Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-04-26 22:01:08 +00:00
Code Issues Projects Releases Packages Wiki Activity

gh-148820: Fix _PyRawMutex use-after-free on spurious semaphore wakeup (gh-148852)

Browse source 
_PyRawMutex_UnlockSlow CAS-removes the waiter from the list and then
calls _PySemaphore_Wakeup, with no handshake. If _PySemaphore_Wait
returns Py_PARK_INTR, the waiter can destroy its stack-allocated
semaphore before the unlocker's Wakeup runs, causing a fatal error from
ReleaseSemaphore / sem_post.

Loop in _PyRawMutex_LockSlow until _PySemaphore_Wait returns Py_PARK_OK,
which is only signalled when a matching Wakeup has been observed.

Also include GetLastError() and the handle in the Windows fatal messages
in _PySemaphore_Init, _PySemaphore_Wait, and _PySemaphore_Wakeup to make
similar races easier to diagnose in the future.
This commit is contained in:
Sam Gross 2026-04-22 14:31:19 -04:00 • committed by GitHub
parent 59b41c8c3b
commit ad3c5b7958
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 23 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
Python/lock.c
View file

@ -248,7 +248,16 @@ _PyRawMutex_LockSlow(_PyRawMutex *m)
// Wait for us to be woken up. Note that we still have to lock the
// mutex ourselves: it is NOT handed off to us.
_PySemaphore_Wait(&waiter.sema, -1);
//
// Loop until we observe an actual wakeup. A return of Py_PARK_INTR
// could otherwise let us exit _PySemaphore_Wait and destroy
// `waiter.sema` while _PyRawMutex_UnlockSlow's matching
// _PySemaphore_Wakeup is still pending, since the unlocker has
// already CAS-removed us from the waiter list without any handshake.
int res;
do {
res = _PySemaphore_Wait(&waiter.sema, -1);
} while (res != Py_PARK_OK);
}
_PySemaphore_Destroy(&waiter.sema);

12
Python/parking_lot.c
View file

@ -61,7 +61,9 @@ _PySemaphore_Init(_PySemaphore *sema)
NULL // unnamed
);
if (!sema->platform_sem) {
Py_FatalError("parking_lot: CreateSemaphore failed");
_Py_FatalErrorFormat(__func__,
"parking_lot: CreateSemaphore failed (error: %u)",
GetLastError());
}
#elif defined(_Py_USE_SEMAPHORES)
if (sem_init(&sema->platform_sem, /*pshared=*/0, /*value=*/0) < 0) {
@ -141,8 +143,8 @@ _PySemaphore_Wait(_PySemaphore *sema, PyTime_t timeout)
}
else {
_Py_FatalErrorFormat(__func__,
"unexpected error from semaphore: %u (error: %u)",
wait, GetLastError());
"unexpected error from semaphore: %u (error: %u, handle: %p)",
wait, GetLastError(), sema->platform_sem);
}
#elif defined(_Py_USE_SEMAPHORES)
int err;
@ -230,7 +232,9 @@ _PySemaphore_Wakeup(_PySemaphore *sema)
{
#if defined(MS_WINDOWS)
if (!ReleaseSemaphore(sema->platform_sem, 1, NULL)) {
Py_FatalError("parking_lot: ReleaseSemaphore failed");
_Py_FatalErrorFormat(__func__,
"parking_lot: ReleaseSemaphore failed (error: %u, handle: %p)",
GetLastError(), sema->platform_sem);
}
#elif defined(_Py_USE_SEMAPHORES)
int err = sem_post(&sema->platform_sem);