Skip to content

GH-96572: fix use after free in trace refs build mode #96618

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 6, 2022

Conversation

kumaraditya303
Copy link
Contributor

@kumaraditya303 kumaraditya303 commented Sep 6, 2022

--with-trace-refs requires objects to be explicitly removed from the global list before deallocation but ceval overrides the Py_DECREF for speed and thus skipped this, hence we avoid this optimization in --with-trace-refs build mode.

This optimization was introduced in 2f233fc by @gvanrossum.

Automerge-Triggered-By: GH:gvanrossum

@kumaraditya303 kumaraditya303 added release-blocker type-crash A hard crash of the interpreter, possibly with a core dump needs backport to 3.11 only security fixes labels Sep 6, 2022
@pablogsal pablogsal added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Sep 6, 2022
@bedevere-bot
Copy link

🤖 New build scheduled with the buildbot fleet by @pablogsal for commit d622e46 🤖

If you want to schedule another build, you need to add the ":hammer: test-with-buildbots" label again.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Sep 6, 2022
Copy link
Member

@gvanrossum gvanrossum left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Amazing. Needs a backport to unblock the release, right?

@miss-islington
Copy link
Contributor

Thanks @kumaraditya303 for the PR, and @gvanrossum for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@bedevere-bot
Copy link

GH-96621 is a backport of this pull request to the 3.11 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 6, 2022
miss-islington added a commit that referenced this pull request Sep 6, 2022
(cherry picked from commit 6744490)

Co-authored-by: Kumar Aditya <[email protected]>
@bedevere-bot
Copy link

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot s390x RHEL7 LTO 3.x has failed when building commit 6744490.

What do you need to do:

  1. Don't panic.
  2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
  3. Go to the page of the buildbot that failed (https://buildbot.python.org/all/#builders/402/builds/2991) and take a look at the build logs.
  4. Check if the failure is related to this commit (6744490) or if it is a false positive.
  5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/all/#builders/402/builds/2991

Summary of the results of the build (if available):

== Tests result: ENV CHANGED ==

414 tests OK.

10 slowest tests:

  • test_tools: 3 min
  • test_concurrent_futures: 2 min 50 sec
  • test_multiprocessing_spawn: 2 min 12 sec
  • test_multiprocessing_forkserver: 1 min 42 sec
  • test_tokenize: 1 min 18 sec
  • test_unparse: 1 min 18 sec
  • test_multiprocessing_fork: 1 min 11 sec
  • test_asyncio: 1 min 8 sec
  • test_io: 59.0 sec
  • test_venv: 53.0 sec

1 test altered the execution environment:
test_asyncio

21 tests skipped:
test_devpoll test_gdb test_idle test_ioctl test_kqueue
test_launcher test_msilib test_perf_profiler test_smtpnet test_ssl
test_startfile test_tcl test_tix test_tkinter test_ttk
test_ttk_textonly test_turtle test_winconsoleio test_winreg
test_winsound test_zipfile64

Total duration: 6 min 11 sec

Click to see traceback logs
remote: Enumerating objects: 195, done.�[K
remote: Counting objects:   0% (1/139)�[K
remote: Counting objects:   1% (2/139)�[K
remote: Counting objects:   2% (3/139)�[K
remote: Counting objects:   3% (5/139)�[K
remote: Counting objects:   4% (6/139)�[K
remote: Counting objects:   5% (7/139)�[K
remote: Counting objects:   6% (9/139)�[K
remote: Counting objects:   7% (10/139)�[K
remote: Counting objects:   8% (12/139)�[K
remote: Counting objects:   9% (13/139)�[K
remote: Counting objects:  10% (14/139)�[K
remote: Counting objects:  11% (16/139)�[K
remote: Counting objects:  12% (17/139)�[K
remote: Counting objects:  13% (19/139)�[K
remote: Counting objects:  14% (20/139)�[K
remote: Counting objects:  15% (21/139)�[K
remote: Counting objects:  16% (23/139)�[K
remote: Counting objects:  17% (24/139)�[K
remote: Counting objects:  18% (26/139)�[K
remote: Counting objects:  19% (27/139)�[K
remote: Counting objects:  20% (28/139)�[K
remote: Counting objects:  21% (30/139)�[K
remote: Counting objects:  22% (31/139)�[K
remote: Counting objects:  23% (32/139)�[K
remote: Counting objects:  24% (34/139)�[K
remote: Counting objects:  25% (35/139)�[K
remote: Counting objects:  26% (37/139)�[K
remote: Counting objects:  27% (38/139)�[K
remote: Counting objects:  28% (39/139)�[K
remote: Counting objects:  29% (41/139)�[K
remote: Counting objects:  30% (42/139)�[K
remote: Counting objects:  31% (44/139)�[K
remote: Counting objects:  32% (45/139)�[K
remote: Counting objects:  33% (46/139)�[K
remote: Counting objects:  34% (48/139)�[K
remote: Counting objects:  35% (49/139)�[K
remote: Counting objects:  36% (51/139)�[K
remote: Counting objects:  37% (52/139)�[K
remote: Counting objects:  38% (53/139)�[K
remote: Counting objects:  39% (55/139)�[K
remote: Counting objects:  40% (56/139)�[K
remote: Counting objects:  41% (57/139)�[K
remote: Counting objects:  42% (59/139)�[K
remote: Counting objects:  43% (60/139)�[K
remote: Counting objects:  44% (62/139)�[K
remote: Counting objects:  45% (63/139)�[K
remote: Counting objects:  46% (64/139)�[K
remote: Counting objects:  47% (66/139)�[K
remote: Counting objects:  48% (67/139)�[K
remote: Counting objects:  49% (69/139)�[K
remote: Counting objects:  50% (70/139)�[K
remote: Counting objects:  51% (71/139)�[K
remote: Counting objects:  52% (73/139)�[K
remote: Counting objects:  53% (74/139)�[K
remote: Counting objects:  54% (76/139)�[K
remote: Counting objects:  55% (77/139)�[K
remote: Counting objects:  56% (78/139)�[K
remote: Counting objects:  57% (80/139)�[K
remote: Counting objects:  58% (81/139)�[K
remote: Counting objects:  59% (83/139)�[K
remote: Counting objects:  60% (84/139)�[K
remote: Counting objects:  61% (85/139)�[K
remote: Counting objects:  62% (87/139)�[K
remote: Counting objects:  63% (88/139)�[K
remote: Counting objects:  64% (89/139)�[K
remote: Counting objects:  65% (91/139)�[K
remote: Counting objects:  66% (92/139)�[K
remote: Counting objects:  67% (94/139)�[K
remote: Counting objects:  68% (95/139)�[K
remote: Counting objects:  69% (96/139)�[K
remote: Counting objects:  70% (98/139)�[K
remote: Counting objects:  71% (99/139)�[K
remote: Counting objects:  72% (101/139)�[K
remote: Counting objects:  73% (102/139)�[K
remote: Counting objects:  74% (103/139)�[K
remote: Counting objects:  75% (105/139)�[K
remote: Counting objects:  76% (106/139)�[K
remote: Counting objects:  77% (108/139)�[K
remote: Counting objects:  78% (109/139)�[K
remote: Counting objects:  79% (110/139)�[K
remote: Counting objects:  80% (112/139)�[K
remote: Counting objects:  81% (113/139)�[K
remote: Counting objects:  82% (114/139)�[K
remote: Counting objects:  83% (116/139)�[K
remote: Counting objects:  84% (117/139)�[K
remote: Counting objects:  85% (119/139)�[K
remote: Counting objects:  86% (120/139)�[K
remote: Counting objects:  87% (121/139)�[K
remote: Counting objects:  88% (123/139)�[K
remote: Counting objects:  89% (124/139)�[K
remote: Counting objects:  90% (126/139)�[K
remote: Counting objects:  91% (127/139)�[K
remote: Counting objects:  92% (128/139)�[K
remote: Counting objects:  93% (130/139)�[K
remote: Counting objects:  94% (131/139)�[K
remote: Counting objects:  95% (133/139)�[K
remote: Counting objects:  96% (134/139)�[K
remote: Counting objects:  97% (135/139)�[K
remote: Counting objects:  98% (137/139)�[K
remote: Counting objects:  99% (138/139)�[K
remote: Counting objects: 100% (139/139)�[K
remote: Counting objects: 100% (139/139), done.�[K
remote: Compressing objects:   3% (1/31)�[K
