From f1c6ae3270913e095d24ae13ecf96f5a32c8c503 Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Sat, 22 Jan 2022 15:08:42 +0100 Subject: [PATCH] bpo-46417: Fix race condition on setting type __bases__ (GH-30788) Fix a race condition on setting a type __bases__ attribute: the internal function add_subclass() now gets the PyTypeObject.tp_subclasses member after calling PyWeakref_NewRef() which can trigger a garbage collection which can indirectly modify PyTypeObject.tp_subclasses. --- .../2022-01-22-14-39-23.bpo-46417.3U5SfN.rst | 5 ++++ Objects/typeobject.c | 27 +++++++++++-------- 2 files changed, 21 insertions(+), 11 deletions(-) create mode 100644 Misc/NEWS.d/next/Core and Builtins/2022-01-22-14-39-23.bpo-46417.3U5SfN.rst diff --git a/Misc/NEWS.d/next/Core and Builtins/2022-01-22-14-39-23.bpo-46417.3U5SfN.rst b/Misc/NEWS.d/next/Core and Builtins/2022-01-22-14-39-23.bpo-46417.3U5SfN.rst new file mode 100644 index 00000000000..54fe09b7ba4 --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2022-01-22-14-39-23.bpo-46417.3U5SfN.rst @@ -0,0 +1,5 @@ +Fix a race condition on setting a type ``__bases__`` attribute: the internal +function ``add_subclass()`` now gets the ``PyTypeObject.tp_subclasses`` +member after calling :c:func:`PyWeakref_NewRef` which can trigger a garbage +collection which can indirectly modify ``PyTypeObject.tp_subclasses``. Patch +by Victor Stinner. diff --git a/Objects/typeobject.c b/Objects/typeobject.c index e4a4824fa2e..2b47afe30e6 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -6503,24 +6503,29 @@ PyType_Ready(PyTypeObject *type) static int add_subclass(PyTypeObject *base, PyTypeObject *type) { - int result = -1; - PyObject *dict, *key, *newobj; + PyObject *key = PyLong_FromVoidPtr((void *) type); + if (key == NULL) + return -1; - dict = base->tp_subclasses; + PyObject *ref = PyWeakref_NewRef((PyObject *)type, NULL); + if (ref == NULL) { + Py_DECREF(key); + return -1; + } + + // Only get tp_subclasses after creating the key and value. + // PyWeakref_NewRef() can trigger a garbage collection which can execute + // arbitrary Python code and so modify base->tp_subclasses. + PyObject *dict = base->tp_subclasses; if (dict == NULL) { base->tp_subclasses = dict = PyDict_New(); if (dict == NULL) return -1; } assert(PyDict_CheckExact(dict)); - key = PyLong_FromVoidPtr((void *) type); - if (key == NULL) - return -1; - newobj = PyWeakref_NewRef((PyObject *)type, NULL); - if (newobj != NULL) { - result = PyDict_SetItem(dict, key, newobj); - Py_DECREF(newobj); - } + + int result = PyDict_SetItem(dict, key, ref); + Py_DECREF(ref); Py_DECREF(key); return result; }