GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-153296: Fix thread-safety data race in io.StringIO iterator by Twix1288 · Pull Request #153368 · python/cpython

Conversation

@Twix1288

@Twix1288 Twix1288 commented Jul 8, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Summary

This PR fixes a TSAN-reported data race and segmentation fault when iterating over an io.StringIO object while it is being concurrently mutated (e.g., via write()).

Details

In the free-threaded build, io.StringIO memory safety is typically enforced automatically via Argument Clinic wrappers that acquire Py_BEGIN_CRITICAL_SECTION(self) for operations like readline and write.
However, the __next__ method triggered during loop iteration bypasses these wrappers. It is implemented in C as stringio_iternext, directly assigned to the tp_iternext slot. Previously, this slot accessed the string buffer (self->buf) and advanced self->pos without acquiring the object lock.
If another thread concurrently called write(), it would execute with the lock held but with its underlying self->pos mutating asynchronously. This led to out-of-bounds memset writes and use-after-free conditions.
This fix conceptually mirrors the implementation used for io.BytesIO: it splits the internal logic into stringio_iternext_lock_held and adds a wrapper stringio_iternext that properly secures the object's critical section.

  • Issue: Use-after-free with a concurrent stringio_iternext #153296

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@bedevere-app

bedevere-app Bot commented Jul 8, 2026

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot mentioned this pull request Jul 8, 2026
Use-after-free with a concurrent stringio_iternext #153296
Closed
@bedevere-app bedevere-app Bot added the awaiting review label Jul 8, 2026
@Twix1288
pythongh-153296: Fix thread-safety data race in io.StringIO iterator
21fafe9
@Twix1288
Twix1288 force-pushed the feature/new-work branch from 3851a6a to 21fafe9 Compare July 8, 2026 22:32
@Twix1288
pythongh-153296: Fix flaky test_rollover_at_midnight on Windows
8ba4fe6
@Twix1288
Twix1288 requested a review from vsajip as a code owner July 8, 2026 23:04
@Twix1288
Revert "pythongh-153296: Fix flaky test_rollover_at_midnight on Windows"
1592fc9
This reverts commit 8ba4fe6.
@Twix1288

Twix1288 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

PR is done and tests are complete, should be good to go. Thanks!

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@vsajip

vsajip commented Jul 9, 2026

Copy link
Copy Markdown
Member

I don't think I'm the best person to review this - I suggest you find someone who has more familiarity with this area of the code.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@vsajip
vsajip removed their request for review July 9, 2026 20:34
@Twix1288
Merge branch 'main' into feature/new-work
3ae15b6
@python-cla-bot

python-cla-bot Bot commented Jul 10, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

All commit authors signed the Contributor License Agreement.

CLA signed

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

kumaraditya303
kumaraditya303 approved these changes Jul 25, 2026
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Jul 25, 2026
@kumaraditya303
kumaraditya303 merged commit bff0051 into python:main Jul 25, 2026
58 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot removed the awaiting merge label Jul 25, 2026
mbeijen pushed a commit to mbeijen/cpython that referenced this pull request Aug 14, 2026
@Twix1288 @mbeijen
pythongh-153296: Fix thread-safety data race in io.StringIO iterator (p…
720ee63
…ython#153368)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kumaraditya303 kumaraditya303 kumaraditya303 approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@Twix1288 @vsajip @kumaraditya303
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.