From 29356e03d4f8800b04f799efe7a10e3ce8b16f61 Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Wed, 18 Mar 2020 03:04:33 +0100 Subject: [PATCH] bpo-39877: Fix take_gil() for daemon threads (GH-19054) bpo-39877, bpo-39984: If the thread must exit, don't access tstate to prevent a potential crash: tstate memory has been freed. --- Python/ceval_gil.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Python/ceval_gil.h b/Python/ceval_gil.h index 9c051ae57b0..f8b06ac68c9 100644 --- a/Python/ceval_gil.h +++ b/Python/ceval_gil.h @@ -281,13 +281,17 @@ _ready: if (_Py_atomic_load_relaxed(&ceval->gil_drop_request)) { RESET_GIL_DROP_REQUEST(ceval); } - if (tstate->async_exc != NULL) { + + int must_exit = tstate_must_exit(tstate); + + /* Don't access tstate if the thread must exit */ + if (!must_exit && tstate->async_exc != NULL) { _PyEval_SignalAsyncExc(ceval); } MUTEX_UNLOCK(gil->mutex); - if (tstate_must_exit(tstate)) { + if (must_exit) { /* bpo-36475: If Py_Finalize() has been called and tstate is not the thread which called Py_Finalize(), exit immediately the thread.