FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-148820: Fix _PyRawMutex use-after-free on spurious semaphore wakeup by colesbury · Pull Request #148852 · python/cpython · GitHub

/ cpython Public
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension .c  (2) .rst  (1) All 2 file types selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
Fix a race in :c:type:`!_PyRawMutex` on the free-threaded build where a
``Py_PARK_INTR`` return from ``_PySemaphore_Wait`` could let the waiter
destroy its semaphore before the unlocking thread's
``_PySemaphore_Wakeup`` completed, causing a fatal ``ReleaseSemaphore``
error.
11 changes: 10 additions & 1 deletion Python/lock.c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
Expand Up @@ -248,7 +248,16 @@ _PyRawMutex_LockSlow(_PyRawMutex *m)

// Wait for us to be woken up. Note that we still have to lock the
// mutex ourselves: it is NOT handed off to us.
_PySemaphore_Wait(&waiter.sema, -1);
//
// Loop until we observe an actual wakeup. A return of Py_PARK_INTR
// could otherwise let us exit _PySemaphore_Wait and destroy
// `waiter.sema` while _PyRawMutex_UnlockSlow's matching
// _PySemaphore_Wakeup is still pending, since the unlocker has
// already CAS-removed us from the waiter list without any handshake.
int res;
do {
res = _PySemaphore_Wait(&waiter.sema, -1);
} while (res != Py_PARK_OK);
}

_PySemaphore_Destroy(&waiter.sema);
Expand Down
12 changes: 8 additions & 4 deletions Python/parking_lot.c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,9 @@ _PySemaphore_Init(_PySemaphore *sema)
NULL // unnamed
);
if (!sema->platform_sem) {
Py_FatalError("parking_lot: CreateSemaphore failed");
_Py_FatalErrorFormat(__func__,
"parking_lot: CreateSemaphore failed (error: %u)",
GetLastError());
}
#elif defined(_Py_USE_SEMAPHORES)
if (sem_init(&sema->platform_sem, /*pshared=*/0, /*value=*/0) < 0) {
Expand Down Expand Up @@ -141,8 +143,8 @@ _PySemaphore_Wait(_PySemaphore *sema, PyTime_t timeout)
}
else {
_Py_FatalErrorFormat(__func__,
"unexpected error from semaphore: %u (error: %u)",
wait, GetLastError());
"unexpected error from semaphore: %u (error: %u, handle: %p)",
wait, GetLastError(), sema->platform_sem);
}
#elif defined(_Py_USE_SEMAPHORES)
int err;
Expand Down Expand Up @@ -230,7 +232,9 @@ _PySemaphore_Wakeup(_PySemaphore *sema)
{
#if defined(MS_WINDOWS)
if (!ReleaseSemaphore(sema->platform_sem, 1, NULL)) {
Py_FatalError("parking_lot: ReleaseSemaphore failed");
_Py_FatalErrorFormat(__func__,
"parking_lot: ReleaseSemaphore failed (error: %u, handle: %p)",
GetLastError(), sema->platform_sem);
}
#elif defined(_Py_USE_SEMAPHORES)
int err = sem_post(&sema->platform_sem);
Expand Down
Loading

Back | FazBrowse Home | New Git URL