remote: Compressing objects:   6% (2/31)�[K
remote: Compressing objects:   9% (3/31)�[K
remote: Compressing objects:  12% (4/31)�[K
remote: Compressing objects:  16% (5/31)�[K
remote: Compressing objects:  19% (6/31)�[K
remote: Compressing objects:  22% (7/31)�[K
remote: Compressing objects:  25% (8/31)�[K
remote: Compressing objects:  29% (9/31)�[K
remote: Compressing objects:  32% (10/31)�[K
remote: Compressing objects:  35% (11/31)�[K
remote: Compressing objects:  38% (12/31)�[K
remote: Compressing objects:  41% (13/31)�[K
remote: Compressing objects:  45% (14/31)�[K
remote: Compressing objects:  48% (15/31)�[K
remote: Compressing objects:  51% (16/31)�[K
remote: Compressing objects:  54% (17/31)�[K
remote: Compressing objects:  58% (18/31)�[K
remote: Compressing objects:  61% (19/31)�[K
remote: Compressing objects:  64% (20/31)�[K
remote: Compressing objects:  67% (21/31)�[K
remote: Compressing objects:  70% (22/31)�[K
remote: Compressing objects:  74% (23/31)�[K
remote: Compressing objects:  77% (24/31)�[K
remote: Compressing objects:  80% (25/31)�[K
remote: Compressing objects:  83% (26/31)�[K
remote: Compressing objects:  87% (27/31)�[K
remote: Compressing objects:  90% (28/31)�[K
remote: Compressing objects:  93% (29/31)�[K
remote: Compressing objects:  96% (30/31)�[K
remote: Compressing objects: 100% (31/31)�[K
remote: Compressing objects: 100% (31/31), done.�[K
Receiving objects:   0% (1/195)   
Receiving objects:   1% (2/195)   
Receiving objects:   2% (4/195)   
Receiving objects:   3% (6/195)   
Receiving objects:   4% (8/195)   
Receiving objects:   5% (10/195)   
Receiving objects:   6% (12/195)   
Receiving objects:   7% (14/195)   
Receiving objects:   8% (16/195)   
Receiving objects:   9% (18/195)   
Receiving objects:  10% (20/195)   
Receiving objects:  11% (22/195)   
Receiving objects:  12% (24/195)   
Receiving objects:  13% (26/195)   
Receiving objects:  14% (28/195)   
Receiving objects:  15% (30/195)   
Receiving objects:  16% (32/195)   
Receiving objects:  17% (34/195)   
Receiving objects:  18% (36/195)   
Receiving objects:  19% (38/195)   
Receiving objects:  20% (39/195)   
Receiving objects:  21% (41/195)   
Receiving objects:  22% (43/195)   
Receiving objects:  23% (45/195)   
Receiving objects:  24% (47/195)   
Receiving objects:  25% (49/195)   
Receiving objects:  26% (51/195)   
Receiving objects:  27% (53/195)   
Receiving objects:  28% (55/195)   
Receiving objects:  29% (57/195)   
Receiving objects:  30% (59/195)   
Receiving objects:  31% (61/195)   
Receiving objects:  32% (63/195)   
Receiving objects:  33% (65/195)   
Receiving objects:  34% (67/195)   
Receiving objects:  35% (69/195)   
Receiving objects:  36% (71/195)   
Receiving objects:  37% (73/195)   
Receiving objects:  38% (75/195)   
Receiving objects:  39% (77/195)   
Receiving objects:  40% (78/195)   
Receiving objects:  41% (80/195)   
Receiving objects:  42% (82/195)   
Receiving objects:  43% (84/195)   
Receiving objects:  44% (86/195)   
Receiving objects:  45% (88/195)   
Receiving objects:  46% (90/195)   
Receiving objects:  47% (92/195)   
Receiving objects:  48% (94/195)   
Receiving objects:  49% (96/195)   
Receiving objects:  50% (98/195)   
Receiving objects:  51% (100/195)   
Receiving objects:  52% (102/195)   
Receiving objects:  53% (104/195)   
Receiving objects:  54% (106/195)   
Receiving objects:  55% (108/195)   
Receiving objects:  56% (110/195)   
Receiving objects:  57% (112/195)   
Receiving objects:  58% (114/195)   
Receiving objects:  59% (116/195)   
Receiving objects:  60% (117/195)   
Receiving objects:  61% (119/195)   
Receiving objects:  62% (121/195)   
Receiving objects:  63% (123/195)   
Receiving objects:  64% (125/195)   
Receiving objects:  65% (127/195)   
Receiving objects:  66% (129/195)   
Receiving objects:  67% (131/195)   
Receiving objects:  68% (133/195)   
Receiving objects:  69% (135/195)   
Receiving objects:  70% (137/195)   
Receiving objects:  71% (139/195)   
Receiving objects:  72% (141/195)   
Receiving objects:  73% (143/195)   
Receiving objects:  74% (145/195)   
Receiving objects:  75% (147/195)   
Receiving objects:  76% (149/195)   
Receiving objects:  77% (151/195)   
Receiving objects:  78% (153/195)   
Receiving objects:  79% (155/195)   
Receiving objects:  80% (156/195)   
Receiving objects:  81% (158/195)   
Receiving objects:  82% (160/195)   
Receiving objects:  83% (162/195)   
Receiving objects:  84% (164/195)   
Receiving objects:  85% (166/195)   
