GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-112127: Fix use-after-free in atexit.unregister() by benjaminJohnson2204 · Pull Request #114092 · python/cpython

Conversation

@benjaminJohnson2204

@benjaminJohnson2204 benjaminJohnson2204 commented Jan 15, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

This PR fixes a use-after-free error when a callback registered with atexit.register() calls atexit.unregister() or atexit._clear() in its __eq__ method, which is called by the atexit_register() C API.

I fixed the issue by increasing the refcounts of both arguments to the __eq__ check before the equality check, and decrementing them afterward.

I also added additional unit tests to test that these cases do not cause crashes.

I don't think this needs a news entry.

Issue: #112127

  • Issue: Use-after-free in unregister() of atexit module #112127

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@benjaminJohnson2204
Fix use-after-free in atexit.unregister()
6c8db8a
@ghost

ghost commented Jan 15, 2024 •
edited by ghost
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

All commit authors signed the Contributor License Agreement.
CLA signed
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Jan 15, 2024

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot added the awaiting review label Jan 15, 2024
@bedevere-app bedevere-app Bot mentioned this pull request Jan 15, 2024
Use-after-free in unregister() of atexit module #112127
Closed
@benjaminJohnson2204
Merge branch 'main' into pythongh-112127
0623581
@bedevere-app

bedevere-app Bot commented Jan 15, 2024

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
sobolevn
sobolevn reviewed Feb 12, 2024
View reviewed changes

@sobolevn sobolevn left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I have several comments.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Lib/test/_test_atexit.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/test/_test_atexit.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/test/_test_atexit.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Modules/atexitmodule.c Resolved

Uh oh!

There was an error while loading. Please reload this page.
@benjaminJohnson2204
Merge branch 'main' into pythongh-112127
8e6d5c6
@bedevere-app

bedevere-app Bot commented Feb 13, 2024

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@benjaminJohnson2204
Address code review comments in atexit tests
075c49f
@bedevere-app

bedevere-app Bot commented Feb 13, 2024

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@benjaminJohnson2204
Fix linter issue
5b022fc
@bedevere-app

bedevere-app Bot commented Feb 13, 2024

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@benjaminJohnson2204
benjaminJohnson2204 requested a review from sobolevn February 13, 2024 18:52
@serhiy-storchaka
Merge branch 'main' into pythongh-112127
1148d80
@bedevere-app

bedevere-app Bot commented Jul 17, 2024

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
serhiy-storchaka
serhiy-storchaka reviewed Jul 17, 2024
View reviewed changes
Comment thread Modules/atexitmodule.c Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/test/_test_atexit.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/test/_test_atexit.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@benjaminJohnson2204
Address PR comments
9056824
@bedevere-app

bedevere-app Bot commented Jul 18, 2024

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@benjaminJohnson2204

benjaminJohnson2204 commented Jul 18, 2024

Copy link
Copy Markdown
Contributor Author

Thanks for the feedback @serhiy-storchaka ! I updated my PR based on your comments, could you take another look when you get a chance please?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@benjaminJohnson2204
benjaminJohnson2204 requested a review from serhiy-storchaka July 18, 2024 02:57
@benjaminJohnson2204
Remove trailing whitespace
0775ca8
@bedevere-app

bedevere-app Bot commented Jul 18, 2024

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
serhiy-storchaka
serhiy-storchaka approved these changes Jul 18, 2024
View reviewed changes

@serhiy-storchaka serhiy-storchaka left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Jul 18, 2024
kumaraditya303
kumaraditya303 requested changes Jul 3, 2025
View reviewed changes

@kumaraditya303 kumaraditya303 left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are merge conflicts

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot removed the awaiting merge label Jul 3, 2025
@bedevere-app

bedevere-app Bot commented Jul 3, 2025

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@serhiy-storchaka

serhiy-storchaka commented Dec 17, 2025

Copy link
Copy Markdown
Member

There is yet one issue here. Even if it no longer crashes, it can unregister wrong function if other function was unregistered during execution of __eq__().

