io.TextIOWrapper UAF triggered by readline()

Bug report

Bug description:

import io
class R(io.RawIOBase):
    def readable(self): return True
    def readinto(self,b):
        tw.detach(); b[:3]=b"ab\n"; return 3
tw=io.TextIOWrapper(io.BufferedReader(R()),encoding="utf-8")
tw.readline(); 

Exception ignored while finalizing file <_io.BufferedReader>:
Traceback (most recent call last):
  File "/repro/audit4/repro/textio_detach_uaf_readline.py", line 5, in readinto
    tw.detach(); b[:3]=b"ab\n"; return 3
    ~~~~~~~~~^^
RuntimeError: reentrant call inside <_io.BufferedReader>
=================================================================
==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x50f000038a20 at pc 0xaaaacdacc864 bp 0xffffd28429c0 sp 0xffffd28429b0
READ of size 8 at 0x50f000038a20 thread T0
    #0 0xaaaacdacc860 in _bufferedreader_raw_read Modules/_io/bufferedio.c:1667
    #1 0xaaaacdad17c0 in _io__Buffered_read1_impl Modules/_io/bufferedio.c:1080
    #2 0xaaaacdad17c0 in _io__Buffered_read1 Modules/_io/clinic/bufferedio.c.h:721
    #3 0xaaaacd059b50 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #4 0xaaaacd059b50 in PyObject_VectorcallMethod Objects/call.c:921
    #5 0xaaaacdadbd48 in PyObject_CallMethodOneArg Include/cpython/abstract.h:74
    #6 0xaaaacdadbd48 in buffer_callmethod_onearg Modules/_io/textio.c:792
    #7 0xaaaacdaf42f8 in textiowrapper_read_chunk Modules/_io/textio.c:1996
    #8 0xaaaacdaf8508 in _textiowrapper_readline Modules/_io/textio.c:2307
    #9 0xaaaacd056320 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #10 0xaaaacd056320 in PyObject_Vectorcall Objects/call.c:327
    #11 0xaaaacd6a1bc8 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:768
    #12 0xaaaaccdd1de8 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #13 0xaaaacd6c0b1c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #14 0xaaaacd6c0b1c in _PyEval_Vector Python/ceval.c:2174
    #15 0xaaaacd6c0b1c in PyEval_EvalCode Python/ceval.c:679
    #16 0xaaaacd8bfeb4 in run_mod Python/pythonrun.c:1509
    #17 0xaaaacd8c0d38 in _PyRun_File Python/pythonrun.c:1332
    #18 0xaaaacd8c4ffc in _PyRun_SimpleFile Python/pythonrun.c:544
    #19 0xaaaacd8c8dd0 in _PyRun_AnyFile Python/pythonrun.c:92
    #20 0xaaaacd99390c in pymain_run_file_obj Modules/main.c:478
    #21 0xaaaacd99390c in pymain_run_file Modules/main.c:494
    #22 0xaaaacd99390c in pymain_run_python Modules/main.c:804
    #23 0xaaaacd99390c in Py_RunMain Modules/main.c:891
    #24 0xaaaacd995c38 in pymain_main Modules/main.c:921
    #25 0xaaaacd995c38 in Py_BytesMain Modules/main.c:945
    #26 0xffff8b8f84c0  (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #27 0xffff8b8f8594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #28 0xaaaacce3beec in _start (/src/cpython/python+0x183beec) (BuildId: eba909a3db0adabacf151d7dc3081dda7999191a)

