From ea57ffa02e42dc430f2cb2312cdfc3d7ff7a5c70 Mon Sep 17 00:00:00 2001 From: Kumar Aditya Date: Thu, 13 Mar 2025 00:11:52 +0530 Subject: gh-131141: fix data race in instrumentation while registering callback (#131142) --- .../2025-03-12-11-19-46.gh-issue-131141.tQz594.rst | 1 + Python/instrumentation.c | 23 ++++++++++++---------- 2 files changed, 14 insertions(+), 10 deletions(-) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2025-03-12-11-19-46.gh-issue-131141.tQz594.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-03-12-11-19-46.gh-issue-131141.tQz594.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-03-12-11-19-46.gh-issue-131141.tQz594.rst new file mode 100644 index 0000000..c1ea679 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-03-12-11-19-46.gh-issue-131141.tQz594.rst @@ -0,0 +1 @@ +Fix data race in :data:`sys.monitoring` instrumentation while registering callback. diff --git a/Python/instrumentation.c b/Python/instrumentation.c index f871d19..c180f4c 100644 --- a/Python/instrumentation.c +++ b/Python/instrumentation.c @@ -3006,13 +3006,6 @@ static PyObject *make_branch_handler(int tool_id, PyObject *handler, bool right) return (PyObject *)callback; } -/* Consumes a reference to obj */ -static PyObject *exchange_callables(int tool_id, int event_id, PyObject *obj) -{ - PyInterpreterState *is = _PyInterpreterState_GET(); - return _Py_atomic_exchange_ptr(&is->monitoring_callables[tool_id][event_id], obj); -} - PyObject * _PyMonitoring_RegisterCallback(int tool_id, int event_id, PyObject *obj) { @@ -3036,11 +3029,21 @@ _PyMonitoring_RegisterCallback(int tool_id, int event_id, PyObject *obj) return NULL; } } - Py_XDECREF(exchange_callables(tool_id, PY_MONITORING_EVENT_BRANCH_RIGHT, right)); - res = exchange_callables(tool_id, PY_MONITORING_EVENT_BRANCH_LEFT, left); + PyInterpreterState *interp = _PyInterpreterState_GET(); + _PyEval_StopTheWorld(interp); + PyObject *old_right = interp->monitoring_callables[tool_id][PY_MONITORING_EVENT_BRANCH_RIGHT]; + interp->monitoring_callables[tool_id][PY_MONITORING_EVENT_BRANCH_RIGHT] = right; + res = interp->monitoring_callables[tool_id][PY_MONITORING_EVENT_BRANCH_LEFT]; + interp->monitoring_callables[tool_id][PY_MONITORING_EVENT_BRANCH_LEFT] = left; + _PyEval_StartTheWorld(interp); + Py_XDECREF(old_right); } else { - res = exchange_callables(tool_id, event_id, Py_XNewRef(obj)); + PyInterpreterState *interp = _PyInterpreterState_GET(); + _PyEval_StopTheWorld(interp); + res = interp->monitoring_callables[tool_id][event_id]; + interp->monitoring_callables[tool_id][event_id] = Py_XNewRef(obj); + _PyEval_StartTheWorld(interp); } if (res != NULL && Py_TYPE(res) == &_PyLegacyBranchEventHandler_Type) { _PyLegacyBranchEventHandler *wrapper = (_PyLegacyBranchEventHandler *)res; -- cgit v0.12