnwgcg35z6ee2h3yczraddm72xrfua9uve2rlrm9deu7xyfzrc2yfxkjmn9wgsrzgrvd9nksarwd9hxwgrsv9uk7at5ypnx7u3qda3k2ctwzcss98x6ecf95avm2gz9gder7dy6fxm568rt23g7paa2kzrkxrvh6nrp

and the following channels

[2024-02-27T16:12:21Z INFO  cln_integration] channels before paying: [{"source":"029cdace125a759b5204543723f349a49b74d1c6b5451e0f7aab087630d97d4c61","destination":"03a7b53e2ff34380703ec263540f0ba29291d7cfd5132782255677e13671a9e42b","short_channel_id":"162x1x0","public":true,"amount_msat":49999974217000,"message_flags":1,"channel_flags":0,"active":true,"last_update":1709050339,"base_fee_millisatoshi":1,"fee_per_millionth":10,"delay":6,"htlc_minimum_msat":0,"htlc_maximum_msat":49499974475000,"features":""},{"source":"03a7b53e2ff34380703ec263540f0ba29291d7cfd5132782255677e13671a9e42b","destination":"029cdace125a759b5204543723f349a49b74d1c6b5451e0f7aab087630d97d4c61","short_channel_id":"162x1x0","public":true,"amount_msat":49999974217000,"message_flags":1,"channel_flags":1,"active":true,"last_update":1709050339,"base_fee_millisatoshi":1,"fee_per_millionth":10,"delay":6,"htlc_minimum_msat":0,"htlc_maximum_msat":49499974475000,"features":""}]

I get the following crash

cln-renepay: plugins/renepay/mcf.c:1233: pseudorand_interval: Assertion `b > a' failed.
cln-renepay: FATAL SIGNAL 6 (version v23.11.2)
0x4249d6 send_backtrace
	???:0
0x424a6c crashdump
	???:0
0x7ffff7b90eaf ???
	???:0
0x7ffff7be007c __pthread_kill_implementation
	???:0
0x7ffff7b90e05 raise
	???:0
0x7ffff7b798f4 abort
	???:0
0x7ffff7b79818 __assert_fail_base.cold
	???:0
0x7ffff7b89685 __assert_fail
	???:0
0x40e5d8 pseudorand_interval
	???:0
0x40ea8d get_flow_paths
	???:0
0x40f283 minflow
	???:0
0x40917b add_payflows
	???:0
0x407965 try_paying
	???:0
0x407c25 listpeerchannels_done
	???:0
0x4160b2 handle_rpc_reply
	???:0
0x416255 rpc_read_response_one
	???:0
0x416302 rpc_conn_read_response
	???:0
0x4453cd next_plan
	???:0
0x445851 do_plan
	???:0
0x4458ea io_ready
	???:0
0x447152 io_loop
	???:0
0x416687 plugin_main
	???:0
0x407d53 main
	???:0
0x7ffff7b7b0cd __libc_start_call_main
	???:0
0x7ffff7b7b188 __libc_start_main_impl
	???:0
0x404954 _start
	???:0
0xffffffffffffffff ???
	???:0
cln-renepay: FATAL SIGNAL 11 (version v23.11.2)
0x4249d6 send_backtrace
	???:0
0x424a6c crashdump
	???:0
0x7ffff7b90eaf ???
	???:0
0x0 ???
	???:0

[cdecker]

There is a second stacktrace by @Sjors here: https://github.com/ElementsProject/lightning/issues/7126#issuecomment-1976411464

[Sjors]

Given the other one was closed, I suggest renaming this to omit "offer", because the crash happens with bolt11 too.

[Lagrang3]

I have not worked yet on BOLT12 support on renepay. Until I do I will place some lines to make it refuse BOLT12 requests.

On the other hand, the assertion seems to be raised when some channel along the route has max_htlc = min_htlc. I will PR a quick fix and some test case if my reasoning is correct.

[Lagrang3]

That's it, this is the fix, there is nothing more to add.

diff --git a/plugins/renepay/mcf.c b/plugins/renepay/mcf.c
index c3f54b6b9..21467ef1a 100644
--- a/plugins/renepay/mcf.c
+++ b/plugins/renepay/mcf.c
@@ -1230,6 +1230,8 @@ struct list_data
 
 static inline uint64_t pseudorand_interval(uint64_t a, uint64_t b)
 {
+       if (a == b)
+               return b;
        assert(b > a);
        return a + pseudorand(b - a);
 }

I was actually working on adding a reg-test but I don't think the overhead of having an extra test that triggers only this bug is worth the extra cycles.