0x50f000038a20 is located 64 bytes inside of 168-byte region [0x50f0000389e0,0x50f000038a88)
freed by thread T0 here:
    #0 0xffff8c2961b4 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0xaaaacdabd8dc in buffered_dealloc Modules/_io/bufferedio.c:444
    #2 0xaaaacd247ab0 in _Py_Dealloc Objects/object.c:3334
    #3 0xaaaaccdffea0 in Py_DECREF_MORTAL Include/internal/pycore_object.h:449
    #4 0xaaaaccdffea0 in PyStackRef_XCLOSE Include/internal/pycore_stackref.h:726
    #5 0xaaaaccdffea0 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:11163
    #6 0xaaaacd6c1a00 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #7 0xaaaacd6c1a00 in _PyEval_Vector Python/ceval.c:2174
    #8 0xaaaacd059b50 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #9 0xaaaacd059b50 in PyObject_VectorcallMethod Objects/call.c:921
    #10 0xaaaacdacc2d8 in PyObject_CallMethodOneArg Include/cpython/abstract.h:74
    #11 0xaaaacdacc2d8 in _bufferedreader_raw_read Modules/_io/bufferedio.c:1640
    #12 0xaaaacdad17c0 in _io__Buffered_read1_impl Modules/_io/bufferedio.c:1080
    #13 0xaaaacdad17c0 in _io__Buffered_read1 Modules/_io/clinic/bufferedio.c.h:721
    #14 0xaaaacd059b50 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #15 0xaaaacd059b50 in PyObject_VectorcallMethod Objects/call.c:921
    #16 0xaaaacdadbd48 in PyObject_CallMethodOneArg Include/cpython/abstract.h:74
    #17 0xaaaacdadbd48 in buffer_callmethod_onearg Modules/_io/textio.c:792
    #18 0xaaaacdaf42f8 in textiowrapper_read_chunk Modules/_io/textio.c:1996
    #19 0xaaaacdaf8508 in _textiowrapper_readline Modules/_io/textio.c:2307
    #20 0xaaaacd056320 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #21 0xaaaacd056320 in PyObject_Vectorcall Objects/call.c:327
    #22 0xaaaacd6a1bc8 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:768
    #23 0xaaaaccdd1de8 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #24 0xaaaacd6c0b1c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #25 0xaaaacd6c0b1c in _PyEval_Vector Python/ceval.c:2174
    #26 0xaaaacd6c0b1c in PyEval_EvalCode Python/ceval.c:679
    #27 0xaaaacd8bfeb4 in run_mod Python/pythonrun.c:1509
    #28 0xaaaacd8c0d38 in _PyRun_File Python/pythonrun.c:1332
    #29 0xaaaacd8c4ffc in _PyRun_SimpleFile Python/pythonrun.c:544
    #30 0xaaaacd8c8dd0 in _PyRun_AnyFile Python/pythonrun.c:92
    #31 0xaaaacd99390c in pymain_run_file_obj Modules/main.c:478
    #32 0xaaaacd99390c in pymain_run_file Modules/main.c:494
    #33 0xaaaacd99390c in pymain_run_python Modules/main.c:804
    #34 0xaaaacd99390c in Py_RunMain Modules/main.c:891
    #35 0xaaaacd995c38 in pymain_main Modules/main.c:921
    #36 0xaaaacd995c38 in Py_BytesMain Modules/main.c:945
    #37 0xffff8b8f84c0  (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #38 0xffff8b8f8594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #39 0xaaaacce3beec in _start (/src/cpython/python+0x183beec) (BuildId: eba909a3db0adabacf151d7dc3081dda7999191a)

previously allocated by thread T0 here:
    #0 0xffff8c2976d0 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0xaaaacd36077c in _PyObject_MallocWithType Include/internal/pycore_object_alloc.h:46
    #2 0xaaaacd36077c in _PyType_AllocNoTrack Objects/typeobject.c:2498
    #3 0xaaaacd360e00 in PyType_GenericAlloc Objects/typeobject.c:2529
    #4 0xaaaacd366808 in type_call Objects/typeobject.c:2442
    #5 0xaaaacd054250 in _PyObject_MakeTpCall Objects/call.c:242
    #6 0xaaaacd6a1bc8 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:768
    #7 0xaaaaccdd1de8 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #8 0xaaaacd6c0b1c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #9 0xaaaacd6c0b1c in _PyEval_Vector Python/ceval.c:2174
    #10 0xaaaacd6c0b1c in PyEval_EvalCode Python/ceval.c:679
    #11 0xaaaacd8bfeb4 in run_mod Python/pythonrun.c:1509
    #12 0xaaaacd8c0d38 in _PyRun_File Python/pythonrun.c:1332
    #13 0xaaaacd8c4ffc in _PyRun_SimpleFile Python/pythonrun.c:544
    #14 0xaaaacd8c8dd0 in _PyRun_AnyFile Python/pythonrun.c:92
    #15 0xaaaacd99390c in pymain_run_file_obj Modules/main.c:478
    #16 0xaaaacd99390c in pymain_run_file Modules/main.c:494
    #17 0xaaaacd99390c in pymain_run_python Modules/main.c:804
    #18 0xaaaacd99390c in Py_RunMain Modules/main.c:891
    #19 0xaaaacd995c38 in pymain_main Modules/main.c:921
    #20 0xaaaacd995c38 in Py_BytesMain Modules/main.c:945
    #21 0xffff8b8f84c0  (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #22 0xffff8b8f8594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #23 0xaaaacce3beec in _start (/src/cpython/python+0x183beec) (BuildId: eba909a3db0adabacf151d7dc3081dda7999191a)

SUMMARY: AddressSanitizer: heap-use-after-free Modules/_io/bufferedio.c:1667 in _bufferedreader_raw_read
Shadow bytes around the buggy address:
  0x50f000038780: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
  0x50f000038800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x50f000038880: 00 00 00 00 00 fa fa fa fa fa fa fa fa fa 00 00
  0x50f000038900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x50f000038980: 00 00 00 fa fa fa fa fa fa fa fa fa fd fd fd fd
=>0x50f000038a00: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
  0x50f000038a80: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
  0x50f000038b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x50f000038b80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x50f000038c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x50f000038c80: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1==ABORTING

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-157370

Start with the reproducer in the issue and inspect Modules/_io/bufferedio.c at line 1667, along with the textio.c call sites shown in the trace. Run the example under AddressSanitizer and compare the behavior with linked PR gh-157370; done means the readline() path no longer reports a heap-use-after-free.