Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gh-119999: Fix potential race condition in _Py_ExplicitMergeRefcount #120000

Merged
merged 1 commit into from
Jun 4, 2024

Conversation

colesbury
Copy link
Contributor

@colesbury colesbury commented Jun 3, 2024

We need to write to ob_ref_local and ob_tid before ob_ref_shared. Once we mark ob_ref_shared as merged, some other thread may free the object because the caller also passes in -1 as extra to give up its only reference.

…efcount`

We need to write to `ob_ref_local` and `ob_tid` before `ob_ref_shared`.
Once we mark `ob_ref_shared` as merged, some other thread may free the
object because the caller also passes in `-1` as `extra` to give up its
only reference.
@colesbury colesbury requested a review from DinoV June 3, 2024 19:40
pimzero added a commit to pimzero/cpython that referenced this pull request Jun 3, 2024
…s.*Selector.select`

Since f70e1ca, and following PEP-475,
`select.select` (and calls to other multiplexing syscalls in the
`select` module) should not raise `InterruptedError`.

However, if a signal happen and interrupts the `select` syscall in
`select.select`, and it raises an exception (uncaught in the signal
handler), then the `select` syscall will returns `-EINTR`, `PyErr_CheckSignals()`
returns -1 and we don't retry the `select` syscall, the exception being
forwarded to the `select.select` caller (in our case,
`selectors.SelectSelector.select`.

It is an issue if the exception raised in the signal handler is
`InterruptedError`: given `selectors.SelectSelector.select` catches this
exception and returns an empty list, it is not possible to differentiate
between a timeout and a `InterruptedError` exception raised in a signal
handler (additionally, this exception is not propagated)
@JelleZijlstra JelleZijlstra changed the title gh-119999: Fix potentital race condition in _Py_ExplicitMergeRefcount gh-119999: Fix potential race condition in _Py_ExplicitMergeRefcount Jun 3, 2024
Copy link
Member

@corona10 corona10 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm (Please ignore my previous comment)

@colesbury colesbury merged commit 4055577 into python:main Jun 4, 2024
40 checks passed
@colesbury colesbury deleted the gh-119999-explicit-merge-refcount branch June 4, 2024 19:26
@miss-islington-app
Copy link

Thanks @colesbury for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jun 4, 2024
…fcount` (pythonGH-120000)

We need to write to `ob_ref_local` and `ob_tid` before `ob_ref_shared`.
Once we mark `ob_ref_shared` as merged, some other thread may free the
object because the caller also passes in `-1` as `extra` to give up its
only reference.
(cherry picked from commit 4055577)

Co-authored-by: Sam Gross <colesbury@gmail.com>
@bedevere-app
Copy link

bedevere-app bot commented Jun 4, 2024

GH-120073 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Jun 4, 2024
colesbury added a commit that referenced this pull request Jun 4, 2024
…efcount` (GH-120000) (#120073)

We need to write to `ob_ref_local` and `ob_tid` before `ob_ref_shared`.
Once we mark `ob_ref_shared` as merged, some other thread may free the
object because the caller also passes in `-1` as `extra` to give up its
only reference.
(cherry picked from commit 4055577)

Co-authored-by: Sam Gross <colesbury@gmail.com>
barneygale pushed a commit to barneygale/cpython that referenced this pull request Jun 5, 2024
…fcount` (python#120000)

We need to write to `ob_ref_local` and `ob_tid` before `ob_ref_shared`.
Once we mark `ob_ref_shared` as merged, some other thread may free the
object because the caller also passes in `-1` as `extra` to give up its
only reference.
noahbkim pushed a commit to hudson-trading/cpython that referenced this pull request Jul 11, 2024
…fcount` (python#120000)

We need to write to `ob_ref_local` and `ob_tid` before `ob_ref_shared`.
Once we mark `ob_ref_shared` as merged, some other thread may free the
object because the caller also passes in `-1` as `extra` to give up its
only reference.
estyxx pushed a commit to estyxx/cpython that referenced this pull request Jul 17, 2024
…fcount` (python#120000)

We need to write to `ob_ref_local` and `ob_tid` before `ob_ref_shared`.
Once we mark `ob_ref_shared` as merged, some other thread may free the
object because the caller also passes in `-1` as `extra` to give up its
only reference.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants