python / python/cpython

Data race on `kqueue.kqfd` between `close()` and the `closed` getter with free-threading build

Open
#151,364 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

topic-free-threading type-bug
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:

select.kqueue accesses its internal kqfd file-descriptor field with no synchronization. So kqueue.close() can write the kqfd,

https://github.com/python/cpython/blob/b18168cb32d545ed976b760983478cbd5dde5bdf/Modules/selectmodule.c#L2160-L2165

while the closed getter reads it.

https://github.com/python/cpython/blob/b18168cb32d545ed976b760983478cbd5dde5bdf/Modules/selectmodule.c#L2276-L2279

Reproducer:

import select
from threading import Thread

slot = [select.kqueue()]

def reader():
    for _ in range(200000):
        try:
            _ = slot[0].closed
        except Exception:
            pass

def churner():
    for _ in range(200000):
        kq = select.kqueue()
        slot[0] = kq
        kq.close()

threads  = [Thread(target=reader)  for _ in range(4)]
threads += [Thread(target=churner) for _ in range(4)]
for t in threads: t.start()
for t in threads: t.join()

TSAN Report:

==================
WARNING: ThreadSanitizer: data race (pid=28784)
  Write of size 4 at 0x00011c040140 by thread T5:
    #0 kqueue_queue_internal_close selectmodule.c:2165
    #1 select_kqueue_close selectmodule.c.h:1189
    #2 method_vectorcall_NOARGS descrobject.c:448
    #3 PyObject_Vectorcall call.c:327
    #4 _Py_VectorCallInstrumentation_StackRefSteal ceval.c:766
    #5 _PyEval_EvalFrameDefault generated_cases.c.h:1846
...

  Previous read of size 4 at 0x00011c040140 by thread T4:
    #0 kqueue_queue_get_closed selectmodule.c:2279
    #1 getset_get descrobject.c:194
    #2 _PyObject_GenericGetAttrWithDict object.c
    #3 PyObject_GenericGetAttr object.c:2012
    #4 _PyObject_GetAttrStackRef object.c
    #5 _PyEval_EvalFrameDefault generated_cases.c.h:8312

SUMMARY: ThreadSanitizer: data race selectmodule.c:2165 in kqueue_queue_internal_close
==================
CPython versions tested on:

CPython main branch

Operating systems tested on:

macOS

Linked PRs
  • gh-151376

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in Modules/selectmodule.c at kqueue_queue_internal_close around line 2165 and kqueue_queue_get_closed around line 2279, then review the reproducer and TSAN report. Check linked PR gh-151376 for work already underway; done means the concurrent close() and closed access no longer produce the reported race or descriptor hazard.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, python
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.