[Python-checkins] gh-92036: Fix gc_fini_untrack() (#92037)

vstinner webhook-mailer at python.org
Wed May 4 05:59:11 EDT 2022


https://github.com/python/cpython/commit/14243369b5f80613628a565c224bba7fb3fcacd8
commit: 14243369b5f80613628a565c224bba7fb3fcacd8
branch: main
author: Victor Stinner <vstinner at python.org>
committer: vstinner <vstinner at python.org>
date: 2022-05-04T11:59:01+02:00
summary:

gh-92036: Fix gc_fini_untrack() (#92037)

Fix a crash in subinterpreters related to the garbage collector. When
a subinterpreter is deleted, untrack all objects tracked by its GC.
To prevent a crash in deallocator functions expecting objects to be
tracked by the GC, leak a strong reference to these objects on
purpose, so they are never deleted and their deallocator functions
are not called.

files:
A Misc/NEWS.d/next/Core and Builtins/2022-04-28-23-37-30.gh-issue-92036.GZJAC9.rst
M Modules/gcmodule.c

diff --git a/Misc/NEWS.d/next/Core and Builtins/2022-04-28-23-37-30.gh-issue-92036.GZJAC9.rst b/Misc/NEWS.d/next/Core and Builtins/2022-04-28-23-37-30.gh-issue-92036.GZJAC9.rst
new file mode 100644
index 0000000000000..78094c5e4fea7
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2022-04-28-23-37-30.gh-issue-92036.GZJAC9.rst	
@@ -0,0 +1,5 @@
+Fix a crash in subinterpreters related to the garbage collector. When a
+subinterpreter is deleted, untrack all objects tracked by its GC. To prevent a
+crash in deallocator functions expecting objects to be tracked by the GC, leak
+a strong reference to these objects on purpose, so they are never deleted and
+their deallocator functions are not called. Patch by Victor Stinner.
diff --git a/Modules/gcmodule.c b/Modules/gcmodule.c
index 802c3eadccfb0..45dad8f0824df 100644
--- a/Modules/gcmodule.c
+++ b/Modules/gcmodule.c
@@ -2165,6 +2165,12 @@ gc_fini_untrack(PyGC_Head *list)
     for (gc = GC_NEXT(list); gc != list; gc = GC_NEXT(list)) {
         PyObject *op = FROM_GC(gc);
         _PyObject_GC_UNTRACK(op);
+        // gh-92036: If a deallocator function expect the object to be tracked
+        // by the GC (ex: func_dealloc()), it can crash if called on an object
+        // which is no longer tracked by the GC. Leak one strong reference on
+        // purpose so the object is never deleted and its deallocator is not
+        // called.
+        Py_INCREF(op);
     }
 }
 



More information about the Python-checkins mailing list