After finding the callback, we should check that the tuple at the current position is the same, and if it is not, iterate back until we find it (items can only be removed, not inserted before the current position, unless we play with gc.get_objects()).
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@serhiy-storchaka
serhiy-storchaka self-requested a review December 17, 2025 09:45
serhiy-storchaka
serhiy-storchaka reviewed Dec 17, 2025
View reviewed changes

@serhiy-storchaka serhiy-storchaka left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, currently the test is passed with unpatched code.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Lib/test/_test_atexit.py Outdated
cnt += 1
if cnt == 1:
self.action(o)
return self.eq_ret_val(o)

@serhiy-storchaka serhiy-storchaka Dec 17, 2025

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

self.eq_ret_val is not callable.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@serhiy-storchaka serhiy-storchaka self-assigned this Dec 17, 2025
@serhiy-storchaka
Fix tests.
143fd96
@bedevere-app

bedevere-app Bot commented Dec 17, 2025

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
serhiy-storchaka added 2 commits December 17, 2025 14:41
@serhiy-storchaka
Add a NEWS entry.
99e35c9
@serhiy-storchaka
Fix use-after-free issue in atexit.unregister
7ec0097
kumaraditya303
kumaraditya303 approved these changes Dec 17, 2025
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting changes labels Dec 17, 2025
@serhiy-storchaka
serhiy-storchaka merged commit 2b466c4 into python:main Dec 17, 2025
49 of 50 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Dec 17, 2025
@serhiy-storchaka serhiy-storchaka removed their assignment Dec 17, 2025
@serhiy-storchaka serhiy-storchaka added needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels Dec 17, 2025
@miss-islington-app

miss-islington-app Bot commented Dec 17, 2025

Copy link
Copy Markdown

Thanks @benjaminJohnson2204 for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Dec 17, 2025

Copy link
Copy Markdown

Thanks @benjaminJohnson2204 for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Dec 17, 2025

Copy link
Copy Markdown

Sorry, @benjaminJohnson2204 and @serhiy-storchaka, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 2b466c47c333106dc9522ab77898e6972e25a2c6 3.13
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned serhiy-storchaka Dec 17, 2025
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Dec 17, 2025
@benjaminJohnson2204 @serhiy-storchaka @miss-islington
pythongh-112127: Fix possible use-after-free in atexit.unregister() (p…
04b11aa 
…ythonGH-114092)

(cherry picked from commit 2b466c4)

Co-authored-by: Benjamin Johnson <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
@bedevere-app

bedevere-app Bot commented Dec 17, 2025

Copy link
Copy Markdown

GH-142878 is a backport of this pull request to the 3.14 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Dec 17, 2025
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull request Dec 17, 2025
@benjaminJohnson2204 @serhiy-storchaka
[3.13] pythongh-112127: Fix possible use-after-free in atexit.unregis…
ed7bea4 
…ter() (pythonGH-114092)

(cherry picked from commit 2b466c4)

Co-authored-by: Benjamin Johnson <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
@bedevere-app

bedevere-app Bot commented Dec 17, 2025

Copy link
Copy Markdown

GH-142880 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Dec 17, 2025
kumaraditya303 pushed a commit that referenced this pull request Dec 17, 2025
@miss-islington @benjaminJohnson2204 @serhiy-storchaka
[3.14] gh-112127: Fix possible use-after-free in atexit.unregister() (G…
8c92d66 
…H-114092) (#142878)

gh-112127: Fix possible use-after-free in atexit.unregister() (GH-114092)
(cherry picked from commit 2b466c4)

Co-authored-by: Benjamin Johnson <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull request Dec 17, 2025
@benjaminJohnson2204 @serhiy-storchaka
[3.13] pythongh-112127: Fix possible use-after-free in atexit.unregis…
3a92ca5 
…ter() (pythonGH-114092)

(cherry picked from commit 2b466c4)

Co-authored-by: Benjamin Johnson <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
serhiy-storchaka added a commit that referenced this pull request Dec 17, 2025
@serhiy-storchaka @benjaminJohnson2204
[3.13] gh-112127: Fix possible use-after-free in atexit.unregister() (G…
08d665d 
…H-114092) (GH-142880)

(cherry picked from commit 2b466c4)

Co-authored-by: Benjamin Johnson <[email protected]>
@serhiy-storchaka serhiy-storchaka removed their assignment Jul 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@serhiy-storchaka serhiy-storchaka serhiy-storchaka approved these changes
@kumaraditya303 kumaraditya303 kumaraditya303 approved these changes
@sobolevn sobolevn Awaiting requested review from sobolevn

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@benjaminJohnson2204 @serhiy-storchaka @sobolevn @kumaraditya303
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.