Description

kumaraditya303

opened on Mar 3, 2023

Issue body actions

The following code segfaults the interpreter on Linux. Tested on current main.

import gc
import _thread

gc.set_threshold(1, 0, 0)

def cb(*args):
    _thread.interrupt_main()


gc.callbacks.append(cb)

def gen():
    yield 1

g = gen()
g.__next__()

Exception ignored in: <function cb at 0x7f7f4f6fe200>
Traceback (most recent call last):
  File "/workspaces/cpython/main.py", line 7, in cb
    _thread.interrupt_main()
KeyboardInterrupt: 
Exception ignored in: <function cb at 0x7f7f4f6fe200>
Traceback (most recent call last):
  File "/workspaces/cpython/main.py", line 7, in cb
    _thread.interrupt_main()
KeyboardInterrupt: 
Exception ignored in: <function cb at 0x7f7f4f6fe200>
Traceback (most recent call last):
  File "/workspaces/cpython/main.py", line 7, in cb
    _thread.interrupt_main()
KeyboardInterrupt: 
Exception ignored in: <function cb at 0x7f7f4f6fe200>
Traceback (most recent call last):
  File "/workspaces/cpython/main.py", line 7, in cb
    _thread.interrupt_main()
KeyboardInterrupt: 
Segmentation fault (core dumped)

Linked PRs

• GH-102397: Fix segfault from race condition in signal handling #102399
• [3.10] GH-102397: Fix segfault from race condition in signal handling (GH-102399) #102527
• [3.11] GH-102397: Fix segfault from race condition in signal handling (GH-102399) #102528

Activity

1. kumaraditya303

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)

   type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

   3.12only security fixesonly security fixes

   on Mar 3, 2023
2. chgnrdv commented on Mar 3, 2023

   

   chgnrdv

   on Mar 3, 2023

   Contributor

   More actions

   Guess I found a minimal reproducer:

   import _thread
   
   class Foo():
       def __del__(self):
           _thread.interrupt_main()
   
   x = Foo()

   This, as well as original one, crashes on 3.10.8, 3.11.0 and current main under Linux.
3. kumaraditya303 commented on Mar 3, 2023

   

   kumaraditya303

   on Mar 3, 2023

   ContributorAuthor

   More actions

   Yeah, both of these crashes are basically the same, they both crash in compare_handler in signal handling, I am working on a fix.

   Reacted by Owain Davies, chgnrdv, Gregory P. Smith and Oleg Iarygin
4. kumaraditya303

   added

   3.11only security fixesonly security fixes

   3.10 (EOL)end of lifeend of life

   on Mar 8, 2023
5. kumaraditya303

   added a commit that references this issue on Mar 8, 2023

   GH-102397: Fix segfault from race condition in signal handling (#102399)

   1a84cc0
6. miss-islington

   added 2 commits that reference this issue on Mar 8, 2023

   pythonGH-102397: Fix segfault from race condition in signal handling (p…

   86df1af

   pythonGH-102397: Fix segfault from race condition in signal handling (p…

   415e956
7. kumaraditya303

   added a commit that references this issue on Mar 8, 2023

   [3.10] GH-102397: Fix segfault from race condition in signal handling (…

   c4fb418
8. miss-islington

   added a commit that references this issue on Mar 8, 2023

   GH-102397: Fix segfault from race condition in signal handling (GH-10…

   7905ae7
9. kumaraditya303 commented on Mar 8, 2023

   

   kumaraditya303

   on Mar 8, 2023

   ContributorAuthor

   More actions

   Fixed in main and backported, closing.
10. kumaraditya303

    closed this as completedon Mar 8, 2023
11. carljm

    added a commit that references this issue on Mar 8, 2023

    Merge branch 'main' into inlinecomp2

    06db319

Issue actions