From e2d5c1bbe01370dbf75e2118d697a159c4ee582b Mon Sep 17 00:00:00 2001 From: Bitflash Date: Fri, 31 Jul 2026 14:26:50 -0300 Subject: net: bound orphan blocks and stop asking a peer the same question twice (#70) Two defects that feed each other. Measured on a 32-core production node: 1287 of 4117 processed blocks arrived with a missing parent, 97 arrived that the node already had, and 490 transactions arrived whose inputs were unknown. mapOrphanBlocks had no ceiling at all. Orphan transactions have had one since 0.1.0 -- MAX_ORPHAN_TRANSACTIONS with LimitOrphanTx -- and blocks never did. An orphan block whose parent never turns up stays in memory for the life of the process, each one holding a whole block, and a peer can send an unlimited number of them just by inventing the previous-block hash. LimitOrphanBlocks mirrors the transaction one: random eviction, both maps kept in step, and the CBlock deleted because mapOrphanBlocks owns it. Every orphan block also fired a getblocks at the sender, and an inv for a block already held as an orphan fired another, with no filtering. So a node missing part of the chain asked the same peer the same question over and over, and the duplicate answers made more orphans, which asked again. CNode::PushGetBlocks remembers the last request and drops a repeat -- the same fix Bitcoin made in e2c2648c1. One trap found by testing rather than by reading: eviction picks at random and may pick the block just inserted, so GetOrphanRoot has to be read out of pblock before LimitOrphanBlocks runs, not after. The first version had that backwards and would have read freed memory. Verified with fabricated orphans, four of the seven sharing one hashPrevBlock so the multimap path is exercised: 7 in, limit(3) leaves 3, limit(0) leaves 0, both maps in step at every stage, no crash. Then a run against the live network to 4348 with no scaffolding left behind. The storm itself was not reproducible on demand -- the network is healthy today and produced one orphan block in seven minutes -- so there is no before/after on the metric that motivated this. --- src/main.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'src/main.h') diff --git a/src/main.h b/src/main.h index 2d5cb86..3bc1219 100644 --- a/src/main.h +++ b/src/main.h @@ -18,6 +18,13 @@ static const unsigned int MAX_SIZE = 0x02000000; // Ceiling on transactions held waiting for a parent that has not arrived. // They cost a peer nothing to send and are never validated, only stored. static const unsigned int MAX_ORPHAN_TRANSACTIONS = 100; +// Blocks held waiting for a parent that has not arrived. Orphan transactions +// have had a ceiling since 0.1.0 and orphan blocks never did: one whose parent +// never turns up stays in memory for the life of the process, and a peer can +// send an unlimited number of them by inventing the previous-block hash. They +// are not free either -- each holds a whole block. A production node was +// seeing 1287 of them against 4117 blocks processed. +static const unsigned int MAX_ORPHAN_BLOCKS = 200; // Signature operations allowed in one block. Size alone does not bound what a // block costs to validate: every OP_CHECKSIG is an elliptic-curve verification, // so a block within the size limit could still hold millions of them and take @@ -125,6 +132,8 @@ void PrintBlockTree(); void AddOrphanTx(const CDataStream& vMsg); void EraseOrphanTx(uint256 hash); void LimitOrphanTx(unsigned int nMaxOrphans); +// Same ceiling idea for orphan blocks, which never had one. +void LimitOrphanBlocks(unsigned int nMaxOrphans); // nThreadId is 1..N, only for logging: it makes each miner's lines // distinguishable, which the dedup filter would otherwise collapse into one. bool BitcoinMiner(int nThreadId = 1); -- cgit v1.2.3