fix: queryevent addrinfo race in kad-dht (#11288)
bump go-libp2p-kad-dht to v0.39.1 to pick up the queryPeer AddrInfo.Addrs race fix from libp2p/go-libp2p-kad-dht#1244, which resolves the random daemon crashes reported in #11287 and #11116. (cherry picked from commit eb2cfacbd8821d54228db607b92546f818e9952e)
Marcin Rataj committed
Apr 20, 2026 at 20:10 UTC
fa8a06f902cad7c4537ab8d8fa45abc61ac6fafb
7 files changed
+19
-10
docs/changelogs/v0.41.md
+10
-1
@@ -26,6 +26,7 @@ This release was brought to you by the [Shipyard](https://ipshipyard.com/) team.
26
- [📂 FUSE Mount Improvements](#-fuse-mount-improvements)
27
- [📦 CARv2 import over HTTP API](#-carv2-import-over-http-api)
28
- [🐹 Go 1.26, Once More with Feeling](#-go-126-once-more-with-feeling)
29
+ - [🐛 Fixed long-standing random daemon crashes during DHT lookups](#-fixed-long-standing-random-daemon-crashes-during-dht-lookups)
30
- [📦️ Dependency updates](#-dependency-updates)
31
- [📝 Changelog](#-changelog)
32
- [👨👩👧👦 Contributors](#-contributors)
@@ -213,10 +214,18 @@ Kubo first shipped with [Go 1.26](https://go.dev/doc/go1.26) in v0.40.0, but [v0
214
215
You should see lower memory usage and reduced GC pauses thanks to the new Green Tea garbage collector (10-40% less GC overhead). Reading block data and API responses is faster due to `io.ReadAll` improvements (~2x faster, ~50% less memory). On 64-bit platforms, heap base address randomization adds a layer of security hardening.
216
217
+#### 🐛 Fixed long-standing random daemon crashes during DHT lookups
218
+
219
+Long-running daemons could exit with `invalid memory address or nil pointer dereference` or similar memory errors while handling DHT traffic. The cause was a data race in the routing layer that had been latent for years: `PublishQueryEvent` handed `QueryEvent.Responses` to subscribers (like `findprovs`) by pointer while the publisher kept mutating the same `AddrInfo.Addrs` slices.
220
+
221
+Two recent changes likely tipped the race into frequent visible crashes: [go-multiaddr v0.15](https://github.com/multiformats/go-multiaddr/releases/tag/v0.15.0) turned `Multiaddr` from an interface into a slice-backed struct, and [Go 1.26](https://go.dev/doc/go1.26) added heap base address randomization and a new garbage collector. Both likely made torn concurrent reads more likely to dereference unmapped memory.
222
+
223
+This release picks up the targeted fix in [go-libp2p-kad-dht#1244](https://github.com/libp2p/go-libp2p-kad-dht/pull/1244). A broader fix covering the whole class of routing publish races is proposed upstream in [go-libp2p#3490](https://github.com/libp2p/go-libp2p/pull/3490).
224
+
225
#### 📦️ Dependency updates
226
227
- update `go-libp2p` to [v0.48.0](https://github.com/libp2p/go-libp2p/releases/tag/v0.48.0)
219
-- update `go-libp2p-kad-dht` to [v0.39.0](https://github.com/libp2p/go-libp2p-kad-dht/releases/tag/v0.39.0)
228
+- update `go-libp2p-kad-dht` to [v0.39.1](https://github.com/libp2p/go-libp2p-kad-dht/releases/tag/v0.39.1) (incl. [v0.39.0](https://github.com/libp2p/go-libp2p-kad-dht/releases/tag/v0.39.0))
229
- update `ipfs-webui` to [v4.12.0](https://github.com/ipfs/ipfs-webui/releases/tag/v4.12.0)
230
- update `gateway-conformance` tests to [v0.13](https://github.com/ipfs/gateway-conformance/releases/tag/v0.13.0) (incl. [v0.12](https://github.com/ipfs/gateway-conformance/releases/tag/v0.12.0), [v0.11](https://github.com/ipfs/gateway-conformance/releases/tag/v0.11.0))
231
- update `boxo` to [v0.38.0](https://github.com/ipfs/boxo/releases/tag/v0.38.0)
docs/examples/kubo-as-a-library/go.mod
+1
-1
@@ -118,7 +118,7 @@ require (
118
github.com/libp2p/go-doh-resolver v0.5.0 // indirect
119
github.com/libp2p/go-flow-metrics v0.3.0 // indirect
120
github.com/libp2p/go-libp2p-asn-util v0.4.1 // indirect
121
- github.com/libp2p/go-libp2p-kad-dht v0.39.1-0.20260326020727-bcbc21e9f633 // indirect
121
+ github.com/libp2p/go-libp2p-kad-dht v0.39.1 // indirect
122
github.com/libp2p/go-libp2p-kbucket v0.8.0 // indirect
123
github.com/libp2p/go-libp2p-pubsub v0.15.0 // indirect
124
github.com/libp2p/go-libp2p-pubsub-router v0.6.0 // indirect
docs/examples/kubo-as-a-library/go.sum
+2
-2
@@ -494,8 +494,8 @@ github.com/libp2p/go-libp2p-asn-util v0.4.1 h1:xqL7++IKD9TBFMgnLPZR6/6iYhawHKHl9
494
github.com/libp2p/go-libp2p-asn-util v0.4.1/go.mod h1:d/NI6XZ9qxw67b4e+NgpQexCIiFYJjErASrYW4PFDN8=
495
github.com/libp2p/go-libp2p-core v0.2.4/go.mod h1:STh4fdfa5vDYr0/SzYYeqnt+E6KfEV5VxfIrm0bcI0g=
496
github.com/libp2p/go-libp2p-core v0.3.0/go.mod h1:ACp3DmS3/N64c2jDzcV429ukDpicbL6+TrrxANBjPGw=
497
-github.com/libp2p/go-libp2p-kad-dht v0.39.1-0.20260326020727-bcbc21e9f633 h1:PcubpdBr1BBg39st+CqGp3EOX++DOBK6B/s07P31eMg=
498
-github.com/libp2p/go-libp2p-kad-dht v0.39.1-0.20260326020727-bcbc21e9f633/go.mod h1:Po2JugFEkDq9Vig/JXtc153ntOi0q58o4j7IuITCOVs=
497
+github.com/libp2p/go-libp2p-kad-dht v0.39.1 h1:9RzUBc7zywT4ZNamRSgEvPZmVlK3Y6xdlCYfXXvlR/Q=
498
+github.com/libp2p/go-libp2p-kad-dht v0.39.1/go.mod h1:Po2JugFEkDq9Vig/JXtc153ntOi0q58o4j7IuITCOVs=
499
github.com/libp2p/go-libp2p-kbucket v0.3.1/go.mod h1:oyjT5O7tS9CQurok++ERgc46YLwEpuGoFq9ubvoUOio=
500
github.com/libp2p/go-libp2p-kbucket v0.8.0 h1:QAK7RzKJpYe+EuSEATAaaHYMYLkPDGC18m9jxPLnU8s=
501
github.com/libp2p/go-libp2p-kbucket v0.8.0/go.mod h1:JMlxqcEyKwO6ox716eyC0hmiduSWZZl6JY93mGaaqc4=
go.mod
+1
-1
@@ -52,7 +52,7 @@ require (
52
github.com/libp2p/go-doh-resolver v0.5.0
53
github.com/libp2p/go-libp2p v0.48.0
54
github.com/libp2p/go-libp2p-http v0.5.0
55
- github.com/libp2p/go-libp2p-kad-dht v0.39.0
55
+ github.com/libp2p/go-libp2p-kad-dht v0.39.1
56
github.com/libp2p/go-libp2p-kbucket v0.8.0
57
github.com/libp2p/go-libp2p-pubsub v0.15.0
58
github.com/libp2p/go-libp2p-pubsub-router v0.6.0
