gh-130019: Fix data race in _PyType_AllocNoTrack (gh-130058)

The reference count fields, such as `ob_tid` and `ob_ref_shared`, may be
accessed concurrently in the free threading build by a `_Py_TryXGetRef`
or similar operation. The PyObject header fields will be initialized by
`_PyObject_Init`, so only call `memset()` to zero-initialize the remainder
of the allocation.
This commit is contained in:
Sam Gross 2025-02-13 11:50:45 -05:00 committed by GitHub
parent c357d69003
commit 0559339ccd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 9 additions and 5 deletions

View file

@ -2251,7 +2251,9 @@ _PyType_AllocNoTrack(PyTypeObject *type, Py_ssize_t nitems)
if (PyType_IS_GC(type)) {
_PyObject_GC_Link(obj);
}
memset(obj, '\0', size);
// Zero out the object after the PyObject header. The header fields are
// initialized by _PyObject_Init[Var]().
memset((char *)obj + sizeof(PyObject), 0, size - sizeof(PyObject));
if (type->tp_itemsize == 0) {
_PyObject_Init(obj, type);