Receiving objects:  86% (168/195)   
Receiving objects:  87% (170/195)   
Receiving objects:  88% (172/195)   
Receiving objects:  89% (174/195)   
Receiving objects:  90% (176/195)   
Receiving objects:  91% (178/195)   
Receiving objects:  92% (180/195)   
Receiving objects:  93% (182/195)   
Receiving objects:  94% (184/195)   
Receiving objects:  95% (186/195)   
Receiving objects:  96% (188/195)   
Receiving objects:  97% (190/195)   
Receiving objects:  98% (192/195)   
Receiving objects:  99% (194/195)   
remote: Total 195 (delta 110), reused 118 (delta 108), pack-reused 56�[K
Receiving objects: 100% (195/195)   
Receiving objects: 100% (195/195), 619.46 KiB | 0 bytes/s, done.
Resolving deltas:   0% (0/124)   
Resolving deltas:   1% (2/124)   
Resolving deltas:   2% (3/124)   
Resolving deltas:   4% (6/124)   
Resolving deltas:   6% (8/124)   
Resolving deltas:   8% (10/124)   
Resolving deltas:   9% (12/124)   
Resolving deltas:  10% (13/124)   
Resolving deltas:  11% (14/124)   
Resolving deltas:  12% (15/124)   
Resolving deltas:  13% (17/124)   
Resolving deltas:  14% (18/124)   
Resolving deltas:  15% (19/124)   
Resolving deltas:  16% (20/124)   
Resolving deltas:  17% (22/124)   
Resolving deltas:  19% (24/124)   
Resolving deltas:  20% (26/124)   
Resolving deltas:  22% (28/124)   
Resolving deltas:  23% (29/124)   
Resolving deltas:  26% (33/124)   
Resolving deltas:  27% (34/124)   
Resolving deltas:  28% (35/124)   
Resolving deltas:  29% (36/124)   
Resolving deltas:  37% (46/124)   
Resolving deltas:  42% (53/124)   
Resolving deltas:  43% (54/124)   
Resolving deltas:  44% (55/124)   
Resolving deltas:  45% (56/124)   
Resolving deltas:  47% (59/124)   
Resolving deltas:  48% (60/124)   
Resolving deltas:  49% (61/124)   
Resolving deltas:  50% (62/124)   
Resolving deltas:  52% (65/124)   
Resolving deltas:  53% (66/124)   
Resolving deltas:  55% (69/124)   
Resolving deltas:  59% (74/124)   
Resolving deltas:  61% (76/124)   
Resolving deltas:  62% (78/124)   
Resolving deltas:  64% (80/124)   
Resolving deltas:  66% (83/124)   
Resolving deltas:  68% (85/124)   
Resolving deltas:  69% (86/124)   
Resolving deltas:  70% (87/124)   
Resolving deltas:  71% (89/124)   
Resolving deltas:  72% (90/124)   
Resolving deltas:  73% (91/124)   
Resolving deltas:  74% (92/124)   
Resolving deltas:  75% (93/124)   
Resolving deltas:  76% (95/124)   
Resolving deltas:  77% (96/124)   
Resolving deltas:  78% (97/124)   
Resolving deltas:  79% (98/124)   
Resolving deltas:  80% (100/124)   
Resolving deltas:  81% (101/124)   
Resolving deltas:  82% (102/124)   
Resolving deltas:  83% (103/124)   
Resolving deltas:  84% (105/124)   
Resolving deltas:  85% (106/124)   
Resolving deltas:  86% (107/124)   
Resolving deltas:  87% (108/124)   
Resolving deltas:  88% (110/124)   
Resolving deltas:  89% (111/124)   
Resolving deltas:  90% (112/124)   
Resolving deltas:  91% (114/124)   
Resolving deltas:  92% (115/124)   
Resolving deltas:  93% (116/124)   
Resolving deltas:  94% (117/124)   
Resolving deltas:  95% (118/124)   
Resolving deltas:  96% (120/124)   
Resolving deltas:  97% (121/124)   
Resolving deltas:  98% (122/124)   
Resolving deltas:  99% (123/124)   
Resolving deltas: 100% (124/124)   
Resolving deltas: 100% (124/124), completed with 71 local objects.
From https://github.com/python/cpython
 * branch            main       -> FETCH_HEAD
 * [new tag]         v3.9.14    -> v3.9.14
Note: checking out '67444902a0f10419a557d0a2d3b8675c31b075a9'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by performing another checkout.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -b with the checkout command again. Example:

  git checkout -b new_branch_name

HEAD is now at 6744490... GH-96572: fix use after free in trace refs build mode (#96618)
Switched to and reset branch 'main'

Objects/frameobject.c: In function ‘_PyFrame_FastToLocalsWithError’:
Objects/frameobject.c:1144:5: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing]
     if (lasti < 0 && _Py_OPCODE(_PyCode_CODE(co)[0]) == COPY_FREE_VARS
     ^
Objects/obmalloc.c:1450:1: warning: always_inline function might not be inlinable [-Wattributes]
 arena_map_get(block *p, int create)
 ^

make: *** [buildbottest] Error 3

@kumaraditya303 kumaraditya303 deleted the fix-ceval branch September 7, 2022 11:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
release-blocker type-crash A hard crash of the interpreter, possibly with a core dump
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants