Repository navigation
gh-142349: Fix refcount corruption in lazy import specialization - #144733
Merged
Yhg1s merged 1 commit intoFeb 12, 2026
Merged
Yhg1s merged 1 commit into
Yhg1s merged 1 commit into
Conversation
Copy link
Copy Markdown
Member
Sorry, something went wrong.
pablogsal
requested review from
kumaraditya303,
ncoghlan and
warsaw
as code owners
February 12, 2026 08:26
pablogsal
force-pushed
the
lazy-cleanup-2
branch
from
3007570 to
239c717
Compare
February 12, 2026 08:26
pablogsal
commented
Feb 12, 2026
Comment thread
Python/import.c
Yhg1s
reviewed
Feb 12, 2026
Yhg1s
left a comment
Copy link
Copy Markdown
Member
There was a problem hiding this comment.
I don't think this is good enough for a free-threaded build. The error case happens when _PyImport_LoadLazyImportTstate is called with a borrowed reference. The GIL won't be protecting that borrowed reference in a free-threaded build, so the INCREF already happens too late. We need the caller to acquire an owned reference instead, in a safe way. But... where does this happen? As far as I can tell the callers all own the reference they pass.
Sorry, something went wrong.
Comment thread
Include/internal/pycore_lazyimportobject.h
Outdated
Comment thread
Python/import.c
Outdated
Comment thread
Python/import.c
Outdated
pablogsal
marked this pull request as draft
February 12, 2026 10:49
Copy link
Copy Markdown
Member
Author
If that were true then there would not be crashes no? |
Sorry, something went wrong.
Copy link
Copy Markdown
Member
Unless the problem is actually something different, yes :) I would like to know which it is. |
Sorry, something went wrong.
pablogsal
force-pushed
the
lazy-cleanup-2
branch
from
ca6f0f9 to
2fe3763
Compare
February 12, 2026 11:13
_PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
pablogsal
force-pushed
the
lazy-cleanup-2
branch
from
2fe3763 to
c7defe2
Compare
February 12, 2026 11:17
pablogsal
marked this pull request as ready for review
February 12, 2026 11:21
Copy link
Copy Markdown
Member
Author
Narrator: and the problem was indeed something different. Kind of |
Sorry, something went wrong.
Yhg1s
approved these changes
Feb 12, 2026
Yhg1s
enabled auto-merge (squash)
February 12, 2026 11:22
kumaraditya303
approved these changes
Feb 12, 2026
thunder-coding
pushed a commit
to thunder-coding/cpython
that referenced
this pull request
Feb 15, 2026
python#144733) Remove spurious Py_DECREF on borrowed ref in LOAD_GLOBAL specialization _PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
pablogsal
added a commit
to pablogsal/cpython
that referenced
this pull request
Feb 15, 2026
Add a regression test ensuring that circular lazy imports raise a proper error (ImportCycleError) instead of crashing with a segfault. The crash was fixed in pythongh-144733 but no test was added at the time.
pablogsal
added a commit
to pablogsal/cpython
that referenced
this pull request
Feb 15, 2026
Add a regression test ensuring that circular lazy imports raise a proper error (ImportCycleError) instead of crashing with a segfault. The crash was fixed in pythongh-144733 but no test was added at the time.
pablogsal
added a commit
that referenced
this pull request
Feb 15, 2026
brijkapadia
pushed a commit
to brijkapadia/cpython
that referenced
this pull request
Feb 28, 2026
python#144733) Remove spurious Py_DECREF on borrowed ref in LOAD_GLOBAL specialization _PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
brijkapadia
pushed a commit
to brijkapadia/cpython
that referenced
this pull request
Feb 28, 2026
…) (python#144838) Add a regression test ensuring that circular lazy imports raise a proper error (ImportCycleError) instead of crashing with a segfault. The crash was fixed in pythongh-144733 but no test was added at the time.
ljfp
pushed a commit
to ljfp/cpython
that referenced
this pull request
Apr 25, 2026
python#144733) Remove spurious Py_DECREF on borrowed ref in LOAD_GLOBAL specialization _PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
ljfp
pushed a commit
to ljfp/cpython
that referenced
this pull request
Apr 25, 2026
…) (python#144838) Add a regression test ensuring that circular lazy imports raise a proper error (ImportCycleError) instead of crashing with a segfault. The crash was fixed in pythongh-144733 but no test was added at the time.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
_PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.