Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

gh-132942: Fix races in type lookup cache#133032

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
nascheme merged 4 commits intopython:mainfromnascheme:gh-132942-tp-lookup-race
Apr 28, 2025

Conversation

nascheme
Copy link
Member

@naschemenascheme commentedApr 27, 2025
edited
Loading

Two races related to the type lookup cache, when used in the free-threaded build. This caused test_opcache to sometimes fail (as well as other hard to reproduce failures).

The first problem is thatfind_name_in_mro() can block on some mutex and then release critical sections. If that happens, the type version used for the cache entry can be wrong (too new). Assigning the version before doing the find fixes this issue. If it does race, you will add an entry that uses an out-of-date version.

The second problem was much harder to track down. There is a hard to trigger race inupdate_cache(), writing to cache, and_PyType_LookupStackRefAndVersion(), reading from cache. We use a sequence lock to avoid races. However, if the reader reads the old entry value and the new entry version, it will try to execute_Py_TryXGetStackRef() on a stale cache entry value. If that value has been deallocated,PyStackRef_XCLOSE() will crash. This could happen before because the version was written first and then new value second.

The fix is simply to write the entry value first and the version after. That way, the reader always sees a value at least as new as the version.

Possible scenarios for the reader of the cache entry, as it is being written to concurrently:

entry versionentry valueoutcome
oldoldOkay, type version will not match
oldnewOkay, incref/decref works, seq check fails
newoldBad, incref/decref on old value might crash
newnewOkay, incref/decref works, seq check fails

Two races related to the type lookup cache, when used in thefree-threaded build.  This caused test_opcache to sometimes fail (aswell as other hard to re-produce failures).
@naschemenascheme added type-crashA hard crash of the interpreter, possibly with a core dump topic-free-threading labelsApr 27, 2025
@naschemenascheme marked this pull request as ready for reviewApril 27, 2025 01:38
@nascheme
Copy link
MemberAuthor

Here is a script that triggers the crash. It can take a while, especially if running under "rr".

crash_mro_lookup.py.txt

Copy link
Contributor

@colesburycolesbury left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

LGTM

@naschemenascheme merged commit31d1342 intopython:mainApr 28, 2025
46 checks passed
@naschemenascheme added the needs backport to 3.13bugs and security fixes labelApr 28, 2025
@miss-islington-app
Copy link

Thanks@nascheme for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

@miss-islington-app
Copy link

Sorry,@nascheme, I could not cleanly backport this to3.13 due to a conflict.
Please backport usingcherry_picker on command line.

cherry_picker 31d1342de9489f95384dbc748130c2ae6f092e84 3.13

@hugovkhugovk removed the needs backport to 3.13bugs and security fixes labelMay 22, 2025
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@colesburycolesburycolesbury approved these changes

@markshannonmarkshannonAwaiting requested review from markshannonmarkshannon is a code owner

Assignees

@naschemenascheme

Labels
topic-free-threadingtype-crashA hard crash of the interpreter, possibly with a core dump
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

3 participants
@nascheme@colesbury@hugovk

[8]ページ先頭

©2009-2025 Movatter.jp