https://github.com/python/cpython/commit/d98f2cba6131b72a8762a64f4f7af19706beb966
commit: d98f2cba6131b72a8762a64f4f7af19706beb966
branch: main
author: Jelle Zijlstra <[email protected]>
committer: JelleZijlstra <[email protected]>
date: 2026-10-22T21:50:54Z
summary:
gh-159739: Protect list storage while reporting its size (#160196)
On free-threaded builds, list.__sizeof__() reads an allocation header through
an atomically loaded storage pointer. The list's owner can resize and free that
storage between the load and the header read, producing invalid size data or an
invalid memory read. Hold the list lock while inspecting the allocation.
Backport to 3.15 and 3.14.
files:
A
Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.Aw61LR.rst
M Objects/listobject.c
diff --git
a/Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.Aw61LR.rst
b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.Aw61LR.rst
new file mode 100644
index 00000000000000..5de64814b1ca55
--- /dev/null
+++
b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.Aw61LR.rst
@@ -0,0 +1 @@
+Fix a race in ``list.__sizeof__()`` when a list is concurrently resized on a
free-threaded build.
diff --git a/Objects/listobject.c b/Objects/listobject.c
index 5ca8cdf09d3160..a01f40d57181da 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -3658,10 +3658,12 @@ list___sizeof___impl(PyListObject *self)
{
size_t res = _PyObject_SIZE(Py_TYPE(self));
#ifdef Py_GIL_DISABLED
- PyObject **ob_item = _Py_atomic_load_ptr(&self->ob_item);
+ Py_BEGIN_CRITICAL_SECTION(self);
+ PyObject **ob_item = self->ob_item;
if (ob_item != NULL) {
res += list_capacity(ob_item) * sizeof(PyObject *);
}
+ Py_END_CRITICAL_SECTION();
#else
res += (size_t)self->allocated * sizeof(PyObject *);
#endif
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
