Description

b-pass

opened on May 17, 2025

Issue body actions

Crash report

What happened?

Stack trace:

#0  tstate_delete_common.constprop.0 (tstate=tstate@entry=0x555555666ca0, release_gil=0) at ../Python/pystate.c:1854
#1  0x00007ffff78cd341 in zapthreads (interp=0x7ffff74c8010) at ../Python/pystate.c:1915
#2  PyInterpreterState_Delete (interp=0x7ffff74c8010) at ../Python/pystate.c:1016
#3  0x00005555555552ef in main () at repro.c:16

(note the address passed to tstate_delete_common is definitely corrupt, and not the address of any PyThreadState created in this program)

This was triggered by creating a new PyThreeadState for the interpreter, switching to it, deleting an old thread state for the same interpreter, and then calling Py_EndInterpreter (on the new thread state).

repro.c:

#include <Python.h>

int main()
{
        Py_Initialize();

        PyThreadState *orig = NULL;
        PyInterpreterConfig cfg =  _PyInterpreterConfig_INIT;
        Py_NewInterpreterFromConfig(&orig, &cfg);

        PyThreadState *temp = PyThreadState_New(orig->interp);
        PyThreadState_Swap(temp);
        PyThreadState_Clear(orig);
        PyThreadState_Delete(orig);
        Py_EndInterpreter(temp);

        Py_Finalize();
}

Compiled with $ gcc -O1 -ggdb repro.cpp -I/usr/include/python3.14 -lpython3.14

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.14.0b1 (main, May 8 2025, 08:57:13) [GCC 13.3.0]

Linked PRs

• gh-134144: Fix use-after-free in zapthreads() #134145
• [3.14] gh-134144: Fix use-after-free in zapthreads() (GH-134145) #134182

Activity

1. b-pass

   added

   type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

   on May 17, 2025
2. ZeroIntensity

   added

   topic-subinterpreters

   on May 17, 2025
3. github-project-automation

   added this to Subinterpreterson May 17, 2025
4. github-project-automation

   moved this to Todo in Subinterpreterson May 17, 2025
5. ZeroIntensity commented on May 17, 2025

   

   ZeroIntensity

   on May 17, 2025

   Member

   More actions

   @ericsnowcurrently This is the zapthreads problem that I was talking about yesterday.

   I'm pretty sure #128640 will fix this.

   Reacted by Eric Snow
6. ZeroIntensity

   added

   3.14bugs and security fixesbugs and security fixes

   3.15bugs and security fixesbugs and security fixes

   on May 17, 2025
7. b-pass commented on May 17, 2025

   

   b-pass

   on May 17, 2025

   ContributorAuthor

   More actions

   I updated the example code to a complete compilable description, this crashes for me. Using deadsnakes repo on ubuntu 24.04, which is 3.14.b1.
8. ZeroIntensity commented on May 17, 2025

   

   ZeroIntensity

   on May 17, 2025

   Member

   More actions

   Huh, that repro looks wrong. PyThreadState_Delete cannot be called with a thread state that is attached.
9. b-pass commented on May 17, 2025

   

   b-pass

   on May 17, 2025

   ContributorAuthor

   More actions

   Huh, that repro looks wrong. PyThreadState_Delete cannot be called with a thread state that is attached.

   Does the PyThreadState_Swap not detach it?
10. ZeroIntensity commented on May 17, 2025

    

    ZeroIntensity

    on May 17, 2025

    Member

    More actions

    Oh wait, I see that you delete orig, not temp.
11. picnixz

    added

    interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)

    on May 17, 2025
12. b-pass commented on May 18, 2025

    

    b-pass

    on May 18, 2025

    ContributorAuthor

    More actions

    If it matters, the reason I am doing it this way is that in 3.12 you can't actually delete (via PyThreadState_Delete) the first PyThreadState of the interpreter ... it looks to me like it never gets zero'd out (because it is the one that has storage inside the interpreterstate) so it causes an abort when it is subsequently reallocated. :( So you have to leave that one allocated. This is fixed in 3.13+
13. kumaraditya303

    added a commit that references this issue on May 18, 2025

    gh-134144: Fix use-after-free in zapthreads() (#134145)

    f2de1e6
14. kumaraditya303

    closed this as completedin #134145on May 18, 2025
15. github-project-automation

    moved this from Todo to Done in Subinterpreterson May 18, 2025
16. miss-islington

    added a commit that references this issue on May 18, 2025

    pythongh-134144: Fix use-after-free in zapthreads() (pythonGH-134145)

    91712d2
17. kumaraditya303

    added a commit that references this issue on May 18, 2025

    [3.14] gh-134144: Fix use-after-free in zapthreads() (GH-134145) (#13…

    bb5f92a
18. Pranjal095

    added a commit that references this issue on Jul 12, 2025

    pythongh-134144: Fix use-after-free in zapthreads() (python#134145)

    2604776
19. taegyunkim

    added a commit that references this issue on Aug 4, 2025

    pythongh-134144: Fix use-after-free in zapthreads() (python#134145)

    f5ef465

Issue actions