From cca30230d992c46dfb607dcc24b3dc2e6d05f536 Mon Sep 17 00:00:00 2001 From: Sam Gross Date: Fri, 8 Mar 2024 12:39:53 -0500 Subject: [PATCH] gh-115103: Fix unregistering of QSBR state (#116480) If a thread blocks while waiting on the `shared->mutex` lock, the array of QSBR states may be reallocated. The `tstate->qsbr` values before the lock is acquired may not be the same as the value after the lock is acquired. --- Python/qsbr.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/Python/qsbr.c b/Python/qsbr.c index 69f77f49082..d7ac8f479cd 100644 --- a/Python/qsbr.c +++ b/Python/qsbr.c @@ -233,13 +233,17 @@ _Py_qsbr_register(_PyThreadStateImpl *tstate, PyInterpreterState *interp, void _Py_qsbr_unregister(_PyThreadStateImpl *tstate) { - struct _qsbr_thread_state *qsbr = tstate->qsbr; - struct _qsbr_shared *shared = qsbr->shared; - - assert(qsbr->seq == 0 && "thread state must be detached"); + struct _qsbr_shared *shared = tstate->qsbr->shared; PyMutex_Lock(&shared->mutex); + // NOTE: we must load (or reload) the thread state's qbsr inside the mutex + // because the array may have been resized (changing tstate->qsbr) while + // we waited to acquire the mutex. + struct _qsbr_thread_state *qsbr = tstate->qsbr; + + assert(qsbr->seq == 0 && "thread state must be detached"); assert(qsbr->allocated && qsbr->tstate == (PyThreadState *)tstate); + tstate->qsbr = NULL; qsbr->tstate = NULL; qsbr->allocated = false;