Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

gh-119999: Fix potential race condition in `_Py_ExplicitMergeRefcount` (#120000) 

We need to write to `ob_ref_local` and `ob_tid` before `ob_ref_shared`.
Once we mark `ob_ref_shared` as merged, some other thread may free the
object because the caller also passes in `-1` as `extra` to give up its
only reference.
This commit is contained in:
Sam Gross 2024-06-04 15:26:26 -04:00 committed by GitHub
parent 109e1082ea
commit 4055577221
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 14 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
Objects/object.c
View File

@ -401,24 +401,27 @@ Py_ssize_t
_Py_ExplicitMergeRefcount(PyObject *op, Py_ssize_t extra) _Py_ExplicitMergeRefcount(PyObject *op, Py_ssize_t extra)
{ {
assert(!_Py_IsImmortal(op)); assert(!_Py_IsImmortal(op));
Py_ssize_t refcnt;
Py_ssize_t new_shared;
Py_ssize_t shared = _Py_atomic_load_ssize_relaxed(&op->ob_ref_shared);
do {
refcnt = Py_ARITHMETIC_RIGHT_SHIFT(Py_ssize_t, shared, _Py_REF_SHARED_SHIFT);
refcnt += (Py_ssize_t)op->ob_ref_local;
refcnt += extra;
new_shared = _Py_REF_SHARED(refcnt, _Py_REF_MERGED);
} while (!_Py_atomic_compare_exchange_ssize(&op->ob_ref_shared,
&shared, new_shared));
#ifdef Py_REF_DEBUG #ifdef Py_REF_DEBUG
_Py_AddRefTotal(_PyThreadState_GET(), extra); _Py_AddRefTotal(_PyThreadState_GET(), extra);
#endif #endif
// gh-119999: Write to ob_ref_local and ob_tid before merging the refcount.
Py_ssize_t local = (Py_ssize_t)op->ob_ref_local;
_Py_atomic_store_uint32_relaxed(&op->ob_ref_local, 0); _Py_atomic_store_uint32_relaxed(&op->ob_ref_local, 0);
_Py_atomic_store_uintptr_relaxed(&op->ob_tid, 0); _Py_atomic_store_uintptr_relaxed(&op->ob_tid, 0);
Py_ssize_t refcnt;
Py_ssize_t new_shared;
Py_ssize_t shared = _Py_atomic_load_ssize_relaxed(&op->ob_ref_shared);
do {
refcnt = Py_ARITHMETIC_RIGHT_SHIFT(Py_ssize_t, shared, _Py_REF_SHARED_SHIFT);
refcnt += local;
refcnt += extra;
new_shared = _Py_REF_SHARED(refcnt, _Py_REF_MERGED);
} while (!_Py_atomic_compare_exchange_ssize(&op->ob_ref_shared,
&shared, new_shared));
return refcnt; return refcnt;
} }
#endif /* Py_GIL_DISABLED */ #endif /* Py_GIL_DISABLED */