Fix cluster bus self-forget use-after-free

[roshkhatri]

This PR fixes a use-after-free in the handling of CLUSTERMSG_EXT_TYPE_FORGOTTEN_NODE cluster-bus PING extensions.

A cluster node can use this extension to tell its peers that another node has been forgotten. However, the receiver did not check whether the node named in the extension was also the sender of the message currently being processed.

In that case, clusterDelNode() deleted the sender and freed its active cluster link and receive buffer. The extension handler then continued processing the same message and later accessed the now-freed sender and link. This could cause memory corruption and crash the server.

How is it fixed?

A node should not be able to legitimately announce that it has forgotten itself. The handler now treats this as an invalid cluster-bus message:

• Logs a warning.
• Closes the malformed connection.
• Returns immediately without deleting the sender or continuing to process the packet.

This preserves the existing behavior for valid forgotten-node extensions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 66456b8f-849f-4c99-9d75-2bc229ab4104

📥 Commits

Reviewing files that changed from the base of the PR and between f42c9ab and a782b84.

📒 Files selected for processing (2)

• src/cluster_legacy.c
• tests/unit/cluster/packet.tcl

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The cluster bus now rejects FORGOTTEN_NODE extensions that identify the sending node. Tests construct this packet, verify link closure, and confirm that the receiving node remains available.

Changes

Cluster self-forget validation

Layer / File(s)	Summary
Reject self-forget extensions src/cluster_legacy.c	clusterProcessPingExtensions logs invalid self-forget requests, closes the link, and returns failure.
Test forged self-forget packets tests/unit/cluster/packet.tcl	Packet helpers create the forged PING and detect closed sockets. A two-node test verifies link closure and continued node availability.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: hpatro

Merge Risk: ⚪ Minimal · up to a782b

The malformed self-forget packet is rejected while valid node state remains available. No actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: fixing a cluster-bus self-forget use-after-free.
Description check	✅ Passed	The description accurately explains the self-forget condition, the use-after-free risk, and the implemented fix.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hpatro]

How does this message originate though?

[enjoy-binbin]

This should be a report from a security email? I recall seeing it. Could we just ignore it by adding a condition like n != sender below? (both are ok to me, not a blocker)