GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-148820: Fix _PyRawMutex use-after-free on spurious semaphore wakeup by colesbury · Pull Request #148852 · python/cpython

Conversation

colesbury commented Apr 21, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

_PyRawMutex_UnlockSlow CAS-removes the waiter from the list and then calls _PySemaphore_Wakeup, with no handshake. If _PySemaphore_Wait returns Py_PARK_INTR, the waiter can destroy its stack-allocated semaphore before the unlocker's Wakeup runs, causing a fatal error from ReleaseSemaphore / sem_post.

Loop in _PyRawMutex_LockSlow until _PySemaphore_Wait returns Py_PARK_OK, which is only signalled when a matching Wakeup has been observed.

Also include GetLastError() and the handle in the Windows fatal messages in _PySemaphore_Init, _PySemaphore_Wait, and _PySemaphore_Wakeup to make similar races easier to diagnose in the future.

Issue: _PySemaphore_Wakeup: parking_lot: ReleaseSemaphore failed #148820

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          pythongh-148820: Fix _PyRawMutex use-after-free on spurious semaphore…

de2e445

… wakeup

_PyRawMutex_UnlockSlow CAS-removes the waiter from the list and then
calls _PySemaphore_Wakeup, with no handshake. If _PySemaphore_Wait
returns Py_PARK_INTR, the waiter can destroy its stack-allocated
semaphore before the unlocker's Wakeup runs, causing a fatal error from
ReleaseSemaphore / sem_post.

Loop in _PyRawMutex_LockSlow until _PySemaphore_Wait returns Py_PARK_OK,
which is only signalled when a matching Wakeup has been observed.

Also include GetLastError() and the handle in the Windows fatal messages
in _PySemaphore_Init, _PySemaphore_Wait, and _PySemaphore_Wakeup to make
similar races easier to diagnose in the future.

colesbury added topic-free-threading needs backport to 3.13

only security fixes

needs backport to 3.14 bugs and security fixes labels

Apr 21, 2026

bedevere-app Bot mentioned this pull request

Apr 21, 2026

_PySemaphore_Wakeup: parking_lot: ReleaseSemaphore failed #148820

Closed

colesbury commented Apr 21, 2026

Copy link

Copy Markdown

Contributor Author

I played around with adding a regression test for this, but I think it's trick to get right. You have to raise a SIGINT at just the right point. However, if you raise SIGINT too frequently you can cause a stack overflow in the main thread due to Python signal handlers being called within Python signal handlers...

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

colesbury marked this pull request as ready for review

April 22, 2026 00:58

bedevere-app Bot added the awaiting core review label

Apr 22, 2026

colesbury requested a review from mpage

April 22, 2026 00:58

mpage approved these changes

Apr 22, 2026

View reviewed changes

mpage left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

bedevere-app Bot added awaiting merge and removed awaiting core review labels

Apr 22, 2026

colesbury merged commit ad3c5b7 into python:main

Apr 22, 2026

66 checks passed

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Apr 22, 2026

Copy link

Copy Markdown

Thanks @colesbury for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the awaiting merge label

Apr 22, 2026

miss-islington-app Bot commented Apr 22, 2026

Copy link

Copy Markdown

Sorry, @colesbury, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker ad3c5b7958b890382f431a53349320cb7c84d405 3.14

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

colesbury deleted the gh-148820-raw-mutex-park-intr branch

April 22, 2026 18:31

miss-islington-app Bot assigned colesbury

Apr 22, 2026

miss-islington-app Bot commented Apr 22, 2026

Copy link

Copy Markdown

Sorry, @colesbury, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker ad3c5b7958b890382f431a53349320cb7c84d405 3.13

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot commented Apr 22, 2026

Copy link

Copy Markdown

GH-148884 is a backport of this pull request to the 3.14 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label

Apr 22, 2026

bedevere-app Bot commented Apr 22, 2026

Copy link

Copy Markdown

GH-148885 is a backport of this pull request to the 3.13 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.13 only security fixes label

