https://github.com/python/cpython/commit/2402715e10d00ef60fad2948d8461559d084eb36
commit: 2402715e10d00ef60fad2948d8461559d084eb36
branch: main
author: Sam Gross <[email protected]>
committer: colesbury <[email protected]>
date: 2024-05-09T18:52:27Z
summary:
gh-118561: Fix crash involving list.extend in free-threaded build (#118723)
The `list_preallocate_exact` function did not zero initialize array
contents. In the free-threaded build, this could expose uninitialized
memory to concurrent readers between the call to
`list_preallocate_exact` and the filling of the array contents with
items.
files:
A Misc/NEWS.d/next/Core and
Builtins/2024-05-07-16-57-56.gh-issue-118561.wNMKVd.rst
M Objects/listobject.c
diff --git a/Misc/NEWS.d/next/Core and
Builtins/2024-05-07-16-57-56.gh-issue-118561.wNMKVd.rst b/Misc/NEWS.d/next/Core
and Builtins/2024-05-07-16-57-56.gh-issue-118561.wNMKVd.rst
new file mode 100644
index 00000000000000..9eaf0abb8a6128
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and
Builtins/2024-05-07-16-57-56.gh-issue-118561.wNMKVd.rst
@@ -0,0 +1,2 @@
+Fix race condition in free-threaded build where :meth:`list.extend` could
expose
+uninitialied memory to concurrent readers.
diff --git a/Objects/listobject.c b/Objects/listobject.c
index 3c4e2d2e6ed7de..7070165014f137 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -192,6 +192,7 @@ list_preallocate_exact(PyListObject *self, Py_ssize_t size)
return -1;
}
items = array->ob_item;
+ memset(items, 0, size * sizeof(PyObject *));
#else
items = PyMem_New(PyObject*, size);
if (items == NULL) {
@@ -199,7 +200,7 @@ list_preallocate_exact(PyListObject *self, Py_ssize_t size)
return -1;
}
#endif
- self->ob_item = items;
+ FT_ATOMIC_STORE_PTR_RELEASE(self->ob_item, items);
self->allocated = size;
return 0;
}
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3/lists/python-checkins.python.org/
Member address: [email protected]
