gh-108987: Fix _thread.start_new_thread() race condition (#109135)

Fix _thread.start_new_thread() race condition. If a thread is created
during Python finalization, the newly spawned thread now exits
immediately instead of trying to access freed memory and lead to a
crash.

thread_run() calls PyEval_AcquireThread() which checks if the thread
must exit. The problem was that tstate was dereferenced earlier in
_PyThreadState_Bind() which leads to a crash most of the time.

Move _PyThreadState_CheckConsistency() from thread_run() to
_PyThreadState_Bind().
This commit is contained in:
Victor Stinner 2023-09-11 17:27:03 +02:00 committed by GitHub
parent c0f488b88f
commit 517cd82ea7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 69 additions and 41 deletions

View file

@ -71,6 +71,8 @@ extern _Py_thread_local PyThreadState *_Py_tss_tstate;
extern int _PyThreadState_CheckConsistency(PyThreadState *tstate);
#endif
int _PyThreadState_MustExit(PyThreadState *tstate);
// Export for most shared extensions, used via _PyThreadState_GET() static
// inline function.
PyAPI_FUNC(PyThreadState *) _PyThreadState_GetCurrent(void);