python / python/cpython

crossinterp.c: Use-after-free + leaked exception + shadowed variable

Open
#153,664 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

extension-modules topic-subinterpreters type-bug
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:

Original gist: https://gist.github.com/devdanzin/a56b8cb579b1950b4206e8a42d6be650

Summary

Three bugs in the cross-interpreter subsystem:

  1. _ensure_notshareableerror (crossinterp_exceptions.h:85): Missing return after _PyErr_SetRaisedException steals ctx ref. Falls through to code using freed pointer.
  2. _PyXI_UnwrapNotShareableError (crossinterp_data_lookup.h:102): Exception removed from thread state via _PyErr_GetRaisedException, then _PyXI_InitFailure fails → exception leaked, thread error indicator cleared.
  3. _pop_preserved (crossinterp.c:2968): Inner _PyXI_namespace *xidata shadows outer. goto error cleanup checks outer (NULL) variable → inner allocation leaked.

Reproducer (ref leak)

import _interpchannels as ch, sys

cid = ch.create()
before = sys.gettotalrefcount()
for i in range(10000):
    try:
        ch.send(cid, lambda: None, blocking=False)
    except Exception:
        pass
after = sys.gettotalrefcount()
ch.destroy(cid)
print(f"Leaked {after - before} refs (~{(after-before)//10000}/send)")

The third issue is already fixed by https://github.com/python/cpython/pull/147999

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs
  • gh-153665

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with crossinterp_exceptions.h:85, crossinterp_data_lookup.h:102, and crossinterp.c:2968, then run the supplied _interpchannels reference-count reproducer on CPython main. Check the existing PRs, since the shadowed-variable issue is already reported as fixed; done means the two remaining exception and reference-management bugs are corrected without leaks or use-after-free behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, python
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.