mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-22 01:35:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 13

gh-130019: Fix data race in _PyType_AllocNoTrack (gh-130058)

Browse source 
The reference count fields, such as `ob_tid` and `ob_ref_shared`, may be
accessed concurrently in the free threading build by a `_Py_TryXGetRef`
or similar operation. The PyObject header fields will be initialized by
`_PyObject_Init`, so only call `memset()` to zero-initialize the remainder
of the allocation.
This commit is contained in:
Sam Gross 2025-02-13 11:50:45 -05:00 • committed by GitHub
parent c357d69003
commit 0559339ccd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 9 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Objects/typeobject.c
View file

@ -2251,7 +2251,9 @@ _PyType_AllocNoTrack(PyTypeObject *type, Py_ssize_t nitems)
if (PyType_IS_GC(type)) {
_PyObject_GC_Link(obj);
}
memset(obj, '\0', size);
// Zero out the object after the PyObject header. The header fields are
// initialized by _PyObject_Init[Var]().
memset((char *)obj + sizeof(PyObject), 0, size - sizeof(PyObject));
if (type->tp_itemsize == 0) {
_PyObject_Init(obj, type);

5
Python/gc.c
View file

@ -2310,11 +2310,12 @@ PyObject *
PyUnstable_Object_GC_NewWithExtraData(PyTypeObject *tp, size_t extra_size)
{
size_t presize = _PyType_PreHeaderSize(tp);
PyObject *op = gc_alloc(tp, _PyObject_SIZE(tp) + extra_size, presize);
size_t size = _PyObject_SIZE(tp) + extra_size;
PyObject *op = gc_alloc(tp, size, presize);
if (op == NULL) {
return NULL;
}
memset(op, 0, _PyObject_SIZE(tp) + extra_size);
memset((char *)op + sizeof(PyObject), 0, size - sizeof(PyObject));
_PyObject_Init(op, tp);
return op;
}

5
Python/gc_free_threading.c
View file

@ -2595,11 +2595,12 @@ PyObject *
PyUnstable_Object_GC_NewWithExtraData(PyTypeObject *tp, size_t extra_size)
{
size_t presize = _PyType_PreHeaderSize(tp);
PyObject *op = gc_alloc(tp, _PyObject_SIZE(tp) + extra_size, presize);
size_t size = _PyObject_SIZE(tp) + extra_size;
PyObject *op = gc_alloc(tp, size, presize);
if (op == NULL) {
return NULL;
}
memset(op, 0, _PyObject_SIZE(tp) + extra_size);
memset((char *)op + sizeof(PyObject), 0, size - sizeof(PyObject));
_PyObject_Init(op, tp);
return op;
}