Repository navigation
Fix return types of three module API declarations to match definitions - #4676
Merged
madolson merged 1 commit intoSep 16, 2026
Merged
Conversation
ValkeyModule_FreeModuleUser, ValkeyModule_ACLAddLogEntry and ValkeyModule_ACLAddLogEntryByUserName are declared in valkeymodule.h as returning void, but the implementations (VM_FreeModuleUser, VM_ACLAddLogEntry, VM_ACLAddLogEntryByUserName) return int, and the latter two document VALKEYMODULE_OK / VALKEYMODULE_ERR. Modules calling them through the API table therefore call an int function via a void function pointer, which is undefined behavior in C. On x86-64 and arm64 the discarded return register makes it harmless in practice; on a target with strict indirect-call signature checking (WebAssembly) the call traps. Declare them as int to match the implementation. Existing modules that ignore the return value are unaffected; modules can now check the result of the ACL log calls as documented. Also document that FreeModuleUser returns VALKEYMODULE_OK. Found by compiling the server with Emscripten, where redis.acl_check_cmd in a Lua script (which calls FreeModuleUser through the API table) trapped with 'null function or function signature mismatch'. Signed-off-by: Rain Valentine <rsg000@gmail.com>
Contributor
|
No actionable comments were generated in the recent review. ð âđïļ Recent review infoâïļ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Advanced Run ID: ð Files selected for processing (2)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. ð WalkthroughWalkthroughThe public declarations for module-user cleanup and ACL log entry functions now return ChangesModule API return contracts
Priority: â Normal Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: Merge Risk: ⊠Minimal · up to This update aligns the public module API declarations with their implemented return values without changing executable behavior, so it is ready to merge. ðĨ Pre-merge checks | â 4 | â 1â Failed checks (1 warning)
â Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 too large.)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Reportâ
All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## unstable #4676 +/- ##
============================================
+ Coverage 80.28% 80.30% +0.01%
============================================
Files 191 191
Lines 98345 98345
============================================
+ Hits 78958 78974 +16
+ Misses 19387 19371 -16
ð New features to boost your workflow:
|
rainsupreme
changed the title
rainsupreme
marked this pull request as ready for review
September 16, 2026 02:00
madolson
added this to
Valkey 9.2, Valkey 9.1, Valkey 9.0, Valkey 8.1, Valkey 8.0 and Valkey 7.2
valkeyrie-ops Bot
pushed a commit
that referenced
this pull request
Sep 16, 2026
![valkeyrie-bot[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
#4676) `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` are declared in valkeymodule.h as returning void, but the implementations (`VM_FreeModuleUser`, `VM_ACLAddLogEntry`, `VM_ACLAddLogEntryByUserName`) return int, and the latter two document `VALKEYMODULE_OK` / `VALKEYMODULE_ERR`. Modules calling them through the API table therefore call an int function via a void function pointer, which is undefined behavior in C. On x86-64 and arm64 the discarded return register makes it harmless in practice; on a target with strict indirect-call signature checking (WebAssembly) the call traps. Declare them as int to match the implementation. Existing modules that ignore the return value are unaffected; modules can now check the result of the ACL log calls as documented. Also document that `FreeModuleUser` returns `VALKEYMODULE_OK`. Found by compiling the server with Emscripten, where `redis.acl_check_cmd` in a Lua script (which calls `FreeModuleUser` through the API table) trapped with 'null function or function signature mismatch'. Signed-off-by: Rain Valentine <rsg000@gmail.com> Backport-Source-PR: 4676
valkeyrie-ops Bot
pushed a commit
that referenced
this pull request
Sep 16, 2026
#4676) `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` are declared in valkeymodule.h as returning void, but the implementations (`VM_FreeModuleUser`, `VM_ACLAddLogEntry`, `VM_ACLAddLogEntryByUserName`) return int, and the latter two document `VALKEYMODULE_OK` / `VALKEYMODULE_ERR`. Modules calling them through the API table therefore call an int function via a void function pointer, which is undefined behavior in C. On x86-64 and arm64 the discarded return register makes it harmless in practice; on a target with strict indirect-call signature checking (WebAssembly) the call traps. Declare them as int to match the implementation. Existing modules that ignore the return value are unaffected; modules can now check the result of the ACL log calls as documented. Also document that `FreeModuleUser` returns `VALKEYMODULE_OK`. Found by compiling the server with Emscripten, where `redis.acl_check_cmd` in a Lua script (which calls `FreeModuleUser` through the API table) trapped with 'null function or function signature mismatch'. Signed-off-by: Rain Valentine <rsg000@gmail.com> Backport-Source-PR: 4676
valkeyrie-ops Bot
pushed a commit
that referenced
this pull request
Sep 16, 2026
#4676) `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` are declared in valkeymodule.h as returning void, but the implementations (`VM_FreeModuleUser`, `VM_ACLAddLogEntry`, `VM_ACLAddLogEntryByUserName`) return int, and the latter two document `VALKEYMODULE_OK` / `VALKEYMODULE_ERR`. Modules calling them through the API table therefore call an int function via a void function pointer, which is undefined behavior in C. On x86-64 and arm64 the discarded return register makes it harmless in practice; on a target with strict indirect-call signature checking (WebAssembly) the call traps. Declare them as int to match the implementation. Existing modules that ignore the return value are unaffected; modules can now check the result of the ACL log calls as documented. Also document that `FreeModuleUser` returns `VALKEYMODULE_OK`. Found by compiling the server with Emscripten, where `redis.acl_check_cmd` in a Lua script (which calls `FreeModuleUser` through the API table) trapped with 'null function or function signature mismatch'. Signed-off-by: Rain Valentine <rsg000@gmail.com> Backport-Source-PR: 4676
This was referenced Sep 15, 2026
valkeyrie-ops Bot
pushed a commit
that referenced
this pull request
Sep 17, 2026
#4676) `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` are declared in valkeymodule.h as returning void, but the implementations (`VM_FreeModuleUser`, `VM_ACLAddLogEntry`, `VM_ACLAddLogEntryByUserName`) return int, and the latter two document `VALKEYMODULE_OK` / `VALKEYMODULE_ERR`. Modules calling them through the API table therefore call an int function via a void function pointer, which is undefined behavior in C. On x86-64 and arm64 the discarded return register makes it harmless in practice; on a target with strict indirect-call signature checking (WebAssembly) the call traps. Declare them as int to match the implementation. Existing modules that ignore the return value are unaffected; modules can now check the result of the ACL log calls as documented. Also document that `FreeModuleUser` returns `VALKEYMODULE_OK`. Found by compiling the server with Emscripten, where `redis.acl_check_cmd` in a Lua script (which calls `FreeModuleUser` through the API table) trapped with 'null function or function signature mismatch'. Signed-off-by: Rain Valentine <rsg000@gmail.com> Backport-Source-PR: 4676
