https://github.com/python/cpython/commit/ef35d828d4e61c435cae77967e8a1db080b20316 commit: ef35d828d4e61c435cae77967e8a1db080b20316 branch: 3.14 author: Miss Islington (bot) <[email protected]> committer: JelleZijlstra <[email protected]> date: 2026-10-22T23:51:16Z summary:
[3.14] gh-159739: Protect list storage while reporting its size (GH-160196) (#160364) On free-threaded builds, list.__sizeof__() reads an allocation header through an atomically loaded storage pointer. The list's owner can resize and free that storage between the load and the header read, producing invalid size data or an invalid memory read. Hold the list lock while inspecting the allocation. Backport to 3.15 and 3.14. (cherry picked from commit d98f2cba6131b72a8762a64f4f7af19706beb966) Co-authored-by: Jelle Zijlstra <[email protected]> files: A Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.Aw61LR.rst M Objects/listobject.c diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.Aw61LR.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.Aw61LR.rst new file mode 100644 index 00000000000000..5de64814b1ca55 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.Aw61LR.rst @@ -0,0 +1 @@ +Fix a race in ``list.__sizeof__()`` when a list is concurrently resized on a free-threaded build. diff --git a/Objects/listobject.c b/Objects/listobject.c index 7dab89a5551a73..063830c6868899 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -3560,10 +3560,12 @@ list___sizeof___impl(PyListObject *self) { size_t res = _PyObject_SIZE(Py_TYPE(self)); #ifdef Py_GIL_DISABLED - PyObject **ob_item = _Py_atomic_load_ptr(&self->ob_item); + Py_BEGIN_CRITICAL_SECTION(self); + PyObject **ob_item = self->ob_item; if (ob_item != NULL) { res += list_capacity(ob_item) * sizeof(PyObject *); } + Py_END_CRITICAL_SECTION(); #else res += (size_t)self->allocated * sizeof(PyObject *); #endif _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
