yoney · GitHub

Bug report

Bug description:

PyUnstable_Code_SetExtra and PyUnstable_Code_GetExtra in Objects/codeobject.c have no free-threaded protections. The co_extra field is read and written with plain loads and stores, and SetExtra calls PyMem_Realloc which can free the old buffer while a concurrent GetExtra is reading from it.

Similarly, PyUnstable_Eval_RequestCodeExtraIndex in Python/ceval.c increments co_extra_user_count and writes to co_extra_freefuncs without any synchronization.

The new tests (#144980) exercise the concurrent paths and a free-threaded TSAN build without the fix crashes/emits warnings.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

Read the original on github.com ↗