sarthakaggarwal97
pushed a commit
that referenced
this pull request
Oct 15, 2026
#4676) `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` are declared in valkeymodule.h as returning void, but the implementations (`VM_FreeModuleUser`, `VM_ACLAddLogEntry`, `VM_ACLAddLogEntryByUserName`) return int, and the latter two document `VALKEYMODULE_OK` / `VALKEYMODULE_ERR`. Modules calling them through the API table therefore call an int function via a void function pointer, which is undefined behavior in C. On x86-64 and arm64 the discarded return register makes it harmless in practice; on a target with strict indirect-call signature checking (WebAssembly) the call traps. Declare them as int to match the implementation. Existing modules that ignore the return value are unaffected; modules can now check the result of the ACL log calls as documented. Also document that `FreeModuleUser` returns `VALKEYMODULE_OK`. Found by compiling the server with Emscripten, where `redis.acl_check_cmd` in a Lua script (which calls `FreeModuleUser` through the API table) trapped with 'null function or function signature mismatch'. Signed-off-by: Rain Valentine <rsg000@gmail.com> Backport-Source-PR: 4676
sarthakaggarwal97
pushed a commit
that referenced
this pull request
Oct 15, 2026
#4676) `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` are declared in valkeymodule.h as returning void, but the implementations (`VM_FreeModuleUser`, `VM_ACLAddLogEntry`, `VM_ACLAddLogEntryByUserName`) return int, and the latter two document `VALKEYMODULE_OK` / `VALKEYMODULE_ERR`. Modules calling them through the API table therefore call an int function via a void function pointer, which is undefined behavior in C. On x86-64 and arm64 the discarded return register makes it harmless in practice; on a target with strict indirect-call signature checking (WebAssembly) the call traps. Declare them as int to match the implementation. Existing modules that ignore the return value are unaffected; modules can now check the result of the ACL log calls as documented. Also document that `FreeModuleUser` returns `VALKEYMODULE_OK`. Found by compiling the server with Emscripten, where `redis.acl_check_cmd` in a Lua script (which calls `FreeModuleUser` through the API table) trapped with 'null function or function signature mismatch'. Signed-off-by: Rain Valentine <rsg000@gmail.com> Backport-Source-PR: 4676
sarthakaggarwal97
pushed a commit
that referenced
this pull request
Oct 15, 2026
#4676) `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` are declared in valkeymodule.h as returning void, but the implementations (`VM_FreeModuleUser`, `VM_ACLAddLogEntry`, `VM_ACLAddLogEntryByUserName`) return int, and the latter two document `VALKEYMODULE_OK` / `VALKEYMODULE_ERR`. Modules calling them through the API table therefore call an int function via a void function pointer, which is undefined behavior in C. On x86-64 and arm64 the discarded return register makes it harmless in practice; on a target with strict indirect-call signature checking (WebAssembly) the call traps. Declare them as int to match the implementation. Existing modules that ignore the return value are unaffected; modules can now check the result of the ACL log calls as documented. Also document that `FreeModuleUser` returns `VALKEYMODULE_OK`. Found by compiling the server with Emscripten, where `redis.acl_check_cmd` in a Lua script (which calls `FreeModuleUser` through the API table) trapped with 'null function or function signature mismatch'. Signed-off-by: Rain Valentine <rsg000@gmail.com> Backport-Source-PR: 4676
This was referenced Oct 23, 2026
sarthakaggarwal97
added a commit
that referenced
this pull request
Oct 26, 2026
> [!NOTE] > **Opened ready despite 5 flagged items** (`force_ready` was set): model declined to note some included PRs; notes flagged low-confidence; release-safety guardrail overrode AI triage; AI triaged PRs without release-notes (confirm include/exclude); notes with an unconfirmed cherry-pick origin. Review the sections below and confirm before merging. Cuts **7.2.15** onto release line `7.2`. - Promotes the release notes into a dated section, bumps `src/version.h`, and refreshes the running contributor list. - Release notes computed over the range below (`7.2.14..b533888`): ``` mode: ga source_ref: 7.2 target_branch: 7.2 base: 7.2.14 @ 499cfb9 head: b533888 @ b533888 ``` ###â ïļ Model declined to note these PRs Selected for the notes but no bullet was generated, so they are **absent** from the dated section: #4383. Confirm each omission and re-cut if one should be noted. ###â ïļ Notes to double-check The generator flagged these notes low-confidence; confirm category and wording before merging: | PR | Category | Why flagged | |----|----------|-------------| | #3721 | Bug Fixes | intentional behavior/config change in a patch release; needs maintainer confirmation | | #4676 | Bug Fixes | could be Module API Changes instead of Bug Fixes | | #4823 | Bug Fixes | explicit impact scope omitted: 32-bit | ### Release-impact review Code detected release-impact terms (availability, memory safety, data integrity, access control, protocol, compatibility) in these PRs; this forces review, it is not a severity classification. The requested urgency is **SECURITY**. Confirm it and decide whether any change needs a hand-authored **Security Fixes** entry:â ïļ [#3972](#3972) names **CVE-2026-21863**. A named CVE normally ships with `SECURITY` urgency and a hand-authored **Security Fixes** entry; this holds the cut at any other urgency. <details> <summary>18 PR(s) with impact signals</summary> | PR | Title | Signal | |----|-------|--------| | [#4211](#4211) | Prevent double-free of the module timer when the callback stops it | memory-safety risk | | [#3971](#3971) | Fix GEORADIUS STORE ACL bypass via duplicate options | security, access-control, or injection hardening | | [#4383](#4383) | Tests: Add subject alternative names to the TLS test certificates | security, access-control, or injection hardening | | [#3922](#3922) | Harden stream validation on RDB load against crafted metadata | server crash, assertion, or availability failure | | [#4212](#4212) | Fix/ready key blocked client uaf | memory-safety risk | | [#4360](#4360) | Fix use-after-free crash when cluster messages arrive after module unload | memory-safety risk | | [#4410](#4410) | Fix out-of-bounds access in cluster message receivers | memory-safety risk | | [#3984](#3984) | AOF loading must not check ACL permissions | data or persisted-state corruption risk | | [#3721](#3721) | Force listpack validation on load to prevent deferred assertions | security, access-control, or injection hardening | | [#4307](#4307) | Fix VLA stack overflow in TLS writev after write failure | server crash, assertion, or availability failure | | [#3972](#3972) | Validate PUBLISH and MODULE payload lengths against packet size | server crash, assertion, or availability failure | | [#4395](#4395) | Fix mem_clients_type_memory leak for cached primary client | server crash, assertion, or availability failure | | [#4676](#4676) | Fix return types of three module API declarations to match definitions | security, access-control, or injection hardening | | [#3598](#3598) | fix: validate key count before allocating result in keyspec | undefined behavior or unsafe arithmetic | | [#4214](#4214) | fix(acl): prevent NULL pointer dereference on malformed selector in ACL file | server crash, assertion, or availability failure | | [#4733](#4733) | Fix sds overflow assert on RESTORE payload with an overflowing string length | server crash, assertion, or availability failure | | [#4489](#4489) | Hold no descriptor on nodes.conf when rename() publishes it | server crash, assertion, or availability failure | | [#5030](#5030) | Fix cluster Pub/Sub length truncation | memory-safety risk | </details> ### Excluded from generated notes (listed under Security Fixes) #5030 was supplied as a `--security-fix`, so the generated bullet(s) in the normal categories were dropped to avoid double-listing. To keep the notes consistent, it appears only under **Security Fixes**, where each is reviewed as a factual security entry. ###â ïļ Release-safety guardrail overrode AI triage AI excluded these PRs (or gave no verdict) but their text names a release-impact signal, so code forced them into the notes; confirm each bullet, category, urgency, and security treatment: | PR | Title | Guardrail reason | |----|-------|------------------| | [#4383](#4383) | Tests: Add subject alternative names to the TLS test certificates |â ïļ release-safety guardrail (security, access-control, or injection hardening; AI exclusion) | ### Triage summary - 12 PR(s) triaged into the notes - 7 PR(s) triaged out - 2 PR(s) hard-excluded by `no-release-notes` Per-PR verdicts (with reasons) are in the run's `triage-verdicts` artifact. To include a wrongly-dropped PR, label it `release-notes` and re-cut. ###â ïļ Notes with an unconfirmed cherry-pick origin These notes carry a `-x` trailer whose source commit is unreachable, so the credited `(#N)` may not be the change's author; confirm the origin and correct the credit if needed: | Credited PR | Range commit | Subject | Source commit(s) | |-------------|--------------|---------|------------------| | #4307 | `34d2c613ab4f` | Fix VLA stack overflow in TLS writev after write failure (#4307) | `fdb304b570b3` | | #3972 | `e47ceb7acfd9` | Validate PUBLISH and MODULE payload lengths against packet size (#3972) | `b1b5adfce837` | ### Prior wording not reused Another release line already published a note for these PRs, but this cut kept its own wording, so the entries will not read identically: <details> <summary>2 note(s) not reusing published wording</summary> | PR | Other line | Why the wording was not reused | |----|------------|--------------------------------| | #4307 | `9.1` (Valkey 9.1.2) | this cut could not confirm the PR the note credits (unresolved backport, cherry-pick, or reused PR number), and that credit is the only thing joining the two notes | | #3972 | `9.1` (Valkey 9.1.2) | the PR names a CVE, so its wording is authored per release line by a human | </details> ### Wording carried from other release lines A backported change is cut once per release line, and each cut words its notes independently. To keep one commit from being described differently per branch, a note whose source PR another line already published takes that published wording verbatim (joined on the trailing `(#N)`, which always names the original source PR). Only the text is reused; the category, the `by @handle` credit, and the `(#N)` are this cut's own. - Release lines consulted: `9.2`, `9.1`, `9.0`, `8.1`, `8.0`, `7.0`, `6.2`, `6.0`, `5.0`, `4.0`, `3.2`, `3.0`, `2.8`, `2.6`, `2.4`, `2.2` - 1 generated note(s) already matches the published wording: #4211 - Reused published wording for 12 note(s) <details> <summary>12 note(s) reusing published wording</summary> | PR | Wording from | Carried wording | This cut generated | |----|--------------|-----------------|--------------------| | #4342 | `9.1` (Valkey 9.1.2) | Truncate a partially written MULTI block from the AOF on short read, preventing loss of newer writes after a later restart | Fix AOF truncation after a short read inside a MULTI block leaving a malformed file that could lose later writes on restart | | #3971 | `9.1` (Valkey 9.1.2) | Fix an ACL bypass where duplicate STORE/STOREDIST options let GEORADIUS write or delete keys outside the user's permitted patterns | Fix an ACL bypass where duplicate STORE/STOREDIST options in GEORADIUS commands allowed writing or deleting keys outside permitted patterns | | #4360 | `9.1` (Valkey 9.1.2) | Fix a use-after-free crash when a module's cluster message type is received after the module is unloaded | Fix a use-after-free crash when a cluster message arrives for a module that has been unloaded | | #4410 | `9.1` (Valkey 9.1.2) | Fix out-of-bounds access for cluster module message type 255, which is now a valid, dispatchable message type | Fix an out-of-bounds access when a module registers or a node receives a cluster message of type 255, which is now a valid type | | #3984 | `9.1` (Valkey 9.1.2) | AOF loading no longer performs ACL checks on replayed commands, preventing silent data loss when the default user is disabled | Fix silent data loss when loading an AOF with a restrictive ACL configuration, since replayed commands must not be subject to permission checks | | #3721 | `9.1` (Valkey 9.1.2) | Listpacks are now always validated on RDB load and RESTORE, preventing deferred assertion crashes; `sanitize-dump-payload` and its ACL flags become no-ops | Always deeply validate listpacks on RDB load and RESTORE to prevent deferred assertion crashes; the `sanitize-dump-payload` config and `sanitize-payload` ACL flags are deprecated and become no-ops | | #4395 | `9.1` (Valkey 9.1.2) | Fix a client memory accounting leak on replicas that inflated the `mem_clients_normal` INFO field after primary disconnections | Fix the `mem_clients_normal` INFO field growing too high on replicas because the cached primary client's memory was never subtracted | | #3459 | `9.2` (Valkey 9.2.0-rc1) | Fix stream commands that mutate consumer-group or PEL state (`XGROUP`, `XSETID`, `XREADGROUP`, `XACK`, `XCLAIM`, `XAUTOCLAIM`) not triggering `WATCH` and client-side tracking invalidation | Fix stream commands such as XGROUP, XSETID, XACK, XCLAIM, XAUTOCLAIM and XREADGROUP not triggering WATCH and client-side tracking invalidation | | #3922 | `9.1` (Valkey 9.1.2) | Harden stream validation on RDB load and RESTORE so crafted payloads can no longer crash the server on later commands | Fix server crashes from crafted RESTORE stream payloads declaring an inconsistent length or negative field counts | | #4212 | `9.1` (Valkey 9.1.2) | Fix a use-after-free crash when serving clients blocked on the same key if one client is freed during processing | Fix a use-after-free crash when serving clients blocked on a key if handling one client frees another client blocked on the same key | | #4676 | `9.2` (Valkey 9.2.0-rc1) | Correct `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks | Fix the declared return types of `ValkeyModule_FreeModuleUser` and the ACL log entry module APIs to match their implementations, avoiding undefined behavior on strict platforms | | #4381 | `9.1` (Valkey 9.1.2) | Reject stream payloads with mismatched live/deleted record counts, preventing XDEL from destroying unaccounted entries | Reject corrupt stream payloads on load whose declared live/deleted record counts mismatch the actual records, preventing `XDEL` from destroying unaccounted entries | </details> *Generated by valkey-ci-agent. Review before merging into the release line.* --------- Signed-off-by: valkeyrie-bot[bot] <3692572+valkeyrie-bot[bot]@users.noreply.github.com> Signed-off-by: Sarthak Aggarwal <sarthakaggarwal97@gmail.com> Co-authored-by: valkeyrie-bot[bot] <3692572+valkeyrie-bot[bot]@users.noreply.github.com> Co-authored-by: Sarthak Aggarwal <sarthagg@amazon.com>
sarthakaggarwal97
pushed a commit
that referenced
this pull request
Oct 26, 2026
#4676) `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` are declared in valkeymodule.h as returning void, but the implementations (`VM_FreeModuleUser`, `VM_ACLAddLogEntry`, `VM_ACLAddLogEntryByUserName`) return int, and the latter two document `VALKEYMODULE_OK` / `VALKEYMODULE_ERR`. Modules calling them through the API table therefore call an int function via a void function pointer, which is undefined behavior in C. On x86-64 and arm64 the discarded return register makes it harmless in practice; on a target with strict indirect-call signature checking (WebAssembly) the call traps. Declare them as int to match the implementation. Existing modules that ignore the return value are unaffected; modules can now check the result of the ACL log calls as documented. Also document that `FreeModuleUser` returns `VALKEYMODULE_OK`. Found by compiling the server with Emscripten, where `redis.acl_check_cmd` in a Lua script (which calls `FreeModuleUser` through the API table) trapped with 'null function or function signature mismatch'. Signed-off-by: Rain Valentine <rsg000@gmail.com> Backport-Source-PR: 4676
sarthakaggarwal97
added a commit
that referenced
this pull request
Oct 26, 2026
> [!NOTE] > **Opened ready despite 3 flagged items** (`force_ready` was set): notes flagged low-confidence; release-safety guardrail overrode AI triage; AI triaged PRs without release-notes (confirm include/exclude). Review the sections below and confirm before merging. Cuts **9.1.3** onto release line `9.1`. - Promotes the release notes into a dated section, bumps `src/version.h`, and refreshes the running contributor list. - Release notes computed over the range below (`9.1.2..c6dc0fc`): ``` mode: ga source_ref: 9.1 target_branch: 9.1 base: 9.1.2 @ 7f1dffe head: c6dc0fc @ c6dc0fc ``` ###â ïļ Notes to double-check The generator flagged these notes low-confidence; confirm category and wording before merging: | PR | Category | Why flagged | |----|----------|-------------| | #4571 | Build and Tooling | dev-utility-only change; flagged per build/tooling policy, may not be user-facing; non-fix category on a patch release needs explicit maintainer confirmation | | #4815 | Bug Fixes | could be Observability and Logging | | #4823 | Bug Fixes | explicit impact scope omitted: 32-bit | ### Release-impact review Code detected release-impact terms (availability, memory safety, data integrity, access control, protocol, compatibility) in these PRs; this forces review, it is not a severity classification. The requested urgency is **SECURITY**. Confirm it and decide whether any change needs a hand-authored **Security Fixes** entry:â ïļ [#4571](#4571) names **CVE-2026-6321**. A named CVE normally ships with `SECURITY` urgency and a hand-authored **Security Fixes** entry; this holds the cut at any other urgency. <details> <summary>10 PR(s) with impact signals</summary> | PR | Title | Signal | |----|-------|--------| | [#4571](#4571) | Bump fast-uri to 3.1.6 in reply-schema-linter to clear CVEs | data or persisted-state corruption risk | | [#4676](#4676) | Fix return types of three module API declarations to match definitions | security, access-control, or injection hardening | | [#3645](#3645) | fix: Reject module writes during client pause to prevent crash | server crash, assertion, or availability failure | | [#4880](#4880) | Reject relative expires that overflow when the base time is added | server crash, assertion, or availability failure | | [#4214](#4214) | fix(acl): prevent NULL pointer dereference on malformed selector in ACL file | server crash, assertion, or availability failure | | [#4504](#4504) | Fix crash and wrong return values in the hash stringRef module API | server crash, assertion, or availability failure | | [#4270](#4270) | make getMonotonicUs static in libvalkeylua | server crash, assertion, or availability failure | | [#4733](#4733) | Fix sds overflow assert on RESTORE payload with an overflowing string length | server crash, assertion, or availability failure | | [#4489](#4489) | Hold no descriptor on nodes.conf when rename() publishes it | server crash, assertion, or availability failure | | [#5030](#5030) | Fix cluster Pub/Sub length truncation | memory-safety risk | </details> ### Excluded from generated notes (listed under Security Fixes) #5030 was supplied as a `--security-fix`, so the generated bullet(s) in the normal categories were dropped to avoid double-listing. To keep the notes consistent, it appears only under **Security Fixes**, where each is reviewed as a factual security entry. ###â ïļ Release-safety guardrail overrode AI triage AI excluded these PRs (or gave no verdict) but their text names a release-impact signal, so code forced them into the notes; confirm each bullet, category, urgency, and security treatment: | PR | Title | Guardrail reason | |----|-------|------------------| | [#4571](#4571) | Bump fast-uri to 3.1.6 in reply-schema-linter to clear CVEs |â ïļ release-safety guardrail (data or persisted-state corruption risk; AI exclusion) | ### Triage summary - 20 PR(s) triaged into the notes - 9 PR(s) triaged out - 2 PR(s) hard-excluded by `no-release-notes` Per-PR verdicts (with reasons) are in the run's `triage-verdicts` artifact. To include a wrongly-dropped PR, label it `release-notes` and re-cut. ### Wording carried from other release lines A backported change is cut once per release line, and each cut words its notes independently. To keep one commit from being described differently per branch, a note whose source PR another line already published takes that published wording verbatim (joined on the trailing `(#N)`, which always names the original source PR). Only the text is reused; the category, the `by @handle` credit, and the `(#N)` are this cut's own. - Release lines consulted: `9.2`, `9.0`, `8.1`, `8.0`, `7.2`, `7.0`, `6.2`, `6.0`, `5.0`, `4.0`, `3.2`, `3.0`, `2.8`, `2.6`, `2.4`, `2.2` - 1 generated note(s) already matches the published wording: #4567 - Reused published wording for 8 note(s) <details> <summary>8 note(s) reusing published wording</summary> | PR | Wording from | Carried wording | This cut generated | |----|--------------|-----------------|--------------------| | #3459 | `9.2` (Valkey 9.2.0-rc1) | Fix stream commands that mutate consumer-group or PEL state (`XGROUP`, `XSETID`, `XREADGROUP`, `XACK`, `XCLAIM`, `XAUTOCLAIM`) not triggering `WATCH` and client-side tracking invalidation | Stream commands that modify consumer-group state (`XGROUP`, `XSETID`, `XREADGROUP`, `XACK`, `XCLAIM`, `XAUTOCLAIM`) now correctly trigger `WATCH` and client tracking invalidation | | #4733 | `7.2` (Valkey 7.2.15) | Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data | Fix a server abort when a `RESTORE` payload declares a string length that overflows the allocation size; such payloads are now rejected as bad data | | #4997 | `7.2` (Valkey 7.2.15) | Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching ZUNION | Fix `ZINTER`/`ZINTERSTORE` returning input-order-dependent scores when a weighted term is 0 times infinity; such NaN terms now count as 0, matching `ZUNION` | | #4533 | `9.2` (Valkey 9.2.0-rc1) | Clear a stale primary-failure gossip flag on replicas so later failovers don't incorrectly skip the election delay | Fix a stale primary-failure gossip flag on cluster replicas that could let a later unrelated failover skip the normal election delay | | #4676 | `9.2` (Valkey 9.2.0-rc1) | Correct `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks | Fix module API declarations of `ValkeyModule_FreeModuleUser` and the ACL log entry functions to return int, avoiding traps on platforms with strict call-signature checks such as WebAssembly | | #4214 | `7.2` (Valkey 7.2.15) | Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis | Fix a server crash when loading an ACL file containing a selector definition with an unmatched parenthesis | | #4489 | `7.2` (Valkey 7.2.15) | Fix cluster config saving to avoid publishing truncated `nodes.conf` files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate `nodes.conf.lock` file | Fix cluster config saving by locking a separate `nodes.conf.lock` file, fixing crash loops on SMB filesystems such as Azure Files and restoring protection against two nodes sharing one config | | #4823 | `7.2` (Valkey 7.2.15) | Fix `LSET` on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error | Fix `LSET` on 64-bit builds modifying the wrong element instead of returning an error for very large out-of-range indexes | </details> *Generated by valkey-ci-agent. Review before merging into the release line.* --------- Signed-off-by: valkeyrie-bot[bot] <3692572+valkeyrie-bot[bot]@users.noreply.github.com> Signed-off-by: Sarthak Aggarwal <sarthakaggarwal97@gmail.com> Co-authored-by: valkeyrie-bot[bot] <3692572+valkeyrie-bot[bot]@users.noreply.github.com> Co-authored-by: Sarthak Aggarwal <sarthagg@amazon.com> Co-authored-by: Roshan Khatri <117414976+roshkhatri@users.noreply.github.com>
sarthakaggarwal97
added a commit
that referenced
this pull request
Oct 26, 2026
> [!NOTE] > **Opened ready despite 2 flagged items** (`force_ready` was set): notes flagged low-confidence; AI triaged PRs without release-notes (confirm include/exclude). Review the sections below and confirm before merging. Cuts **8.1.11** onto release line `8.1`. - Promotes the release notes into a dated section, bumps `src/version.h`, and refreshes the running contributor list. - Release notes computed over the range below (`8.1.10..1b167ac`): ``` mode: ga source_ref: 8.1 target_branch: 8.1 base: 8.1.10 @ 55a5426 head: 1b167ac @ 1b167ac ``` ###â ïļ Notes to double-check The generator flagged these notes low-confidence; confirm category and wording before merging: | PR | Category | Why flagged | |----|----------|-------------| | #4676 | Bug Fixes | could be Module API Changes | | #4815 | Bug Fixes | could be Observability and Logging | | #4823 | Bug Fixes | explicit impact scope omitted: 32-bit | ### Release-impact review Code detected release-impact terms (availability, memory safety, data integrity, access control, protocol, compatibility) in these PRs; this forces review, it is not a severity classification. The requested urgency is **SECURITY**. Confirm it and decide whether any change needs a hand-authored **Security Fixes** entry: <details> <summary>8 PR(s) with impact signals</summary> | PR | Title | Signal | |----|-------|--------| | [#4676](#4676) | Fix return types of three module API declarations to match definitions | security, access-control, or injection hardening | | [#3645](#3645) | fix: Reject module writes during client pause to prevent crash | server crash, assertion, or availability failure | | [#3598](#3598) | fix: validate key count before allocating result in keyspec | undefined behavior or unsafe arithmetic | | [#4880](#4880) | Reject relative expires that overflow when the base time is added | server crash, assertion, or availability failure | | [#4214](#4214) | fix(acl): prevent NULL pointer dereference on malformed selector in ACL file | server crash, assertion, or availability failure | | [#4733](#4733) | Fix sds overflow assert on RESTORE payload with an overflowing string length | server crash, assertion, or availability failure | | [#4489](#4489) | Hold no descriptor on nodes.conf when rename() publishes it | server crash, assertion, or availability failure | | [#5030](#5030) | Fix cluster Pub/Sub length truncation | memory-safety risk | </details> ### Excluded from generated notes (listed under Security Fixes) #5030 was supplied as a `--security-fix`, so the generated bullet(s) in the normal categories were dropped to avoid double-listing. To keep the notes consistent, it appears only under **Security Fixes**, where each is reviewed as a factual security entry. ### Triage summary - 10 PR(s) triaged into the notes - 4 PR(s) triaged out - 2 PR(s) hard-excluded by `no-release-notes` Per-PR verdicts (with reasons) are in the run's `triage-verdicts` artifact. To include a wrongly-dropped PR, label it `release-notes` and re-cut. ### Wording carried from other release lines A backported change is cut once per release line, and each cut words its notes independently. To keep one commit from being described differently per branch, a note whose source PR another line already published takes that published wording verbatim (joined on the trailing `(#N)`, which always names the original source PR). Only the text is reused; the category, the `by @handle` credit, and the `(#N)` are this cut's own. - Release lines consulted: `9.2`, `9.1`, `9.0`, `8.0`, `7.2`, `7.0`, `6.2`, `6.0`, `5.0`, `4.0`, `3.2`, `3.0`, `2.8`, `2.6`, `2.4`, `2.2` - Reused published wording for 9 note(s) <details> <summary>9 note(s) reusing published wording</summary> | PR | Wording from | Carried wording | This cut generated | |----|--------------|-----------------|--------------------| | #3459 | `9.2` (Valkey 9.2.0-rc1) | Fix stream commands that mutate consumer-group or PEL state (`XGROUP`, `XSETID`, `XREADGROUP`, `XACK`, `XCLAIM`, `XAUTOCLAIM`) not triggering `WATCH` and client-side tracking invalidation | Fix stream commands (`XGROUP`, `XSETID`, `XREADGROUP`, `XACK`, `XCLAIM`, `XAUTOCLAIM`) not triggering `WATCH` and client-side tracking invalidation when they modify consumer-group state | | #4733 | `7.2` (Valkey 7.2.15) | Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data | Fix a server abort on a corrupt or crafted `RESTORE` payload declaring a string length that overflows the allocation size; the payload is now rejected with a Bad data format error | | #4997 | `7.2` (Valkey 7.2.15) | Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching ZUNION | Fix `ZINTER`/`ZINTERSTORE` scores depending on input order when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching `ZUNION` | | #4676 | `9.2` (Valkey 9.2.0-rc1) | Correct `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks | Fix `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry`, and `ValkeyModule_ACLAddLogEntryByUserName` declarations to return int as implemented, fixing traps on platforms with strict indirect-call checks such as WebAssembly | | #4567 | `7.2` (Valkey 7.2.15) | Fix valkey-benchmark spinning on would-block writes, which could starve reply processing and the `--duration` timer | Fix `valkey-benchmark` spinning