Data race on `kqueue.kqfd` between `close()` and the `closed` getter with free-threading build
未关闭
还没有人认领这个 Issue。
topic-free-threading
type-bug
- 主要语言
- Python
- 星标
- 77.2k
- 派生
- 36k
- PR 合并指标
- PR 指标待抓取
描述
Bug report
Bug description:
select.kqueue accesses its internal kqfd file-descriptor field with no synchronization. So kqueue.close() can write the kqfd,
while the closed getter reads it.
Reproducer:
import select
from threading import Thread
slot = [select.kqueue()]
def reader():
for _ in range(200000):
try:
_ = slot[0].closed
except Exception:
pass
def churner():
for _ in range(200000):
kq = select.kqueue()
slot[0] = kq
kq.close()
threads = [Thread(target=reader) for _ in range(4)]
threads += [Thread(target=churner) for _ in range(4)]
for t in threads: t.start()
for t in threads: t.join()
TSAN Report:
==================
WARNING: ThreadSanitizer: data race (pid=28784)
Write of size 4 at 0x00011c040140 by thread T5:
#0 kqueue_queue_internal_close selectmodule.c:2165
#1 select_kqueue_close selectmodule.c.h:1189
#2 method_vectorcall_NOARGS descrobject.c:448
#3 PyObject_Vectorcall call.c:327
#4 _Py_VectorCallInstrumentation_StackRefSteal ceval.c:766
#5 _PyEval_EvalFrameDefault generated_cases.c.h:1846
...
Previous read of size 4 at 0x00011c040140 by thread T4:
#0 kqueue_queue_get_closed selectmodule.c:2279
#1 getset_get descrobject.c:194
#2 _PyObject_GenericGetAttrWithDict object.c
#3 PyObject_GenericGetAttr object.c:2012
#4 _PyObject_GetAttrStackRef object.c
#5 _PyEval_EvalFrameDefault generated_cases.c.h:8312
SUMMARY: ThreadSanitizer: data race selectmodule.c:2165 in kqueue_queue_internal_close
==================
CPython versions tested on:
CPython main branch
Operating systems tested on:
macOS
Linked PRs
- gh-151376
贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
调研方向
从 Modules/selectmodule.c 中约第 2165 行的 kqueue_queue_internal_close 和约第 2279 行的 kqueue_queue_get_closed 开始,然后检查 reproducer 和 TSAN 报告。查看链接的 PR gh-151376,了解已经在进行的工作;当并发 close() 和对 closed 的访问不再产生报告中的 race 或 descriptor hazard 时,即视为完成。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- c, python
- 领域
- operating-systems
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 停滞
- 描述清晰度
- 描述清楚
- 新手友好度
- 20/100