Bug report

Bug description:

Attempting to access an attribute of a lazily-loaded module causes the module's__class__ to be reset before its attributes have been populated.

importimportlib.utilimportsysimportthreadingimporttime# Lazy load httpspec=importlib.util.find_spec("http")module=importlib.util.module_from_spec(spec)http=sys.modules["http"]=moduleloader=importlib.util.LazyLoader(spec.loader)loader.exec_module(module)defcheck():time.sleep(0.2)returnhttp.HTTPStatus.ACCEPTED==202defmulticheck():for_inrange(10):threading.Thread(target=check).start()ifsys.argv[1:]== ["single"]:check()else:multicheck()

The issue is here:

When attempting to access an attribute, the module's__dict__ is not updated until after__class__ is reset. If other threads attempt to access between these two points, then an attribute lookup can fail.

Assuming this is considered a bug, the two fixes I can think of are:

1. A module-scoped lock that is used to protect__getattribute__'s critical section. Theself.__class__ = type.ModuleType would need to be moved below__dict__.update(), which in turn would mean thatself.__spec__ andself.__dict__ would need to change toobject.__getattribute__(self, ...) lookups to avoid recursion.
2. A module-scoped dictionary of locks, one-per-_LazyModule. Here, additional work would be needed to remove no-longer-needed locks without creating another critical section where a thread enters_LazyModule.__getattribute__ but looks up its lock after it is removed by the first thread.

My suspicion is that one lock is enough, so I would suggest going with 1.

CPython versions tested on:

3.8, 3.10, 3.11, 3.12

Operating systems tested on:

Linux

Linked PRs

• gh-114763: Protect lazy loading modules from attribute access race #114781
• [3.12] gh-114763: Protect lazy loading modules from attribute access races (GH-114781) #115870
• [3.11] gh-114763: Protect lazy loading modules from attribute access races (GH-114781) #115871