Hi, bugs.python.org is down so I'm reporting the bug here :-)
We have a crash in our product when tracing is enabled by sys.settrace() and threading.settrace(). If a Python generator is created in a C thread, calling the generator later in another thread may crash if Python tracing is enabled. - the C thread calls PyGILState_Ensure() which creates a temporary Python thread state - a generator is created, the generator has a reference to a Python frame which keeps a reference to the temporary Python thread state - the C thread calls PyGILState_Releases() which destroys the temporary Python thread state - when the generator is called later in another thread, call_trace() reads the Python thread state from the generator frame, which is the destroyed frame => it does crash on a pointer dereference if the memory was reallocated (by malloc()) and the data were erased To reproduce the crash, unpack the attached generator_frame_bug.tar.gz, compile the C module using "python setup.py build" and then run "PYTHONPATH=$(ls -d build/lib*/) python test.py" (or just "python test.py if you installed the _test module). You may need to use Valgrind to see the error, or call memset(tstate, 0xFF, sizeof(*tstate)) before free(tstate) in tstate_delete_common(). Calling the generator should update its reference to the Python state thread in its frame. The generator may also clears frame->f_tstate (to detect bugs earlier), as it does for frame->f_back (to avoid a reference cycle). Attached patch implements this fix for Python 3.3. Victor
generator_frame_bug.tar.gz
Description: GNU Zip compressed data
diff -r 51016ff7f8c9 Objects/genobject.c
--- a/Objects/genobject.c Sun Mar 25 22:41:16 2012 -0400
+++ b/Objects/genobject.c Wed Mar 28 12:44:07 2012 +0200
@@ -76,6 +76,7 @@ gen_send_ex(PyGenObject *gen, PyObject *
/* Generators always return to their most recent caller, not
* necessarily their creator. */
+ f->f_tstate = tstate;
Py_XINCREF(tstate->frame);
assert(f->f_back == NULL);
f->f_back = tstate->frame;
@@ -89,6 +90,8 @@ gen_send_ex(PyGenObject *gen, PyObject *
* cycle. */
assert(f->f_back == tstate->frame);
Py_CLEAR(f->f_back);
+ /* Clear the borrowed reference to the thread state */
+ f->f_tstate = NULL;
/* If the generator just returned (as opposed to yielding), signal
* that the generator is exhausted. */
_______________________________________________ Python-Dev mailing list Python-Dev@python.org http://mail.python.org/mailman/listinfo/python-dev Unsubscribe: http://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