go.sum
+2
-2
@@ -549,8 +549,8 @@ github.com/libp2p/go-libp2p-gostream v0.6.0 h1:QfAiWeQRce6pqnYfmIVWJFXNdDyfiR/qk
549
github.com/libp2p/go-libp2p-gostream v0.6.0/go.mod h1:Nywu0gYZwfj7Jc91PQvbGU8dIpqbQQkjWgDuOrFaRdA=
550
github.com/libp2p/go-libp2p-http v0.5.0 h1:+x0AbLaUuLBArHubbbNRTsgWz0RjNTy6DJLOxQ3/QBc=
551
github.com/libp2p/go-libp2p-http v0.5.0/go.mod h1:glh87nZ35XCQyFsdzZps6+F4HYI6DctVFY5u1fehwSg=
552
-github.com/libp2p/go-libp2p-kad-dht v0.39.0 h1:mww38eBYiUvdsu+Xl/GLlBC0Aa8M+5HAwvafkFOygAM=
553
-github.com/libp2p/go-libp2p-kad-dht v0.39.0/go.mod h1:Po2JugFEkDq9Vig/JXtc153ntOi0q58o4j7IuITCOVs=
552
+github.com/libp2p/go-libp2p-kad-dht v0.39.1 h1:9RzUBc7zywT4ZNamRSgEvPZmVlK3Y6xdlCYfXXvlR/Q=
553
+github.com/libp2p/go-libp2p-kad-dht v0.39.1/go.mod h1:Po2JugFEkDq9Vig/JXtc153ntOi0q58o4j7IuITCOVs=
554
github.com/libp2p/go-libp2p-kbucket v0.3.1/go.mod h1:oyjT5O7tS9CQurok++ERgc46YLwEpuGoFq9ubvoUOio=
555
github.com/libp2p/go-libp2p-kbucket v0.8.0 h1:QAK7RzKJpYe+EuSEATAaaHYMYLkPDGC18m9jxPLnU8s=
556
github.com/libp2p/go-libp2p-kbucket v0.8.0/go.mod h1:JMlxqcEyKwO6ox716eyC0hmiduSWZZl6JY93mGaaqc4=
test/dependencies/go.mod
+1
-1
@@ -183,7 +183,7 @@ require (
183
github.com/libp2p/go-flow-metrics v0.3.0 // indirect
184
github.com/libp2p/go-libp2p v0.48.0 // indirect
185
github.com/libp2p/go-libp2p-asn-util v0.4.1 // indirect
186
- github.com/libp2p/go-libp2p-kad-dht v0.39.1-0.20260326020727-bcbc21e9f633 // indirect
186
+ github.com/libp2p/go-libp2p-kad-dht v0.39.1 // indirect
187
github.com/libp2p/go-libp2p-kbucket v0.8.0 // indirect
188
github.com/libp2p/go-libp2p-record v0.3.1 // indirect
189
github.com/libp2p/go-libp2p-routing-helpers v0.7.5 // indirect
test/dependencies/go.sum
+2
-2
@@ -582,8 +582,8 @@ github.com/libp2p/go-libp2p v0.48.0 h1:h2BrLAgrj7X8bEN05K7qmrjpNHYA+6tnsGRdprjTn
582
github.com/libp2p/go-libp2p v0.48.0/go.mod h1:Q1fBZNdmC2Hf82husCTfkKJVfHm2we5zk+NWmOGEmWk=
583
github.com/libp2p/go-libp2p-asn-util v0.4.1 h1:xqL7++IKD9TBFMgnLPZR6/6iYhawHKHl950SO9L6n94=
584
github.com/libp2p/go-libp2p-asn-util v0.4.1/go.mod h1:d/NI6XZ9qxw67b4e+NgpQexCIiFYJjErASrYW4PFDN8=
585
-github.com/libp2p/go-libp2p-kad-dht v0.39.1-0.20260326020727-bcbc21e9f633 h1:PcubpdBr1BBg39st+CqGp3EOX++DOBK6B/s07P31eMg=
586
-github.com/libp2p/go-libp2p-kad-dht v0.39.1-0.20260326020727-bcbc21e9f633/go.mod h1:Po2JugFEkDq9Vig/JXtc153ntOi0q58o4j7IuITCOVs=
585
+github.com/libp2p/go-libp2p-kad-dht v0.39.1 h1:9RzUBc7zywT4ZNamRSgEvPZmVlK3Y6xdlCYfXXvlR/Q=
586
+github.com/libp2p/go-libp2p-kad-dht v0.39.1/go.mod h1:Po2JugFEkDq9Vig/JXtc153ntOi0q58o4j7IuITCOVs=
587
github.com/libp2p/go-libp2p-kbucket v0.8.0 h1:QAK7RzKJpYe+EuSEATAaaHYMYLkPDGC18m9jxPLnU8s=
588
github.com/libp2p/go-libp2p-kbucket v0.8.0/go.mod h1:JMlxqcEyKwO6ox716eyC0hmiduSWZZl6JY93mGaaqc4=
589
github.com/libp2p/go-libp2p-record v0.3.1 h1:cly48Xi5GjNw5Wq+7gmjfBiG9HCzQVkiZOUZ8kUl+Fg=