[issue29347] Python 2.7.8 is crashing while creating weakref for a given object.
New submission from Saida Dhanavath: We are using python 2.7.8 on Ubuntu 14.04 to host our services. In one of the crashes python interpreter got segmentation fault while initializing weakref for a given object. Please find snip of backtraces as given below. #0 0x7f62aa86951a in clear_weakref (self=0x7f5a1ed17520) at Objects/weakrefobject.c:65 #1 proxy_dealloc (self=0x7f5a1ed17520) at Objects/weakrefobject.c:540 #2 0x7f62aa869b8b in PyWeakref_NewProxy (ob=, callback=) at Objects/weakrefobject.c:855 #3 0x7f62aa901e56 in weakref_proxy (self=, args=) at ./Modules/_weakref.c:73 #4 0x7f62aa8a929b in call_function (oparg=, pp_stack=0x7f5d36661c90) at Python/ceval.c:4033 . . . Have tried to root cause the issue and found that PyWeakref_NewProxy@Objects/weakrefobject.c creates new isntance of PyWeakReference struct and does not intialize wr_prev and wr_next of new isntance. These pointers can have garbage and point to random memory locations. As per comment in the code there could be a race while creating new instance and some other thread could have created weakref by the time current thread returns from new_weakref function. If it finds weakref created, current thread destroys instance created by itself and uses the one created by some other thread. Python should not crash while destroying the isntance created in the same interpreter function. As per my understanding, both wr_prev and wr_next of PyWeakReference instance should be initialized to NULL to avoid segfault. -- components: Interpreter Core messages: 286044 nosy: dhanavaths priority: normal severity: normal status: open title: Python 2.7.8 is crashing while creating weakref for a given object. versions: Python 2.7 ___ Python tracker <http://bugs.python.org/issue29347> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue29347] Python 2.7.8 is crashing while creating weakref for a given object.
Changes by Saida Dhanavath : -- type: -> crash ___ Python tracker <http://bugs.python.org/issue29347> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue29347] Python 2.7.8 is crashing while creating weakref for a given object.
Saida Dhanavath added the comment: Hi Christian Heimes, PFA. I have written a some code to simulate and test PyWeakReference struct instantion and then hit segfault based on flag passed-in to C code. Here I am trying to execute some of the operations from new_weakref and dealloc_weakref of Objects/weakrefobject.c to show that new isntance of PyWeakReference is not initialized properly. Have also checked latest 3.6 source and there is no difference in alloc and dealloc routines of 2.7.8 and 3.6.0. Have run test code on 2.7.8, 2.7.12+, 3.4m and 3.5m interpreters and got segfault in all runs. -- Added file: http://bugs.python.org/file46396/crash_in_weakref.zip ___ Python tracker <http://bugs.python.org/issue29347> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue29347] Python 2.7.8 is crashing while creating weakref for a given object.
Saida Dhanavath added the comment: Hi Christian Heimes, Please ignore typos in the previous post. I have written some code to simulate and test PyWeakReference struct instantiation and then hit segfault based on the flag passed to C code. Here I am trying to execute some of the operations from new_weakref and dealloc_weakref of Objects/weakrefobject.c to show that new instance of PyWeakReference is not initialized properly and results in segfault. Have also checked python 3.6.0 source and I do not see any change in weakref alloc and dealloc routines of 2.7.8 and 3.6.0 versions. Have run test code on 2.7.8, 2.7.12+, 3.4m and 3.5m interpreters and got segfault in all runs. Please find the sample output as given below. ubuntu@ubuntu1610saida:~/weakref$ make build PYVERSION=2.7 swig -python weakref_crash.i gcc -w -fpic -c weakref_crash.c weakref_crash_wrap.c -I/usr/include/python2.7 gcc -shared weakref_crash.o weakref_crash_wrap.o -o _pyweakref_crash.so -L/usr/lib/python2.7 -lpython2.7 ubuntu@ubuntu1610saida:~/weakref$ python test.py 0 0 2.7.12+ (default, Sep 17 2016, 12:08:02) [GCC 6.2.0 20160914] 0 0 ubuntu@ubuntu1610saida:~/weakref$ python test.py 0 1 2.7.12+ (default, Sep 17 2016, 12:08:02) [GCC 6.2.0 20160914] 0 0 ubuntu@ubuntu1610saida:~/weakref$ python test.py 1 0 2.7.12+ (default, Sep 17 2016, 12:08:02) [GCC 6.2.0 20160914] 1010101 1010101 ubuntu@ubuntu1610saida:~/weakref$ python test.py 1 1 2.7.12+ (default, Sep 17 2016, 12:08:02) [GCC 6.2.0 20160914] 1010101 1010101 Segmentation fault (core dumped) ubuntu@ubuntu1610saida:~/weakref$ make clean rm -f *.so *.o *crash.py *.pyc *crash_wrap.c ubuntu@ubuntu1610saida:~/weakref$ make build PYVERSION=3.5m swig -python weakref_crash.i gcc -w -fpic -c weakref_crash.c weakref_crash_wrap.c -I/usr/include/python3.5m gcc -shared weakref_crash.o weakref_crash_wrap.o -o _pyweakref_crash.so -L/usr/lib/python3.5m -lpython3.5m ubuntu@ubuntu1610saida:~/weakref$ python3.5m test.py 0 0 3.5.2+ (default, Sep 22 2016, 12:18:14) [GCC 6.2.0 20160927] 0 0 ubuntu@ubuntu1610saida:~/weakref$ python3.5m test.py 0 1 3.5.2+ (default, Sep 22 2016, 12:18:14) [GCC 6.2.0 20160927] 0 0 ubuntu@ubuntu1610saida:~/weakref$ python3.5m test.py 1 0 3.5.2+ (default, Sep 22 2016, 12:18:14) [GCC 6.2.0 20160927] 1010101 101 ubuntu@ubuntu1610saida:~/weakref$ python3.5m test.py 1 1 3.5.2+ (default, Sep 22 2016, 12:18:14) [GCC 6.2.0 20160927] 1010101 101 Segmentation fault (core dumped) -- ___ Python tracker <http://bugs.python.org/issue29347> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue29347] Python 2.7.8 is crashing while creating weakref for a given object.
Changes by Saida Dhanavath : -- versions: +Python 3.3, Python 3.4, Python 3.5, Python 3.6, Python 3.7 ___ Python tracker <http://bugs.python.org/issue29347> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue29347] Python could crash while creating weakref for a given object
Saida Dhanavath added the comment: Hi xiang, I have already patched our build environment with the fix and tested it locally. Although I cannot test it in production, have taken out the code of new_weakref, init_weakref and clear_weakref from weakrefobject.c. Changed init_weakref to initialize wr_prev and wr_next with NULL and verified that test program does crash after fix. -- ___ Python tracker <http://bugs.python.org/issue29347> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue29347] Python could crash while creating weakref for a given object
Saida Dhanavath added the comment: Please find the test program attached. Readme.txt has steps to comiple and run program. -- Added file: http://bugs.python.org/file46515/verify_crash_in_weakref.zip ___ Python tracker <http://bugs.python.org/issue29347> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue29347] Python could crash while creating weakref for a given object
Saida Dhanavath added the comment: Xiang, Sure, I will run it with other python versions and post the results. -- ___ Python tracker <http://bugs.python.org/issue29347> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue29347] Python could crash while creating weakref for a given object
Saida Dhanavath added the comment: Hi Xiang, Sorry for the delay. I have not checked my inbox since last week. The proposed fix works for me. -- ___ Python tracker <http://bugs.python.org/issue29347> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
