diff options
| author |   Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2024-06-04 21:57:18 +0200 |
|---|---|---|
| committer |   GitHub <noreply@github.com> | 2024-06-04 19:57:18 +0000 |
| commit | 327a36a4f98466e734bf3b10994290fceab8fdd2 (patch) | |
| tree | 2d8a7792df438d9d007da41b2fc66d7fffde68ec | |
| parent | [3.13] gh-119819: Update test to skip if _multiprocessing is unavailable. (GH... (diff) | |
| download | cpython-327a36a4f98466e734bf3b10994290fceab8fdd2.tar.gz cpython-327a36a4f98466e734bf3b10994290fceab8fdd2.tar.bz2 cpython-327a36a4f98466e734bf3b10994290fceab8fdd2.zip | |
[3.13] gh-119999: Fix potential race condition in `_Py_ExplicitMergeRefcount` (GH-120000) (#120073)
We need to write to `ob_ref_local` and `ob_tid` before `ob_ref_shared`.
Once we mark `ob_ref_shared` as merged, some other thread may free the
object because the caller also passes in `-1` as `extra` to give up its
only reference.
(cherry picked from commit 4055577221f5f52af329e87f31d81bb8fb02c504)
Co-authored-by: Sam Gross <colesbury@gmail.com>
| -rw-r--r-- | Objects/object.c | 19 |
1 files changed, 11 insertions, 8 deletions
diff --git a/Objects/object.c b/Objects/object.c index 9c74d5471b..1127fedc3f 100644 --- a/Objects/object.c +++ b/Objects/object.c @@ -401,24 +401,27 @@ Py_ssize_t _Py_ExplicitMergeRefcount(PyObject *op, Py_ssize_t extra) { assert(!_Py_IsImmortal(op)); + +#ifdef Py_REF_DEBUG + _Py_AddRefTotal(_PyThreadState_GET(), extra); +#endif + + // gh-119999: Write to ob_ref_local and ob_tid before merging the refcount. + Py_ssize_t local = (Py_ssize_t)op->ob_ref_local; + _Py_atomic_store_uint32_relaxed(&op->ob_ref_local, 0); + _Py_atomic_store_uintptr_relaxed(&op->ob_tid, 0); + Py_ssize_t refcnt; Py_ssize_t new_shared; Py_ssize_t shared = _Py_atomic_load_ssize_relaxed(&op->ob_ref_shared); do { refcnt = Py_ARITHMETIC_RIGHT_SHIFT(Py_ssize_t, shared, _Py_REF_SHARED_SHIFT); - refcnt += (Py_ssize_t)op->ob_ref_local; + refcnt += local; refcnt += extra; new_shared = _Py_REF_SHARED(refcnt, _Py_REF_MERGED); } while (!_Py_atomic_compare_exchange_ssize(&op->ob_ref_shared, &shared, new_shared)); - -#ifdef Py_REF_DEBUG - _Py_AddRefTotal(_PyThreadState_GET(), extra); -#endif - - _Py_atomic_store_uint32_relaxed(&op->ob_ref_local, 0); - _Py_atomic_store_uintptr_relaxed(&op->ob_tid, 0); return refcnt; } #endif /* Py_GIL_DISABLED */ |