Valkey on Quanye's Blog

RESP3 push frame torn apart when a pubsub message >= 16384 bytes is delivered to the publishing connection (9.0 regression)

quanyemostima@gmail.com (quanye) — Wed, 22 Jul 2026 11:55:36 +0800

First issue binbin assigned directly to me — I used it to dig into this code path.

Original issue: https://github.com/valkey-io/valkey/issues/4231

Preventing UAF from synchronous reentrancy

quanyemostima@gmail.com (quanye) — Tue, 21 Jul 2026 15:43:38 +0800

We have seen several segfaults of this class already.

This PR targets single-thread free UAFs: https://github.com/valkey-io/valkey/pull/4212 We also hit the same pattern in multithread RDMA crashes and Valkey Over RDMA server UAF in tests, so we are trying to address it at the architecture level.

UAF with multiple BLPOP waiters

quanyemostima@gmail.com (quanye) — Tue, 21 Jul 2026 11:15:35 +0800

1. What is BLPOP?
#

Ordinary LPOP mylist: if the list is empty, return (nil) immediately.

RDB_OPCODE_SLOT_IMPORT short job_name causes server-side heap out-of-bounds read during startup RDB loading

quanyemostima@gmail.com (quanye) — Sun, 19 Jul 2026 12:33:27 +0800

https://github.com/valkey-io/valkey/issues/4207

A security-class issue — link above; worth trying to fix.

Classic trust-boundary length-contract mismatch: the command path requires job_name to be exactly 40 bytes, but the RDB load path does not validate, so memcpy(..., 40) OOB-reads from a short SDS.

Client-side caching: server reverse-index leak after disconnect (unbounded growth)

quanyemostima@gmail.com (quanye) — Wed, 15 Jul 2026 22:08:11 +0800

The core of Issue #4143 is that Client Side Caching (CSC) deliberately skips immediate cleanup of the server-side reverse index when a client disconnects, which lets the inner tables grow without bound. Below we break it down as mechanism → memory layout → lifecycle → gap.

Valkey Over RDMA: server UAF crash in tests

quanyemostima@gmail.com (quanye) — Tue, 14 Jul 2026 21:46:50 +0800

https://github.com/valkey-io/valkey/issues/3345

Main symptom: segfault on Ctrl+C — how do we fix it?

Our PR:

https://github.com/valkey-io/valkey/pull/3448

To explain this UAF server crash clearly in interviews, we need a careful postmortem. This is another Valkey Over RDMA series issue:

Multithread RDMA crash (lock-free IO queue model)

quanyemostima@gmail.com (quanye) — Tue, 14 Jul 2026 21:27:29 +0800

If it’s broken, I’ll fix it!

Reintroducing an interesting problem (background)
#

Description: This write-up fixes RDMA crashes under multithreading. While we work on it, main is also refactoring the I/O model — we do not yet know if the new model still hits this. (Verify later.)

Valkey Over RDMA Internals

quanyemostima@gmail.com (quanye) — Mon, 13 Jul 2026 15:03:13 +0800

2. RDMA basics

How does communication actually work?

TCP is a stream protocol (byte stream); RDMA is message-oriented (elements).

Raft Cluster valkey-cli Tooling Compatibility

quanyemostima@gmail.com (quanye) — Mon, 13 Jul 2026 14:53:53 +0800

Also a very interesting topic — Valkey recently introduced Raft.

This PR addresses the following: in a Raft cluster, the server-side execution model for topology-change commands has changed, but valkey-cli --cluster fix still sends commands using the old gossip transaction model, so the two are incompatible.

Raft Cluster Support For Non-Voting Members

quanyemostima@gmail.com (quanye) — Sun, 12 Jul 2026 23:44:47 +0800

Another interesting Raft topic: implement a new role — Learner. The schedule was tight, and this is clearly more challenging than Pre-Vote.

Raft Cluster Pre-Vote Protocol

quanyemostima@gmail.com (quanye) — Sun, 12 Jul 2026 23:06:26 +0800

Written early in the pluggable Raft cluster-bus work — the design was still forming. This is mainly a learning note while I tried to implement Raft Pre-Vote in Redis/Valkey Cluster V2. It has since merged; this is also a retrospective.

