gh-127879: Fix data race in _PyFreeList_Push (#127880)

colesbury · web-flow · commit f8dcb8200626 · 2024-12-12T12:59:13.000-05:00
Writes to the `ob_tid` field need to use atomics because it may be
concurrently read by a non-locking dictionary, list, or structmember
read.
diff --git a/Include/internal/pycore_freelist.h b/Include/internal/pycore_freelist.h
@@ -51,7 +51,7 @@ static inline int
 _PyFreeList_Push(struct _Py_freelist *fl, void *obj, Py_ssize_t maxsize)
 {
     if (fl->size < maxsize && fl->size >= 0) {
-        *(void **)obj = fl->freelist;
+        FT_ATOMIC_STORE_PTR_RELAXED(*(void **)obj, fl->freelist);
         fl->freelist = obj;
         fl->size++;
         OBJECT_STAT_INC(to_freelist);

Original file line number	Diff line number	Diff line change
`@@ -51,7 +51,7 @@ static inline int`
`51`	`51`	`_PyFreeList_Push(struct _Py_freelist fl, void obj, Py_ssize_t maxsize)`
`52`	`52`	`{`
`53`	`53`	`if (fl->size < maxsize && fl->size >= 0) {`
`54`		`- (void *)obj = fl->freelist;`
	`54`	`+ FT_ATOMIC_STORE_PTR_RELAXED((void *)obj, fl->freelist);`
`55`	`55`	`fl->freelist = obj;`
`56`	`56`	`fl->size++;`
`57`	`57`	`OBJECT_STAT_INC(to_freelist);`