Apr 22, 2026

colesbury added a commit that referenced this pull request

Apr 22, 2026


          [3.13] gh-148820: Fix _PyRawMutex use-after-free on spurious semaphor…

1b2301c

…e wakeup (gh-148852) (#148885)

_PyRawMutex_UnlockSlow CAS-removes the waiter from the list and then
calls _PySemaphore_Wakeup, with no handshake. If _PySemaphore_Wait
returns Py_PARK_INTR, the waiter can destroy its stack-allocated
semaphore before the unlocker's Wakeup runs, causing a fatal error from
ReleaseSemaphore / sem_post.

Loop in _PyRawMutex_LockSlow until _PySemaphore_Wait returns Py_PARK_OK,
which is only signalled when a matching Wakeup has been observed.

Also include GetLastError() and the handle in the Windows fatal messages
in _PySemaphore_Init, _PySemaphore_Wait, and _PySemaphore_Wakeup to make
similar races easier to diagnose in the future.

(cherry picked from commit ad3c5b7)

colesbury added a commit that referenced this pull request

Apr 22, 2026


          [3.14] gh-148820: Fix _PyRawMutex use-after-free on spurious semaphor…

e5d5541

…e wakeup (gh-148852) (#148884)

_PyRawMutex_UnlockSlow CAS-removes the waiter from the list and then
calls _PySemaphore_Wakeup, with no handshake. If _PySemaphore_Wait
returns Py_PARK_INTR, the waiter can destroy its stack-allocated
semaphore before the unlocker's Wakeup runs, causing a fatal error from
ReleaseSemaphore / sem_post.

Loop in _PyRawMutex_LockSlow until _PySemaphore_Wait returns Py_PARK_OK,
which is only signalled when a matching Wakeup has been observed.

Also include GetLastError() and the handle in the Windows fatal messages
in _PySemaphore_Init, _PySemaphore_Wait, and _PySemaphore_Wakeup to make
similar races easier to diagnose in the future.

(cherry picked from commit ad3c5b7)

ljfp pushed a commit to ljfp/cpython that referenced this pull request

Apr 25, 2026


          pythongh-148820: Fix _PyRawMutex use-after-free on spurious semaphore…

a2e4eb1

… wakeup (pythongh-148852)

_PyRawMutex_UnlockSlow CAS-removes the waiter from the list and then
calls _PySemaphore_Wakeup, with no handshake. If _PySemaphore_Wait
returns Py_PARK_INTR, the waiter can destroy its stack-allocated
semaphore before the unlocker's Wakeup runs, causing a fatal error from
ReleaseSemaphore / sem_post.

Loop in _PyRawMutex_LockSlow until _PySemaphore_Wait returns Py_PARK_OK,
which is only signalled when a matching Wakeup has been observed.

Also include GetLastError() and the handle in the Windows fatal messages
in _PySemaphore_Init, _PySemaphore_Wait, and _PySemaphore_Wakeup to make
similar races easier to diagnose in the future.

nascheme mentioned this pull request

Jul 14, 2026

Backport free-threading memory-safety fixes to 3.14 and 3.15 #153714

Closed

openjiuwen-collaboration-bot Bot mentioned this pull request

Sep 8, 2026

[Bug]:执行过程中服务挂掉，没有自动恢复 openJiuwen-ai/jiuwenswarm#4113

Closed

1 of 3 tasks

Reviewers

mpage

mpage approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

colesbury

Labels

topic-free-threading

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

colesbury commented Apr 21, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

colesbury commented Apr 21, 2026

Uh oh!

mpage left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington-app Bot commented Apr 22, 2026

Uh oh!

miss-islington-app Bot commented Apr 22, 2026

Uh oh!

miss-islington-app Bot commented Apr 22, 2026

Uh oh!

bedevere-app Bot commented Apr 22, 2026

Uh oh!

bedevere-app Bot commented Apr 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

colesbury commented Apr 21, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.