How Are Event Notifications Produced?

quanyemostima@gmail.com (quanye) — Thu, 09 Jul 2026 15:50:02 +0800

Look at an RDMA context:

typedef struct RdmaContext {

    connection * conn; // 上层连接结构体
    char * ip;
    int port;
    long long keepalive_te; /* RDMA has no transport layer keepalive */
    struct ibv_pd * pd; // 保护域
    struct rdma_event_channel * cm_channel;
    struct ibv_comp_channel * comp_channel; // CQ的通知事件，用来触发POLLIN事件
    struct ibv_cq * cq;

    /* TX */
    RdmaXfer tx;
    char * tx_addr; /* remote transfer buffer address */
    uint32_t tx_key; /* remote transfer buffer key */
    uint32_t tx_length; /* remote transfer buffer length */
    uint32_t tx_offset; /* remote transfer buffer offset */
    uint32_t tx_ops; /* operations on remote transfer */

    /* RX */
    RdmaXfer rx;

    /* CMD 0 ~ VALKEY_RDMA_MAX_WQE for recv buffer
     * VALKEY_RDMA_MAX_WQE ~ 2 * VALKEY_RDMA_MAX_WQE -1 for send buffer */
    ValkeyRdmaCmd * cmd_buf;
    struct ibv_mr * cmd_mr;

}
RdmaContext;

RDMA Library Runtime Dynamic Loading (for client and benchmark)

quanyemostima@gmail.com (quanye) — Mon, 06 Jul 2026 16:56:17 +0800

Two PRs:

Valkey main-repo change libvalkey upstream

We mainly cover dynamic loading of the two RDMA libraries (librdmacm, libibverbs) for client and benchmark.

32-bit Valkey builds: header include order and off_t ABI mismatch

quanyemostima@gmail.com (quanye) — Sun, 05 Jul 2026 19:28:49 +0800

This PR is memorable: it was our first PR to Valkey.

Static linking background also shows up in CSAPP Linker Lab.

valkey-benchmark RDMA lost-wakeup

quanyemostima@gmail.com (quanye) — Sun, 05 Jul 2026 19:24:12 +0800

https://github.com/valkey-io/valkey/issues/3345#issuecomment-4084382404

Users hit GET hangs with the benchmark client? Initial analysis: lost wakeup.

Deleting code is cooler than adding code.

Raft-based cluster bus (Cluster V2)

quanyemostima@gmail.com (quanye) — Thu, 02 Jul 2026 23:24:33 +0800

Recently the Valkey community has been exploring a new feature: driving Cluster bus communication with the Raft protocol. I had just finished learning Raft and master–replica replication, and claimed an issue, so I wanted to dig deeper and try to solve more problems in this area.

Valkey Over RDMA: Multithread Tests (New Test Framework)

quanyemostima@gmail.com (quanye) — Mon, 29 Jun 2026 17:13:42 +0800

I treat this as a new feature: use the libvalkey client to simulate load, with multithread support.

Test logic for this change
#

This is a new feature; we need a new PR.

CVE-2026-25243 Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution

quanyemostima@gmail.com (quanye) — Wed, 27 May 2026 23:17:00 +0800

CVE-2026-25243 — Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution
#

The trigger is Redis’s RESTORE command.

CVE-2026-27623 Pre-Authentication DOS from malformed RESP request

quanyemostima@gmail.com (quanye) — Tue, 26 May 2026 23:06:59 +0800

CVE-2026-27623 — Pre-Authentication DOS from malformed RESP request
#

Valkey pre-auth DoS | RESP protocol state machine | CVSS 3.1: 7.5 HIGH | CWE-20 | no auth required | Reproduction steps

Multithread RDMA crash

quanyemostima@gmail.com (quanye) — Sun, 17 May 2026 10:48:06 +0800

Notes from trying to fix [CRASH] Does Valkey over RDMA not support I/O threads? #3112.

https://github.com/valkey-io/valkey/issues/3112

Summarizing the experimental workflow — longest campaign yet; over a month and still not merged.

Why multithreading causes issues (summary)

quanyemostima@gmail.com (quanye) — Fri, 15 May 2026 22:11:18 +0800

Multithread RDMA crash Multithread RDMA crash (lock-free IO queue model) Both issues relate to the RDMA notification model. For socket/unix, ConnectionType.update_state is NULL, so connUpdateState is essentially a no-op. For RDMA, updateRdmaState calls straight into the data path:

Multithread RDB crash

quanyemostima@gmail.com (quanye) — Fri, 15 May 2026 22:10:35 +0800

This looks like a multithread-only issue — revisit later. I hit this as a new Valkey problem while testing; worth trying first. Reproduction sketch: Build on unstable, start a server without changing valkey.conf; under load an RDB should appear by default. Test on the main thread and see if it fails.