gh-144319: Fix huge page leak in datastack chunk allocator - #147963
Merged
pablogsal merged 1 commit intoApr 5, 2026
Merged
Conversation
Copy link
Copy Markdown
Member
Sorry, something went wrong.
pablogsal
requested review from
FFY00,
ZeroIntensity and
ericsnowcurrently
as code owners
April 1, 2026 11:50
maurycy
reviewed
Apr 1, 2026
Comment thread
Python/pystate.c
Outdated
maurycy
reviewed
Apr 1, 2026
Fidget-Spinner
approved these changes
Apr 3, 2026
Fidget-Spinner
left a comment
Copy link
Copy Markdown
Member
There was a problem hiding this comment.
Other than the stylistic stuff @maurycy pointed out, I think this looks fine.
Sorry, something went wrong.
The original fix rounded datastack chunk allocations in pystate.c so that _PyObject_VirtualFree() would receive the full huge page mapping size. Change direction and move that logic into _PyObject_VirtualAlloc() and _PyObject_VirtualFree() instead. The key invariant is that munmap() must see the full mapped size, so alloc and free now apply the same platform-specific rounding in the allocator layer. This keeps _PyStackChunk bookkeeping in requested-size units, avoids a hardcoded 2 MB assumption, and also covers other small virtual-memory users such as the JIT tracer state allocation in optimizer.c.
Copy link
Copy Markdown
Member
Author
|
I changed direction from the pystate.c-local roundup to an allocator-level fix. The important invariant here is that munmap() must always see the full mapped size, so I moved the rounding into _PyObject_VirtualAlloc() / _PyObject_VirtualFree() to keep alloc/free symmetric. That also covers the JIT tracer path instead of fixing only the datastack caller. |
Sorry, something went wrong.
Fidget-Spinner
approved these changes
Apr 5, 2026
ljfp
pushed a commit
to ljfp/cpython
that referenced
this pull request
Apr 25, 2026
…hon#147963) Fix huge page leak in datastack chunk allocator The original fix rounded datastack chunk allocations in pystate.c so that _PyObject_VirtualFree() would receive the full huge page mapping size. Change direction and move that logic into _PyObject_VirtualAlloc() and _PyObject_VirtualFree() instead. The key invariant is that munmap() must see the full mapped size, so alloc and free now apply the same platform-specific rounding in the allocator layer. This keeps _PyStackChunk bookkeeping in requested-size units, avoids a hardcoded 2 MB assumption, and also covers other small virtual-memory users such as the JIT tracer state allocation in optimizer.c.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The datastack chunk allocator (allocate_chunk in pystate.c) and other
small virtual-memory users such as the JIT tracer allocate through
_PyObject_VirtualAlloc() using the logical requested size. When huge pages
are enabled, the arena allocator may round those mappings up to the platform
huge page size, so freeing with the smaller requested size can make
munmap() fail with EINVAL and leak the mapping.
This change moves the rounding logic into _PyObject_VirtualAlloc() /
_PyObject_VirtualFree() so allocation and free always agree on the full
mapped size. Keeping it in the allocator layer also avoids a hardcoded 2 MB
assumption in pystate.c and fixes the JIT tracer allocation path at the
same time.