gh-130019: Fix data race in _PyType_AllocNoTrack (gh-130058)

The reference count fields, such as `ob_tid` and `ob_ref_shared`, may be
accessed concurrently in the free threading build by a `_Py_TryXGetRef`
or similar operation. The PyObject header fields will be initialized by
`_PyObject_Init`, so only call `memset()` to zero-initialize the remainder
of the allocation.
This commit is contained in:
Sam Gross 2025-02-13 11:50:45 -05:00 committed by GitHub
parent c357d69003
commit 0559339ccd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 9 additions and 5 deletions

View file

@ -2310,11 +2310,12 @@ PyObject *
PyUnstable_Object_GC_NewWithExtraData(PyTypeObject *tp, size_t extra_size)
{
size_t presize = _PyType_PreHeaderSize(tp);
PyObject *op = gc_alloc(tp, _PyObject_SIZE(tp) + extra_size, presize);
size_t size = _PyObject_SIZE(tp) + extra_size;
PyObject *op = gc_alloc(tp, size, presize);
if (op == NULL) {
return NULL;
}
memset(op, 0, _PyObject_SIZE(tp) + extra_size);
memset((char *)op + sizeof(PyObject), 0, size - sizeof(PyObject));
_PyObject_Init(op, tp);
return op;
}

View file

@ -2595,11 +2595,12 @@ PyObject *
PyUnstable_Object_GC_NewWithExtraData(PyTypeObject *tp, size_t extra_size)
{
size_t presize = _PyType_PreHeaderSize(tp);
PyObject *op = gc_alloc(tp, _PyObject_SIZE(tp) + extra_size, presize);
size_t size = _PyObject_SIZE(tp) + extra_size;
PyObject *op = gc_alloc(tp, size, presize);
if (op == NULL) {
return NULL;
}
memset(op, 0, _PyObject_SIZE(tp) + extra_size);
memset((char *)op + sizeof(PyObject), 0, size - sizeof(PyObject));
_PyObject_Init(op, tp);
return op;
}