Skip to content

PyUnstable_Code_SetExtra and PyUnstable_Code_GetExtra are not thread-safe in free-threaded builds #144981

@yoney

Description

@yoney

Bug report

Bug description:

PyUnstable_Code_SetExtra and PyUnstable_Code_GetExtra in Objects/codeobject.c have no free-threaded protections. The co_extra field is read and written with plain loads and stores, and SetExtra calls PyMem_Realloc which can free the old buffer while a concurrent GetExtra is reading from it.

Similarly, PyUnstable_Eval_RequestCodeExtraIndex in Python/ceval.c increments co_extra_user_count and writes to co_extra_freefuncs without any synchronization.

The new tests (#144980) exercise the concurrent paths and a free-threaded TSAN build without the fix crashes/emits warnings.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.14bugs and security fixes3.15new features, bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)topic-free-threadingtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions