GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-150157: fix: critical section for `PyDict_Next` in `_pickle.c` by KowalskiThomas · Pull Request #150158 · python/cpython

Conversation

@KowalskiThomas

@KowalskiThomas KowalskiThomas commented May 20, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Fixes #150157.

  • Issue: Missing critical section for PyDict_Next in _pickle.c #150157

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@KowalskiThomas
fix: pickle whichmodule has a UAF on free-threading
5d4d511
@KowalskiThomas KowalskiThomas changed the title fix: critical section for PyDict_Next in _pickle.c gh-150157: fix: critical section for PyDict_Next in _pickle.c May 20, 2026
@bedevere-app bedevere-app Bot mentioned this pull request May 20, 2026
Missing critical section for PyDict_Next in _pickle.c #150157
Closed
vstinner
vstinner reviewed May 21, 2026
View reviewed changes
Comment thread Modules/_pickle.c Resolved

Uh oh!

There was an error while loading. Please reload this page.
KowalskiThomas added 2 commits May 21, 2026 20:45
@KowalskiThomas
review: address comment on code order
1fd7911
@KowalskiThomas
misc: add news entry
adea962
@KowalskiThomas
KowalskiThomas marked this pull request as ready for review May 21, 2026 18:50
@bedevere-app bedevere-app Bot added the awaiting review label May 21, 2026
@KowalskiThomas
KowalskiThomas requested a review from vstinner May 22, 2026 07:01
serhiy-storchaka
serhiy-storchaka reviewed May 29, 2026
View reviewed changes
Comment thread Misc/NEWS.d/next/Library/2026-05-21-20-47-45.gh-issue-150157.ZvmO-bQZ.rst Outdated
@@ -0,0 +1,2 @@
Fix a heap use-after-free in :mod:`pickle`\'s ``whichmodule`` on

@serhiy-storchaka serhiy-storchaka May 29, 2026

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

whichmodule is an internal detail not visible to users. Describe the cause in general words, like it looks from user's point.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@KowalskiThomas KowalskiThomas May 30, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How does the following sound? (I pushed it for now.)

Fix a potential crash occurring when pickling objects
concurrently in free-threaded builds.

Tried to make it clear from and end-user perspective while not sounding too scary (since it's a rare race condition), hence the potential.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@serhiy-storchaka serhiy-storchaka May 30, 2026

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not just a matter of luck. There have to be several conditions for this to happen. First, we must pickle by name an object without the __module__ attribute. Second, sys.modules should be concurrently modified (in a specific way, but we will leave this).

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@KowalskiThomas KowalskiThomas May 30, 2026

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, I feared this might be a little bit too detail-y. I'll rephrase it again 😅

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@KowalskiThomas KowalskiThomas May 30, 2026

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated to this.

Fix a crash in free-threaded builds that occurs when pickling
an object without a ``__module__`` attribute while :data:`sys.modules`
is concurrently being modified.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@KowalskiThomas
KowalskiThomas force-pushed the kowalski/fix-pickle-whichmodule-has-a-uaf-on-free-threading branch from eb71e46 to 88e8cb8 Compare May 30, 2026 15:26
@KowalskiThomas
misc: update news entry
3981cfc
@KowalskiThomas
KowalskiThomas force-pushed the kowalski/fix-pickle-whichmodule-has-a-uaf-on-free-threading branch from 88e8cb8 to 3981cfc Compare May 30, 2026 15:28
@KowalskiThomas
misc: update news entry
012200c
@KowalskiThomas
KowalskiThomas requested a review from serhiy-storchaka May 30, 2026 19:53
serhiy-storchaka
serhiy-storchaka reviewed May 31, 2026
View reviewed changes

@serhiy-storchaka serhiy-storchaka left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically, this is not correct, most objects do not have such issue even without having __module__, only objects pickled by name (some singletons, named constants or enum-like objects). But if you think that the current wording is enough, we can leave it.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@KowalskiThomas
misc: update news entry
49b9a1f
@KowalskiThomas

KowalskiThomas commented May 31, 2026

Copy link
Copy Markdown
Contributor Author

@serhiy-storchaka Right... Thanks for bearing with me; I've updated it again and I think it should be clear and accurate now 😅

Latest version is:

Fix a crash in free-threaded builds that occurs when pickling by name
objects without a ``__module__`` attribute while :data:`sys.modules`
is concurrently being modified.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@KowalskiThomas
KowalskiThomas requested a review from serhiy-storchaka June 1, 2026 12:23
vstinner
vstinner approved these changes Jun 1, 2026
View reviewed changes

@vstinner vstinner left a comment •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@serhiy-storchaka: I will leave it to you to do the final review :-)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Jun 1, 2026
serhiy-storchaka
serhiy-storchaka approved these changes Jun 1, 2026
View reviewed changes

@serhiy-storchaka serhiy-storchaka left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. 👍

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@serhiy-storchaka
serhiy-storchaka merged commit c5516e7 into python:main Jun 1, 2026
104 of 106 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Jun 1, 2026
@serhiy-storchaka serhiy-storchaka added needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Jun 1, 2026
@miss-islington-app

miss-islington-app Bot commented Jun 1, 2026

Copy link
Copy Markdown

Thanks @KowalskiThomas for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Jun 1, 2026

Copy link
Copy Markdown

Thanks @KowalskiThomas for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Jun 1, 2026

Copy link
Copy Markdown

Thanks @KowalskiThomas for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Jun 1, 2026

Copy link
Copy Markdown

GH-150710 is a backport of this pull request to the 3.14 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Jun 1, 2026
@miss-islington-app

miss-islington-app Bot commented Jun 1, 2026

Copy link
Copy Markdown

Sorry, @KowalskiThomas and @serhiy-storchaka, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c5516e7e371f7b273eb37c7b65f14ef14ee81f11 3.13
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned serhiy-storchaka Jun 1, 2026
@bedevere-app

bedevere-app Bot commented Jun 1, 2026

Copy link
Copy Markdown

GH-150711 is a backport of this pull request to the 3.15 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Jun 1, 2026
serhiy-storchaka pushed a commit that referenced this pull request Jun 1, 2026
@miss-islington @KowalskiThomas
[3.14] gh-150157: Fix critical section for PyDict_Next() in _pickle.c (…
c15f066 
…GH-150158) (GH-150710)

(cherry picked from commit c5516e7)

Co-authored-by: Thomas Kowalski <[email protected]>
serhiy-storchaka pushed a commit that referenced this pull request Jun 1, 2026
@miss-islington @KowalskiThomas
[3.15] gh-150157: Fix critical section for PyDict_Next() in _pickle.c (…
b65c282 
…GH-150158) (#150711)

(cherry picked from commit c5516e7)

Co-authored-by: Thomas Kowalski <[email protected]>
@StanFromIreland

StanFromIreland commented Jun 5, 2026

Copy link
Copy Markdown
Member

@KowalskiThomas are you able to do the backport to 3.13 (see bot comment above)?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@KowalskiThomas

KowalskiThomas commented Jun 5, 2026

Copy link
Copy Markdown
Contributor Author

I meant to do it but then it slipped my mind. I'll take care of it today, thanks for reminding me!
StanFromIreland reacted with heart emoji
All reactions
  • ❤️ 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@KowalskiThomas KowalskiThomas mentioned this pull request Jun 5, 2026
[3.13] gh-150157: add critical section for PyDict_Next in _pickle.c #150951
Closed
@KowalskiThomas

KowalskiThomas commented Jun 5, 2026

Copy link
Copy Markdown
Contributor Author

Created #150951 where I believe I correctly handled the conflict (pretty much had to re-make the change from scratch but I believe it's good).
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@serhiy-storchaka serhiy-storchaka removed the needs backport to 3.13 only security fixes label Jul 15, 2026
@serhiy-storchaka serhiy-storchaka removed their assignment Jul 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vstinner vstinner vstinner approved these changes
@serhiy-storchaka serhiy-storchaka serhiy-storchaka approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Missing critical section for PyDict_Next in _pickle.c

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@KowalskiThomas @StanFromIreland @vstinner @serhiy-storchaka
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.