in a tight loop on would-block writes, which could starve reply processing and the `--duration` timer | | #3598 | `7.2` (Valkey 7.2.15) | Fix a huge memory allocation when a command such as COMMAND GETKEYS EVAL declares a far larger key count than the arguments provided | Fix a huge memory allocation in `COMMAND GETKEYS` when a command such as `EVAL` declares an enormous key count, which could trigger out-of-memory when overcommit is disabled | | #4214 | `7.2` (Valkey 7.2.15) | Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis | Fix a server crash when loading an ACL file containing a selector definition with an unmatched parenthesis | | #4489 | `7.2` (Valkey 7.2.15) | Fix cluster config saving to avoid publishing truncated `nodes.conf` files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate `nodes.conf.lock` file | Fix cluster config saves failing on SMB filesystems such as Azure Files and the startup lock not protecting `nodes.conf` after the first save; the lock is now held on a separate `nodes.conf.lock` file | | #4823 | `7.2` (Valkey 7.2.15) | Fix `LSET` on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error | Fix `LSET` modifying the wrong element instead of returning an out-of-range error for indexes beyond 32 bits on 64-bit builds | </details> *Generated by valkey-ci-agent. Review before merging into the release line.* --------- Signed-off-by: valkeyrie-bot[bot] <3692572+valkeyrie-bot[bot]@users.noreply.github.com> Signed-off-by: Sarthak Aggarwal <sarthakaggarwal97@gmail.com> Co-authored-by: valkeyrie-bot[bot] <3692572+valkeyrie-bot[bot]@users.noreply.github.com> Co-authored-by: Sarthak Aggarwal <sarthagg@amazon.com> Co-authored-by: Roshan Khatri <117414976+roshkhatri@users.noreply.github.com>
sarthakaggarwal97
pushed a commit
that referenced
this pull request
Oct 26, 2026
#4676) `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` are declared in valkeymodule.h as returning void, but the implementations (`VM_FreeModuleUser`, `VM_ACLAddLogEntry`, `VM_ACLAddLogEntryByUserName`) return int, and the latter two document `VALKEYMODULE_OK` / `VALKEYMODULE_ERR`. Modules calling them through the API table therefore call an int function via a void function pointer, which is undefined behavior in C. On x86-64 and arm64 the discarded return register makes it harmless in practice; on a target with strict indirect-call signature checking (WebAssembly) the call traps. Declare them as int to match the implementation. Existing modules that ignore the return value are unaffected; modules can now check the result of the ACL log calls as documented. Also document that `FreeModuleUser` returns `VALKEYMODULE_OK`. Found by compiling the server with Emscripten, where `redis.acl_check_cmd` in a Lua script (which calls `FreeModuleUser` through the API table) trapped with 'null function or function signature mismatch'. Signed-off-by: Rain Valentine <rsg000@gmail.com> Backport-Source-PR: 4676
sarthakaggarwal97
pushed a commit
that referenced
this pull request
Oct 26, 2026
> [!NOTE] > **Opened ready despite 2 flagged items** (`force_ready` was set): notes flagged low-confidence; AI triaged PRs without release-notes (confirm include/exclude). Review the sections below and confirm before merging. Cuts **8.0.12** onto release line `8.0`. - Promotes the release notes into a dated section, bumps `src/version.h`, and refreshes the running contributor list. - Release notes computed over the range below (`8.0.11..fff95b5`): ``` mode: ga source_ref: 8.0 target_branch: 8.0 base: 8.0.11 @ 4bf1df6 head: fff95b5 @ fff95b5 ``` ###â ïļ Notes to double-check The generator flagged these notes low-confidence; confirm category and wording before merging: | PR | Category | Why flagged | |----|----------|-------------| | #4676 | Bug Fixes | could be Module API Changes | | #4815 | Bug Fixes | could be Observability and Logging | | #4823 | Bug Fixes | explicit impact scope omitted: 32-bit | ### Release-impact review Code detected release-impact terms (availability, memory safety, data integrity, access control, protocol, compatibility) in these PRs; this forces review, it is not a severity classification. The requested urgency is **SECURITY**. Confirm it and decide whether any change needs a hand-authored **Security Fixes** entry: <details> <summary>8 PR(s) with impact signals</summary> | PR | Title | Signal | |----|-------|--------| | [#4676](#4676) | Fix return types of three module API declarations to match definitions | security, access-control, or injection hardening | | [#3598](#3598) | fix: validate key count before allocating result in keyspec | undefined behavior or unsafe arithmetic | | [#4880](#4880) | Reject relative expires that overflow when the base time is added | server crash, assertion, or availability failure | | [#4214](#4214) | fix(acl): prevent NULL pointer dereference on malformed selector in ACL file | server crash, assertion, or availability failure | | [#4733](#4733) | Fix sds overflow assert on RESTORE payload with an overflowing string length | server crash, assertion, or availability failure | | [#4489](#4489) | Hold no descriptor on nodes.conf when rename() publishes it | server crash, assertion, or availability failure | | [#3645](#3645) | fix: Reject module writes during client pause to prevent crash | server crash, assertion, or availability failure | | [#5030](#5030) | Fix cluster Pub/Sub length truncation | memory-safety risk | </details> ### Excluded from generated notes (listed under Security Fixes) #5030 was supplied as a `--security-fix`, so the generated bullet(s) in the normal categories were dropped to avoid double-listing. To keep the notes consistent, it appears only under **Security Fixes**, where each is reviewed as a factual security entry. ### Triage summary - 10 PR(s) triaged into the notes - 3 PR(s) triaged out - 2 PR(s) hard-excluded by `no-release-notes` Per-PR verdicts (with reasons) are in the run's `triage-verdicts` artifact. To include a wrongly-dropped PR, label it `release-notes` and re-cut. ### Wording carried from other release lines A backported change is cut once per release line, and each cut words its notes independently. To keep one commit from being described differently per branch, a note whose source PR another line already published takes that published wording verbatim (joined on the trailing `(#N)`, which always names the original source PR). Only the text is reused; the category, the `by @handle` credit, and the `(#N)` are this cut's own. - Release lines consulted: `9.2`, `9.1`, `9.0`, `8.1`, `7.2`, `7.0`, `6.2`, `6.0`, `5.0`, `4.0`, `3.2`, `3.0`, `2.8`, `2.6`, `2.4`, `2.2` - 1 generated note(s) already matches the published wording: #4567 - Reused published wording for 12 note(s) <details> <summary>12 note(s) reusing published wording</summary> | PR | Wording from | Carried wording | This cut generated | |----|--------------|-----------------|--------------------| | #3459 | `9.2` (Valkey 9.2.0-rc1) | Fix stream commands that mutate consumer-group or PEL state (`XGROUP`, `XSETID`, `XREADGROUP`, `XACK`, `XCLAIM`, `XAUTOCLAIM`) not triggering `WATCH` and client-side tracking invalidation | Fix stream commands like `XGROUP`, `XSETID`, `XACK`, `XCLAIM`, and `XREADGROUP` not triggering `WATCH` and client tracking invalidation when they modify consumer-group state | | #4733 | `9.1` (Valkey 9.1.3) | Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data | Fix server abort on a `RESTORE` payload declaring an overflowing string length; the corrupt payload is now rejected with a Bad data format error | | #3645 | `9.1` (Valkey 9.1.3) | Reject module write commands while the server is paused for writes, preventing a crash from module timer callbacks during `CLIENT PAUSE WRITE` or `CLUSTER FAILOVER` | Fix server crash when module timer callbacks or thread-safe contexts issue writes during `CLIENT PAUSE WRITE` or `CLUSTER FAILOVER`; such writes are now rejected | | #4997 | `9.1` (Valkey 9.1.3) | Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching ZUNION | Fix `ZINTER`/`ZINTERSTORE` returning input-order-dependent scores when a weighted score is 0*inf; such terms now count as 0, matching `ZUNION` | | #4676 | `9.2` (Valkey 9.2.0-rc1) | Correct `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks | Fix module API declarations of `ValkeyModule_FreeModuleUser` and the ACL log entry functions to return int as implemented, avoiding undefined behavior on platforms with strict call signature checks | | #3598 | `8.1` (Valkey 8.1.11) | Fix a huge memory allocation when a command such as COMMAND GETKEYS EVAL declares a far larger key count than the arguments provided | Fix `COMMAND GETKEYS` allocating huge amounts of memory for a command declaring a huge key count before validating it against the actual arguments | | #4880 | `9.1` (Valkey 9.1.3) | Reject relative expire times in `SET`/`GETEX`, `RESTORE`, and `ValkeyModule_SetExpire` that overflow when added to the current time, preventing server aborts from negative expires | Reject relative expire times in `SET`/`GETEX`, `RESTORE`, and the module `SetExpire` API that overflow when added to the current time, preventing assertion crashes | | #4214 | `9.1` (Valkey 9.1.3) | Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis | Fix server crash when loading an ACL file containing a selector definition with an unmatched parenthesis | | #4637 | `9.1` (Valkey 9.1.3) | Sorted set range commands with a negative `LIMIT` offset now return an empty result instead of a spurious element on btree-encoded keys | Fix sorted set range commands with a negative `LIMIT` offset returning a wrong element on btree-encoded keys; a negative offset now returns an empty result in both encodings | | #4815 | `9.1` (Valkey 9.1.3) | Redact error text in server logs when `hide-user-data-from-log` is enabled, so command arguments no longer leak into logs | Honor `hide-user-data-from-log` when logging error replies sent to replicas, primaries, or during AOF loading, redacting error text that may echo user data | | #4489 | `9.1` (Valkey 9.1.3) | Fix cluster config saving to avoid publishing truncated `nodes.conf` files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate `nodes.conf.lock` file | Fix cluster config save failures on SMB filesystems and ineffective nodes.conf locking by locking a separate nodes.conf.lock file and closing the temp file before publishing it | | #4823 | `9.1` (Valkey 9.1.3) | Fix `LSET` on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error | Fix `LSET` on 64-bit builds modifying the wrong element instead of returning an error for indexes that overflow 32 bits | </details> *Generated by valkey-ci-agent. Review before merging into the release line.* Signed-off-by: valkeyrie-bot[bot] <3692572+valkeyrie-bot[bot]@users.noreply.github.com> Co-authored-by: valkeyrie-bot[bot] <3692572+valkeyrie-bot[bot]@users.noreply.github.com>
sarthakaggarwal97
added a commit
that referenced
this pull request
Oct 26, 2026
> [!NOTE] > **Opened ready despite 2 flagged items** (`force_ready` was set): notes flagged low-confidence; AI triaged PRs without release-notes (confirm include/exclude). Review the sections below and confirm before merging. Cuts **9.0.7** onto release line `9.0`. - Promotes the release notes into a dated section, bumps `src/version.h`, and refreshes the running contributor list. - Release notes computed over the range below (`9.0.6..31a98d4`): ``` mode: ga source_ref: 9.0 target_branch: 9.0 base: 9.0.6 @ a100149 head: 31a98d4 @ 31a98d4 ``` ###â ïļ Notes to double-check The generator flagged these notes low-confidence; confirm category and wording before merging: | PR | Category | Why flagged | |----|----------|-------------| | #4815 | Bug Fixes | could be Observability and Logging | | #4823 | Bug Fixes | explicit impact scope omitted: 32-bit | ### Release-impact review Code detected release-impact terms (availability, memory safety, data integrity, access control, protocol, compatibility) in these PRs; this forces review, it is not a severity classification. The requested urgency is **SECURITY**. Confirm it and decide whether any change needs a hand-authored **Security Fixes** entry: <details> <summary>8 PR(s) with impact signals</summary> | PR | Title | Signal | |----|-------|--------| | [#4676](#4676) | Fix return types of three module API declarations to match definitions | security, access-control, or injection hardening | | [#3645](#3645) | fix: Reject module writes during client pause to prevent crash | server crash, assertion, or availability failure | | [#3598](#3598) | fix: validate key count before allocating result in keyspec | undefined behavior or unsafe arithmetic | | [#4880](#4880) | Reject relative expires that overflow when the base time is added | server crash, assertion, or availability failure | | [#4214](#4214) | fix(acl): prevent NULL pointer dereference on malformed selector in ACL file | server crash, assertion, or availability failure | | [#4733](#4733) | Fix sds overflow assert on RESTORE payload with an overflowing string length | server crash, assertion, or availability failure | | [#4489](#4489) | Hold no descriptor on nodes.conf when rename() publishes it | server crash, assertion, or availability failure | | [#5030](#5030) | Fix cluster Pub/Sub length truncation | memory-safety risk | </details> ### Excluded from generated notes (listed under Security Fixes) #5030 was supplied as a `--security-fix`, so the generated bullet(s) in the normal categories were dropped to avoid double-listing. To keep the notes consistent, it appears only under **Security Fixes**, where each is reviewed as a factual security entry. ### Triage summary - 16 PR(s) triaged into the notes - 6 PR(s) triaged out - 2 PR(s) hard-excluded by `no-release-notes` Per-PR verdicts (with reasons) are in the run's `triage-verdicts` artifact. To include a wrongly-dropped PR, label it `release-notes` and re-cut. ### Wording carried from other release lines A backported change is cut once per release line, and each cut words its notes independently. To keep one commit from being described differently per branch, a note whose source PR another line already published takes that published wording verbatim (joined on the trailing `(#N)`, which always names the original source PR). Only the text is reused; the category, the `by @handle` credit, and the `(#N)` are this cut's own. - Release lines consulted: `9.2`, `9.1`, `8.1`, `8.0`, `7.2`, `7.0`, `6.2`, `6.0`, `5.0`, `4.0`, `3.2`, `3.0`, `2.8`, `2.6`, `2.4`, `2.2` - Reused published wording for 19 note(s) <details> <summary>19 note(s) reusing published wording</summary> | PR | Wording from | Carried wording | This cut generated | |----|--------------|-----------------|--------------------| | #3459 | `9.2` (Valkey 9.2.0-rc1) | Fix stream commands that