From e8fb088dbaa71dd5f0146b2f4a8f7ecbe2ce9625 Mon Sep 17 00:00:00 2001 From: Peter Bierma Date: Fri, 9 Aug 2024 14:06:36 +0000 Subject: [PATCH] [3.13] gh-122695: Fix double-free when using `gc.get_referents` with a freed `_asyncio.FutureIter` (#122837) * Backport #122834 for 3.13 --- Lib/test/test_asyncio/test_futures.py | 8 ++++++++ .../2024-08-08-15-05-58.gh-issue-122695.f7pwBv.rst | 2 ++ Modules/_asynciomodule.c | 11 ----------- 3 files changed, 10 insertions(+), 11 deletions(-) create mode 100644 Misc/NEWS.d/next/Library/2024-08-08-15-05-58.gh-issue-122695.f7pwBv.rst diff --git a/Lib/test/test_asyncio/test_futures.py b/Lib/test/test_asyncio/test_futures.py index 458b70451a3..2417712a9c9 100644 --- a/Lib/test/test_asyncio/test_futures.py +++ b/Lib/test/test_asyncio/test_futures.py @@ -675,6 +675,14 @@ class CFutureTests(BaseFutureTests, test_utils.TestCase): with self.assertRaises(AttributeError): del fut._log_traceback + def test_future_iter_get_referents_segfault(self): + # See https://github.com/python/cpython/issues/122695 + import _asyncio + it = iter(self._new_future(loop=self.loop)) + del it + evil = gc.get_referents(_asyncio) + gc.collect() + @unittest.skipUnless(hasattr(futures, '_CFuture'), 'requires the C _asyncio module') diff --git a/Misc/NEWS.d/next/Library/2024-08-08-15-05-58.gh-issue-122695.f7pwBv.rst b/Misc/NEWS.d/next/Library/2024-08-08-15-05-58.gh-issue-122695.f7pwBv.rst new file mode 100644 index 00000000000..cc6bc38f419 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2024-08-08-15-05-58.gh-issue-122695.f7pwBv.rst @@ -0,0 +1,2 @@ +Fixed double-free when using :func:`gc.get_referents` with a freed +:class:`asyncio.Future` iterator. diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c index 6e87de5e954..3babd33eaab 100644 --- a/Modules/_asynciomodule.c +++ b/Modules/_asynciomodule.c @@ -3529,17 +3529,6 @@ module_traverse(PyObject *mod, visitproc visit, void *arg) Py_VISIT(state->iscoroutine_typecache); Py_VISIT(state->context_kwname); - -#ifndef Py_GIL_DISABLED - // Visit freelist. - PyObject *next = (PyObject*) state->fi_freelist; - while (next != NULL) { - PyObject *current = next; - Py_VISIT(current); - next = (PyObject*) ((futureiterobject*) current)->future; - } -#endif - return 0; }