mutate consumer-group or PEL state (`XGROUP`, `XSETID`, `XREADGROUP`, `XACK`, `XCLAIM`, `XAUTOCLAIM`) not triggering `WATCH` and client-side tracking invalidation | Fix stream commands (`XGROUP`, `XSETID`, `XACK`, `XCLAIM`, `XAUTOCLAIM`, `XREADGROUP`) not triggering `WATCH` and client-side tracking invalidation when they modify consumer-group state | | #3645 | `9.1` (Valkey 9.1.3) | Reject module write commands while the server is paused for writes, preventing a crash from module timer callbacks during `CLIENT PAUSE WRITE` or `CLUSTER FAILOVER` | Fix a crash when module timer callbacks or thread-safe contexts attempt writes while the server is paused for writes; such module writes are now rejected with an error | | #4733 | `9.1` (Valkey 9.1.3) | Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data | Fix a server abort when a corrupt `RESTORE` payload declares a string length that overflows the allocation size; the payload is now rejected with a Bad data format error | | #4997 | `9.1` (Valkey 9.1.3) | Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching ZUNION | Fix `ZINTER`/`ZINTERSTORE` returning input-order-dependent scores when a weighted score is 0*inf (NaN); it now counts as 0, matching `ZUNION` | | #4676 | `9.2` (Valkey 9.2.0-rc1) | Correct `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks | Fix the declared return types of `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry`, and `ValkeyModule_ACLAddLogEntryByUserName` to match their implementations, avoiding traps on platforms with strict call-signature checks | | #4739 | `9.1` (Valkey 9.1.3) | valkey-check-aof now recognizes RDB base files with the `VALKEY` signature instead of misreporting a valid multipart AOF as invalid | Fix `valkey-check-aof` not recognizing RDB base files with the `VALKEY` signature, which made it report healthy multipart AOFs as invalid | | #4567 | `8.0` (Valkey 8.0.12) | Fix valkey-benchmark spinning on would-block writes, which could starve reply processing and the `--duration` timer | Fix `valkey-benchmark` spinning on would-block writes, which could starve reply processing and the `--duration` timer under high connection counts | | #3598 | `8.1` (Valkey 8.1.11) | Fix a huge memory allocation when a command such as COMMAND GETKEYS EVAL declares a far larger key count than the arguments provided | Fix a huge memory allocation in `COMMAND GETKEYS` when a command such as `EVAL` declares an excessive key count; the count is now validated before allocating | | #4880 | `9.1` (Valkey 9.1.3) | Reject relative expire times in `SET`/`GETEX`, `RESTORE`, and `ValkeyModule_SetExpire` that overflow when added to the current time, preventing server aborts from negative expires | Fix relative expire times in `SET`/`GETEX`, `RESTORE`, and `ValkeyModule_SetExpire` overflowing when the current time is added, which could store a negative expire and crash the server during active expiry or AOF restart | | #4772 | `9.1` (Valkey 9.1.3) | `HDEL`, `HGETDEL`, `HPERSIST`, and `HEXPIRE` no longer propagate fields they treat as expired, preventing replica and AOF-reload divergence | Fix `HDEL`, `HGETDEL`, `HPERSIST`, and `HEXPIRE` propagating already-expired hash fields, which could make replicas and AOF-reloaded data diverge from the primary | | #4214 | `9.1` (Valkey 9.1.3) | Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis | Fix a crash when loading an ACL file containing a selector definition with unmatched parentheses | | #4939 | `9.1` (Valkey 9.1.3) | `COPY` of a hash now includes expired-but-unreaped fields so their deletion is propagated and replicas stay in sync | Fix `COPY` of a hash dropping expired-but-unreaped fields, which left stale fields on replicas that were never deleted | | #4637 | `9.1` (Valkey 9.1.3) | Sorted set range commands with a negative `LIMIT` offset now return an empty result instead of a spurious element on btree-encoded keys | Fix `ZRANGEBYSCORE`/`ZRANGEBYLEX` and related range commands returning a wrong element on btree-encoded sorted sets when the LIMIT offset is negative; they now return an empty result | | #4920 | `9.1` (Valkey 9.1.3) | Fix atomic slot migration not replicating evictions on the import target, which let replicas grow far past `maxmemory` | Fix evictions on an atomic slot migration target not being replicated, which could make replicas grow far past maxmemory and keep keys the primary evicted | | #4815 | `9.1` (Valkey 9.1.3) | Redact error text in server logs when `hide-user-data-from-log` is enabled, so command arguments no longer leak into logs | Redact error reply text in server logs when `hide-user-data-from-log` is enabled, so keys and values no longer leak into the log from replication or AOF error paths | | #4945 | `9.1` (Valkey 9.1.3) | Fix `HSETEX` and `HGETEX` failing to parse their arguments when the key is named `fields` | Fix `HSETEX` and `HGETEX` failing with a parse error when the key is named "fields" | | #4489 | `9.1` (Valkey 9.1.3) | Fix cluster config saving to avoid publishing truncated `nodes.conf` files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate `nodes.conf.lock` file | Fix cluster config saving: the startup lock now uses a separate nodes.conf.lock file and no descriptor is held across the rename, fixing ineffective locking and save failures (crash loops) on SMB/Azure Files | | #4952 | `9.1` (Valkey 9.1.3) | Fix atomic slot migration with `cluster-databases` > 1 applying writes made during the snapshot to the wrong database on the target | Fix writes made during an atomic slot migration snapshot being applied to the wrong database on the target when cluster-databases is greater than 1 | | #4823 | `9.1` (Valkey 9.1.3) | Fix `LSET` on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error | Fix `LSET` on 64-bit builds modifying an element instead of returning an out-of-range error when the index exceeds 32 bits | </details> *Generated by valkey-ci-agent. Review before merging into the release line.* --------- Signed-off-by: valkeyrie-bot[bot] <3692572+valkeyrie-bot[bot]@users.noreply.github.com> Signed-off-by: Sarthak Aggarwal <sarthakaggarwal97@gmail.com> Co-authored-by: valkeyrie-bot[bot] <3692572+valkeyrie-bot[bot]@users.noreply.github.com> Co-authored-by: Sarthak Aggarwal <sarthagg@amazon.com> Co-authored-by: Roshan Khatri <117414976+roshkhatri@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ValkeyModule_FreeModuleUser,ValkeyModule_ACLAddLogEntryandValkeyModule_ACLAddLogEntryByUserNameare declared in valkeymodule.h as returning void, but the implementations (VM_FreeModuleUser,VM_ACLAddLogEntry,VM_ACLAddLogEntryByUserName) return int, and the latter two documentVALKEYMODULE_OK/VALKEYMODULE_ERR. Modules calling them through the API table therefore call an int function via a void function pointer, which is undefined behavior in C. On x86-64 and arm64 the discarded return register makes it harmless in practice; on a target with strict indirect-call signature checking (WebAssembly) the call traps.Declare them as int to match the implementation. Existing modules that ignore the return value are unaffected; modules can now check the result of the ACL log calls as documented. Also document that
FreeModuleUserreturnsVALKEYMODULE_OK.Found by compiling the server with Emscripten, where
redis.acl_check_cmdin a Lua script (which callsFreeModuleUserthrough the API table) trapped with 'null function or function signature mismatch'.